Privacy policy

Version of 27 September 2026.

This policy explains how Matt Lingner, trading as Flat Consent, San Francisco, California, United States ("Flat Consent", "we") handles personal data about the people who visit flatconsent.com, try the free check, sign up, or use the dashboard. Questions and requests go to hello@flatconsent.com.

It doesn't cover the visitors to our customers' websites. For them, our customers decide what happens to their data and we process it on their behalf under our Data Processing Agreement (flatconsent.com/dpa). If you visited one of our customers' sites and want your consent record deleted, contact that site; if you contact us, we'll pass your request on.

What we collect and why

Visiting flatconsent.com. Our website sets no cookies and runs no analytics or advertising. Our hosting provider (Cloudflare) handles your IP address to deliver pages and protect the site from attacks, and keeps standard security logs.

The free check. When you check a site, we store the address you entered and the results, and a one-way hash of your IP address so we can limit how many checks one network can run each hour. We delete the hash after 30 days. Results of free checks are kept so the link to them keeps working.

Your account. Your email address, the name of your workspace, the sites you add, your settings, your team members' email addresses and roles, and a record of sign-ins and changes (the audit log). If you turn on two-factor sign-in or single sign-on, we store what's needed for that (never your password for another service). We use this to provide the Service, keep it secure, and contact you about your account.

Payments. Stripe handles payments. We receive your plan, billing status and invoices, not your full card number.

Emails and support. Messages you send us and our replies. We send emails about your account, your sites (for example alerts about new trackers, and monthly reports, which you can switch off) and changes to our terms or subprocessors. We don't send marketing emails unless you ask for them, for example by joining the founding agencies list.

Founding agencies list. Your email address and the details you give, until the offer closes or you ask us to remove you.

Legal bases

Where GDPR applies: we process account, payment and support data to perform our contract with you; security logs, abuse limits and the audit log for our legitimate interest in keeping the Service secure; and the founding agencies list with your consent, which you can withdraw at any time.

Who else handles it

We use a small number of companies to run the Service, such as Cloudflare for hosting, databases and email, and Stripe for payments. The full, current list, what each does and where, is at flatconsent.com/subprocessors, and we give 30 days' notice before adding one. We don't sell personal data or share it for advertising.

Where it's stored

Consent records and your account data are stored in Cloudflare's EU region where the Service allows it. Because Flat Consent is run from the United States and some providers operate worldwide, data may be accessed from or processed in the US. Where GDPR applies, we rely on the EU Standard Contractual Clauses or an adequacy decision for these transfers.

How long we keep it

Account data: while your account is open, then deleted within 30 days of you closing it, except invoices and records we must keep by law. Free check IP hashes: 30 days. Security logs: kept by our providers for their standard periods. Support emails: as long as useful to help you, and at most 3 years after your account closes.

Your rights

You can ask to see, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent where we rely on it. Email hello@flatconsent.com and we'll reply within 30 days. If you're in the EU or UK, you can also complain to your data protection authority. If you're in California or another US state with a privacy law, you have similar rights, and we don't sell or share personal data as those laws define it.

Changes

We'll post changes here with a new date, and email account owners about significant ones before they take effect.