Privacy policy

Controller: Consent Management Inc (“Inth,” “we,” “us,” or “our”), a Delaware corporation

Notice address: 2261 Market Street STE 86311, San Francisco, CA 94114

Privacy contact: privacy@inth.com

This Privacy Policy describes how we process personal information when you use:

• inth.com marketing and documentation sites (and related subdomains we operate);
• the Inth Dashboard, Public API, Inth Agent, Code Audit, Website Audit, and related platform features;
• hosted consent infrastructure (including Project Gateway) that business customers embed on their own properties;
• booking.inth.com, status.inth.com, and the Inth CLI where they link to this Policy;
• our marketing, sales, and support activities related to the above.

Collectively, the “Service.”

c15t.com and Cookie Bench may publish product-specific notices. Where those sites link here, this Policy still governs Inth’s processing as described below.

Primary markets: United States (including California), the United Kingdom, and Europe (EEA).

Related: Cookie Notice (https://inth.com/legals/cookie-policy) · Terms of Service (https://inth.com/legals/terms-and-conditions) · Customer Data Processing Agreement (where executed)

We design this Policy for:

• US state privacy laws, especially California CCPA/CPRA;
• UK GDPR and UK PECR (cookies / electronic marketing);
• EU GDPR and ePrivacy rules for cookies and similar technologies.

Consent Management Inc is incorporated in Delaware and uses a California mailing address for notices. That does not reduce rights under UK or European law where those laws apply.

Article 27 representatives (EU and UK)

Status: appointed.

We do not maintain an establishment in the EEA or the United Kingdom. Where GDPR Article 27 / UK GDPR Article 27 requires a representative, we have appointed:

EU Representative

Euverify Limited (Ireland)

Unit 3D North Point House

North Point Business Park

New Mallow Road

Cork

T23 AT2P

Ireland

Email: gdpr@euverify.com

UK Representative

Euverify Ltd (UK)

3rd Floor

86-90 Paul Street

London

EC2A 4NE

United Kingdom

Email: gdpr@euverify.com

If you are located in the EU/EEA or the UK and have questions or concerns regarding your personal data, you may contact our appointed representative above.

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, use the secure portal:

https://gdpr.euverify.com/verify/0ef2b25b-75a8-4b05-ac18-f0364f18a4f9

The portal lets you verify our appointed representative and submit GDPR requests directly. Requests submitted through the portal are logged and tracked.

You may also contact privacy@inth.com, the ICO (UK), or your EEA supervisory authority.

2.1 You provide

• Account and profile: name, email, authentication credentials or one-time codes (as configured), profile image, organisation membership and roles, legal-acceptance records.
• Organisation and invitations: organisation name, invitee emails, roles.
• Enterprise identity (when enabled): SSO configuration metadata, directory / SCIM group and membership attributes your admin connects, and identity assertions from your organisation’s identity provider.
• Billing: billing contact email, address fields we store, plan/entitlement metadata, invoice history. Card numbers are handled by our payment provider; we may store last four digits, brand, and expiry.
• Communications: support and contact messages, email content (including inbound support email), attachments (e.g. on object storage).
• Customer content / inputs: repositories for Code Audit; sites for Website Audit; prompts and configuration for Agent/audit features; integration tokens (e.g. Google Search Console) when connected.
• Marketing preferences: opt-in/out flags.

2.2 From third parties and public sources

• Research / enrichment sources (e.g. Exa and public web, GitHub, or LinkedIn signals);
• Authentication and identity providers — WorkOS (platform auth and enterprise features); social login IdPs (GitHub, Google, and others if enabled); your organisation’s enterprise IdP (e.g. Okta, Microsoft Entra ID, Google Workspace) when you configure SSO or directory sync;
• Payment / billing partners (Stripe via Autumn);
• CRM records we create (e.g. Attio).

Enrichment is not limited to fields you typed into a form. See §3.

2.3 Automatically collected

• Device and logs: IP address, user agent, device/browser type, approximate location from IP, timestamps, paths, referrers.
• Usage and diagnostics: product events, performance metrics, error reports; session replay only where enabled and allowed under the Cookie Notice.
• Consent technology: first-party consent cookie and server-side consent records on our sites; for your properties see §5.
• Security signals: bot/fraud checks (e.g. Vercel BotID) on protected forms.

2.4 Customers’ end users (processor mode)

If you use hosted consent, we may process about your visitors: consent choices; subject or external IDs you configure; domain; policy/jurisdiction metadata; optional IAB TCF strings; experiment metadata; free-form metadata you send; masked IP (default); user agent (default).

Separately, we may process pseudonymous platform telemetry (hashed visitor fingerprints, geo, user agent, journey aggregates) as controller for security, abuse prevention, billing, and operating the Service — see §5.

AI features

Code Audit, Agent, and related features may send prompts, code, or page context to model providers through our AI gateway. We maintain zero data retention (ZDR) arrangements with SpaceXAI and Anthropic (including Claude on the commercial path) for covered routes. Organisation strict ZDR settings can further limit routing to approved ZDR providers.

Other tools and routes may differ. We do not claim that every vendor never uses data to improve their services. See product UI, organisation data controls, and subprocessor materials.

Signup enrichment

For normal B2B self-serve signup and account setup, we may automatically send your name and email (and related signals) to research and AI tools, write results to our CRM (e.g. Attio), and notify internal channels (e.g. Slack). Lawful basis: legitimate interests — understand who is signing up, prevent abuse, run relevant B2B onboarding. We do not seek special-category data through enrichment.

Opt out: email privacy@inth.com. We will stop further enrichment for your account where feasible.

See the Cookie Notice. Categories typically include:

• Strictly necessary — consent storage, authentication, security;
• Measurement — e.g. PostHog (EU), Databuddy, Speed Insights / session replay where gated;
• Marketing — after marketing consent where required: LinkedIn Insight partner 9588490, X pixel rc5sn, Meta Pixel, Reddit Pixel, and Google Ads conversion/remarketing tags (IDs as configured in the relevant ads accounts). Used for our paid campaigns (including ads we run on Google), not to host third-party ads on our sites. See Cookie Notice.

Advertising partners often act as independent controllers. GPC, where implemented, is treated as denial of measurement permission and supports opt-out of sale/share / targeted advertising.

booking.inth.com may differ from the main site banner behaviour; see the Cookie Notice until engineering aligns controls.

Two data sets:

1. Consent evidence (processor). Stored for your consent programme under your instructions (regional databases; shared regional stores with tenant isolation may be used). Defaults may include masked IP and user agent as proof fields.
2. Platform telemetry (controller). Pseudonymous request analytics (hashed fingerprints, geo, user agent, journeys) for operating, securing, and billing the Service. Configured retention is approximately 90 days for raw ClickHouse request data and 180 days for certain rollups/journeys (ops may adjust; material changes will be reflected here or in the DPA).

Deletion and assistance

We delete or anonymise account-holder data on verified request according to retention practices. For hosted end-user consent records (processor mode): we assist under your instructions when technical controls allow. We do not promise a fixed number of days for complete tenant consent-row purge in every architecture generation until that purge capability is fully shipped. You remain responsible for end-user rights responses as controller. Contact privacy@inth.com or support.

Typical subprocessors (hosted path)

Infrastructure such as Vercel, PlanetScale, Turso (legacy), ClickHouse, Upstash, Unkey, and Sentry. Email delivery via Resend. Authentication and enterprise identity via WorkOS. A current list appears in the customer DPA / trust materials when available. See also Terms § subprocessors (notice and objection).

Not production product subprocessors: build-only tools (e.g. Lingo.dev), CI agents, and similar non-runtime tooling. Primitive is not used in production.

We share personal information with:

• Service providers / processors — hosting, email (Resend), billing orchestration (Autumn / Stripe), CRM (Attio), research APIs (Exa and similar), error monitoring (Sentry), analytics (PostHog, Databuddy), status tooling (incident.io), browser automation (Kernel) where features require it, AI model providers via our gateway, and WorkOS for authentication and enterprise identity;
• WorkOS — account authentication (including magic links / AuthKit-style flows as we configure), session establishment, social login orchestration where enabled, SSO (SAML/OIDC), and directory sync / SCIM for enterprise organisations. WorkOS processes identity data as our processor. See WorkOS’s terms and privacy notice for their platform;
• Stripe — payment data (role depends on activity);
• Advertising partners — LinkedIn, X, Meta, Reddit, and Google (Google Ads) as independent controllers when marketing tags fire;
• Social login identity providers — GitHub, Google (and others if enabled) remain independent controllers of their own account systems when you sign in with them;
• Your enterprise identity provider — when your organisation enables SSO or directory sync, your IdP (for example Okta, Microsoft Entra ID, or Google Workspace as IdP) processes workforce identity under your relationship with that IdP; Inth and WorkOS receive assertions and directory attributes needed to operate access;
• Professional advisors and authorities when required by law;
• Corporate transaction parties under appropriate controls;
• Your organisation’s admins and members per roles you configure;
• Internal tools such as Slack when staff handle support or GTM (customer content may appear if included in messages).

Authentication migration note

Platform authentication is moving to WorkOS. Prior session libraries (including self-hosted Better Auth) are being retired for production login. During cutover, transitional session cookies or dual-run may appear briefly; the live auth path is WorkOS once enabled for your environment.

Sale / share (California and similar)

We do not sell personal information for money. Allowing advertising cookies/pixels when marketing permission is on may be “sharing” (or in some laws “selling”) for cross-context behavioural / targeted advertising. Opt out via:

• Your Privacy Choices / manage-preferences in the site footer;
• GPC where we honour it;
• email privacy@inth.com.

• Account data: life of the account plus a reasonable period for backup, disputes, and legal holds;
• Billing: as required by tax and accounting law;
• Support: reasonable support history period;
• Analytics and logs: tool configuration and §5 telemetry windows;
• Consent evidence: until you delete or reconfigure as controller, subject to §5 purge limits.

We implement technical and organisational measures appropriate to the risk (access controls, encryption in transit, secrets management, monitoring). No method of transmission or storage is completely secure. Customers must protect API keys, webhooks, and admin access.

We operate from the United States (Delaware corporation; California notice address). Personal information may be processed in the US and other countries where we or our providers operate. Privacy laws in those places may differ from the laws where you live.

9.1 Safeguards we use today

Where a transfer of personal data from the EEA, United Kingdom, or Switzerland requires a safeguard, we rely primarily on:

• Standard Contractual Clauses (SCCs) approved for use under the GDPR, and the UK Addendum and/or UK International Data Transfer Agreement (IDTA) where UK GDPR applies;
• other lawful mechanisms permitted by applicable law (for example, an adequacy decision where one applies, or a provider’s own valid transfer tool);
• contractual and organisational measures with our processors and, for customer end-user data in processor mode, our DPA with you.

We may also receive personal data that a service provider transfers under that provider’s own certification or clauses (for example a host or analytics vendor that is DPF-certified). That is the provider’s transfer tool, not a claim that Consent Management Inc. is itself DPF-certified.

Switzerland: If we process personal data of people in Switzerland, we apply transfer safeguards similar to those used for the EEA/UK. We have not appointed a separate Swiss representative unless published here.

Public authority requests. In certain situations, Consent Management Inc. may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Third parties. The types of third parties to whom we disclose personal information, and the purposes, are described in §6 (How we share information).

9.2 Data Privacy Framework — status: pending listing

Consent Management Inc. is working toward participation in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-US Data Privacy Framework, as set forth by the U.S. Department of Commerce.

Until Consent Management Inc. appears on the official Data Privacy Framework list at https://www.dataprivacyframework.gov/, we:

• do not claim that we “comply with” or “have certified to” the DPF for our own transfers;
• do not rely on Inth’s DPF certification as a transfer mechanism;
• continue to rely on the safeguards in §9.1 (especially SCCs and the UK Addendum/IDTA).

When our organisation is listed on that site, we will update this Policy to the full DPF participation text (Principles, FTC oversight, independent recourse, binding arbitration, onward-transfer liability, and related rights language) and may add the PrivacyTrust seal and dispute links required for that program. Until then, those certification-only statements and seal markup are not part of the live Policy.

Privacy questions and complaints (any transfer basis): contact privacy@inth.com or our DPO (see §13). EU, UK, and Swiss individuals may also contact their supervisory authority (for example the ICO in the UK) and, where applicable, our Article 27 representatives (see Primary markets and representatives).

• Cookie / Privacy Choices: footer control; browser settings; GPC where honoured.
• Marketing email: unsubscribe links.
• Account: Dashboard profile; deletion via privacy@inth.com or product flows.
• OAuth / SSO: disconnect social login in product and/or at the provider; enterprise members should use their organisation admin / IdP for access removal.
• Do Not Sell or Share / targeted ads: Your Privacy Choices, GPC, privacy@inth.com.
• Enrichment opt-out: privacy@inth.com.

Europe and United Kingdom

Where EU GDPR or UK GDPR applies and we are controller, you may access, rectify, erase, restrict, port, object, and withdraw consent. Complain to the ICO (UK) or your EEA supervisory authority. International transfers are described in §9 (SCCs / UK tools today; DPF certification pending listing).

Lawful bases are summarised in §3. Signup enrichment uses legitimate interests as described there.

When we are processor for hosted consent, contact your controller first; our DPA with the customer governs.

Article 27 representatives: appointed — see Primary markets and representatives (Euverify EU + UK; portal linked there).

United States — California first

We design for CCPA/CPRA and similar state laws (e.g. Colorado, Virginia, Connecticut, Utah, Texas, Oregon, and others as applicable).

You may have rights to know/access, delete, correct, opt out of sale/share/targeted advertising, and limit sensitive personal information. We will not discriminate for exercising rights. Request via privacy@inth.com (we may verify identity; authorised agents where law allows).

Notice at collection (California):

Retention: §7. We do not seek SSNs or precise geolocation for core CMP features. Do not submit special-category data unless a written agreement says so.

The Service is not directed to children under 16 (or higher age required by local law). We do not knowingly collect personal information from children.

We may update this Policy and change the effective date. Material changes may include additional notice. Continued use after the effective date is acceptance where permitted by law.

Consent Management Inc (Delaware corporation)

Notice address: 2261 Market Street STE 86311, San Francisco, CA 94114

Privacy: privacy@inth.com · Support: support@inth.com · Legal: legal@inth.com

Data Protection Officer

Consent Management Inc. has appointed a Data Protection Officer (DPO):

• Name: William De Ath
• Contact: privacy@inth.com
• Postal: Consent Management Inc., 2261 Market Street STE 86311, San Francisco, CA 94114, USA (mark correspondence “Data Protection Officer” / “William De Ath”)

You may contact the DPO about this Privacy Policy, personal-data processing, or data-protection rights. EU/UK individuals may also use the Article 27 representatives (Primary markets and representatives).

International transfers: see §9. DPF self-certification is pending official listing; until then we rely on SCCs and related tools (§9.1). Privacy / DPO: privacy@inth.com.