How ConsentVeil Monitor processes personal data: orders and correspondence, verification records, the exclusion register, invoicing, and the scan evidence we hold for you.
Copyright © 2026 Safe and Informed S.R.L. All rights reserved.
ConsentVeil Monitor ("Monitor", the "Service") is a technical website audit service operated by Safe and Informed S.R.L., a company incorporated in Romania ("Safe & Informed", "we", "us", "our").
This Policy explains what personal data we process when a customer orders a Monitor audit, why, on what legal basis, for how long, and what rights the people concerned have.
This Policy applies to Monitor orders, correspondence, reports and invoicing. It does not apply to the free ConsentVeil browser extension, which has its own Privacy Policy, or to the Safe & Informed website.
Where this Policy and the ConsentVeil Monitor Data Processing Agreement (the "DPA") both apply to the same data, the DPA prevails for processing we carry out as a processor or sub-processor.
The ConsentVeil browser extension processes data only locally on the user's device and sends nothing to us. Monitor is a separate service with separate code. Monitor never receives any data from users of the extension. There is no shared identifier, no shared database and no link between an extension user and a Monitor customer. Nothing in this Policy changes the extension's Privacy Policy.
There are no customer accounts, no customer-facing dashboard, no customer-facing API and no customer portal. Safe & Informed staff use an internal operator console and API to run and record scans. A customer orders by e-mail. Our staff run our scanner on company equipment located in Romania against the public pages of the customer's website, review the results by hand and send a PDF report by e-mail. Scans are started by staff, except that recurring audits expressly agreed in an Order may be queued by the internal scheduler.
4.1 As controller. For the data we hold about our customers and the people who act for them (order correspondence, verification record, exclusion register, invoicing data), we decide the purposes and means of processing and are the controller under Article 4(7) GDPR.
4.2 As processor or sub-processor. A scan records what a public web page does: request URLs, methods and resource types, browser console errors, cookie and storage keys, the visible behaviour of consent controls, screenshots. That technical evidence may incidentally contain personal data, for example a name visible on a public page. For that data we act only on the instructions of the customer that ordered the scan. The customer acts as controller or, where it orders the scan on behalf of another controller, as processor; we act as its processor under Article 4(8) GDPR or as its sub-processor, as applicable. This processing is governed by the DPA, which forms part of the Monitor Terms of Service.
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Order correspondence | name, e-mail address, company, website address, your messages and our replies, the quotation and the Order confirmation | take and perform the order, answer questions, handle disputes | see below |
| Verification record | which of the four verification methods was used and when, and the e-mail address or order reference it relies on | confirm that you are responsible for the website | see below |
| Exclusion register | domain names whose verified owner has asked us not to scan them, and the contact details of the person who asked | refuse scans of excluded domains | Art. 6(1)(f) GDPR: our legitimate interest, and the domain owner's, in preventing scans the owner has not authorised |
| Invoicing data | legal name, address, VAT or registration number, invoice history, payment status | invoicing, accounting, tax | Art. 6(1)(b) and 6(1)(c) GDPR |
Legal basis for order correspondence and the verification record. Where you order the Service as an individual, we process this data to perform the contract with you, Article 6(1)(b) GDPR. Where you act as an employee or representative of an organisation that is the customer, we process this data on the basis of our legitimate interests and those of the customer in arranging, verifying and administering the service, Article 6(1)(f) GDPR.
Where the data comes from. We obtain this data from you directly or, where you do not deal with us yourself, from the customer organisation, your employer or the authorised representative who places or administers the Order (for example when a colleague names you as the contact for a Website or as the recipient of Reports). Where we obtain your contact data this way, this Policy is the information required by Article 14 GDPR. When a customer supplies another person's contact details, we provide this notice by the first communication with that person and within the applicable Article 14 deadline, unless a documented exception applies. The customer may assist with delivery; we retain responsibility for our controller obligations.
What is necessary. To take and perform an Order we need a contact name, an e-mail address and the Website address; to invoice we need the customer's legal name, address and, where applicable, VAT or registration number. Without these we cannot conclude or perform the contract. Anything else you give us is optional.
We do not use this data for advertising, do not profile anyone and do not sell or rent personal data.
For each scan we keep the report, the redacted technical evidence it is based on and the screenshots.
What the scanner observes. Request URLs, methods and resource types; browser console errors, counted and sampled; cookies and storage keys with their attributes and value lengths; the visible behaviour of consent controls; the state of IAB TCF and Google Consent Mode signals as counts and flags; and screenshots of public pages as rendered. Each report also states the browser, locale, User-Agent string, Methodology version and time of the scan.
Redaction before report data is written. Header values, cookie values and storage values are not included in reports at all; for cookies and storage only keys, attributes and value lengths are kept. Before any report file is written, the redaction rules are applied to the target URL, the findings, the list of refused requests and the records of the outbound-request guard: query parameters not on an allowlist and path segments that look like e-mail addresses or long identifiers are replaced.
Public pages only. The scanner loads public pages inside its own isolated browser and clicks consent controls (accept, reject, withdraw) to observe what they do. It may also open the banner's settings layer and press keyboard keys (Tab, Escape) to measure whether the banner can be operated without a mouse; it reads the toggles in that layer and never changes them, and it never uses an accept, reject, save or close control for those measurements. On sites that implement the IAB TCF API or Google Consent Mode, it reads the consent signal's state in its own browser (counts and flags only, never the consent string or vendor identifiers). The scanner does not modify source code, CMS content or server configuration. Ordinary page loads and interactions with consent controls may create server or CDN logs, cookies, consent records, analytics events or similar operational records on the customer's side. The scanner does not sign in, create accounts, complete business forms or place orders. It does not authenticate into, circumvent or bypass paywalled or otherwise access-controlled areas.
Use of scan evidence. We use scan evidence only to produce the customer's report and to answer a dispute about a finding. Safe & Informed may use scan evidence to investigate and correct the customer's specific scan only as necessary to perform the Service and under the customer's documented instructions. General product development uses synthetic data or data that has first been irreversibly anonymised. We do not use scan evidence to build profiles of website visitors.
Alert e-mails. For continuous monitoring, and when you ask for it, we send a short notification to the address named in the Order or for the schedule when a scan finishes: the website scanned, the kind and time of the scan, a one-line summary of the alert conditions met, taken from a fixed list (a test that regressed; a result that could no longer be established; a classified tracking hostname newly present in the pre-consent inventory; a change of consent platform), the score and counts. No other condition is alerted; a message stating "No configured alert condition was detected" is sent only if you asked for it. Each condition is evaluated on the primary page's aggregate result and, separately, on each browser-and-locale combination and each additional page of the scan, against the same-named result of the previous comparable scan. The primary page is scanned in every agreed browser-and-locale combination; each additional page is scanned once, in the primary combination that ran, and each produced report is compared only with its same-named report of the previous scan when the recorded engine, locale, viewport, timezone, flows and page address match. Two scans are compared only when they have the same recorded scope (pages, browsers, locales, viewport, timezone) and the same Methodology version; otherwise no condition is evaluated and, if a completion message was requested and delivery is configured, the message states that no comparable previous scan was available. It contains no scan evidence (no raw request records, full URLs, cookie or storage values, page content or screenshots; a tracking host is named by its host name only) and no link to our systems. Alert e-mails do not replace the Reports due under the Order, including the monthly PDF summary. Additional underlying run Reports can be requested by e-mail. Each notification is logged with the recipient address, subject and outcome, and deleted with the related scan record under section 10. The recipient is fixed when the scan is queued (the schedule's alert address, otherwise the client contact address recorded then; staff-queued scans go to the client contact only); messages are rendered from a validated summary passed through the report redaction and contain the host name, never a URL, together with test identifiers, statuses, tracker host names, consent-platform names and the browser-and-locale or page identifier of each condition; mail credentials are kept only in a restricted configuration file on our equipment and, like server replies and authentication material, are never included in console or API output, delivery records or diagnostic logs; one delivery task and one delivery record exist per scan, and a retry after a lost acknowledgement can occasionally deliver a second copy; a pending retry is held in memory only and is cancelled by a restart; a scan completed while alert delivery is not configured on our side is not notified later; a message already accepted by the mail server cannot be recalled by a later deletion; a purged scan's delivery records are deleted with it, and the delivery-log rows of test messages become eligible for deletion after 90 days and are removed by the monthly deletion routine.
At the date above you pay by bank transfer against our invoice; this is the only payment route in use. Safe and Informed S.R.L. is the seller and service provider. We receive the transfer details that appear on our bank statement (account holder name, account number, amount, reference) and keep them as accounting records (section 10). No payment provider is involved. Where we later offer a card payment link, the provider, its role, the destinations of the payment data, the payment mechanism and how to obtain its transfer safeguards are identified before payment; such a link would only collect payment for the Order already agreed with us, the provider would not replace us as seller, card data would never reach us, and no payment provider would receive Scan Data or be a sub-processor under the DPA. Where we later offer purchase through a merchant of record, that route, the seller of record, the applicable buyer terms and the invoice issuer are identified before purchase; it is not in use at the date above.
We share personal data only with:
We use no other direct sub-processor. We disclose Reports or scan evidence only to Zoho for the delivery and mailbox storage described above, to professional advisers where necessary and subject to confidentiality, to public authorities where legally required, or as the Customer instructs.
Scan working files and screenshots are stored only on company-managed devices protected by a login password, to which only named staff have access, located in Romania. Reports are generated on those devices; sent copies are also retained in our Zoho mailbox as described below. We do not use a cloud evidence store. Correspondence, including sent copies of reports, is kept in our Zoho mailbox, stored in the European Union as described in section 8. Primary mailbox storage remains in the European Union. Authorised Zoho personnel in India may access data for technical support under the Standard Contractual Clauses incorporated into Zoho's data processing addendum and the supplementary safeguards in Zoho's transfer-impact assessment, as described in section 8 and DPA Annex III. You may ask us for a copy or a meaningful summary of these safeguards; we provide it subject to legitimate redactions. No payment provider is in use at the date above (section 7).
| Data | Retention |
|---|---|
| Reports, evidence and screenshots | 12 months after delivery, or any shorter period the customer instructs, then deleted through the documented monthly process described below. The 12 months support the dispute procedure in the Terms and comparison between successive reports |
| Order correspondence, verification record and exclusion register | as long as needed to provide the service, honour an exclusion and handle any dispute, then deleted |
| Invoices and accounting records | for the periods required by Romanian accounting and tax law for each category of record |
Scan evidence and Safe & Informed's copies of reports are deleted through a documented monthly process once their retention period expires, and no later than 31 days after expiry. The process covers local working folders, sent-e-mail copies and other copies under Safe & Informed's control. Backup copies, where made, are unavailable for ordinary use, expire within 35 days of the day the data was deleted from the working copy, and are re-deleted if restored.
A valid early-deletion or return request from the customer is completed within 30 days for copies under Safe & Informed's control. We return or delete Scan Data on the Customer's documented instruction within the stated period, except where Union or Member State law requires storage. Any retention separately necessary for our own legal obligations or a specific legal claim is limited to identified records, assessed and documented under our controller responsibilities, and disclosed with its purpose, legal basis and retention period. It is not a general right to retain Scan Data after a deletion instruction. Backup copies are subject to the 35-day limit above, which runs from the day the data was deleted from the working copy.
Scan working files are stored only on company-managed devices protected by a login password, to which only named staff have access. Header values, cookie values and storage values are not included in reports, and the redaction rules are applied before any report file is written. For HTTP and HTTPS requests intercepted by the browser-context route (the document, every frame, every sub-resource), supported request types are judged against the same rules as the scan target before the scanner fetches them: local, private, link-local and cloud-metadata addresses are refused, and a navigation of the page itself to another registrable domain is refused. Requests eligible for fetching are fetched by the scanner's own client with redirects disabled, so the browser does not make the connection; a redirect has its destination judged hop by hop before it is followed, and a refused hop is aborted before any connection and listed in the Report. Media, event-stream and unsupported request types are refused without fetching; WebSockets are refused separately; service workers are blocked. For requests eligible for fetching, hostname checks use fresh DNS resolution by default, and the scanner's client resolves the name again when it fetches. These are application-layer controls, not a complete browser-network sandbox or socket-level IP pinning: a name that answers differently to two consecutive lookups can still reach a different address than the one checked, and browser traffic outside these routing controls (WebRTC) is removed in every scanner context by a script whose required protections are verified on a startup probe, in the supported browser configurations only, and, on the documented server deployment, by host-level egress rules bound to the scanner's user that reject the listed prohibited address ranges while those rules remain intact. Chromium runs only as Playwright's bundled headless shell. WebKit is supported. Firefox is used only where available, included in the Order and passing the required startup checks. Browser-channel and executable-path overrides are refused. Engine settings supplement the checked initialisation protections where available. Deletion follows a documented routine. No system is perfectly secure; if a personal data breach affects you, we notify you as set out in the DPA and, where required, the supervisory authority.
Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. You may exercise these rights through any reasonable channel, for example by e-mail to [email protected] or by post to the address in section 14; you do not have to write from the mailbox you used to order. Where we have reasonable doubts about your identity we ask for proportionate verification, such as a reply from an address we already hold or a reference to the Order, and never more than is needed. We respond without undue delay and normally within one month. Where the GDPR permits an extension because of complexity or number of requests, we will notify you within the initial month.
Where the right applies, we will complete a valid deletion request within 30 days for data under our control, unless retention is required or permitted by law, including for the establishment, exercise or defence of legal claims.
If your personal data appears inside scan evidence, the organisation that ordered the scan, or the controller on whose behalf it ordered, is the controller. Please contact that organisation; we assist it as set out in the DPA.
You have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or with the supervisory authority of your habitual residence.
We may update this Policy. The "Last updated" date above changes and the current version is available at its published URL. We notify customers with an open order or subscription of material changes by e-mail at least 30 days before they take effect.
Safe and Informed S.R.L. Aleea Slt. Adrian Cârstea, Nr. 13, Bl. 37, Sc. 2, Et. 8, Ap. 141, Sector 3, Bucharest, Romania Email: [email protected]