The contract for ConsentVeil Monitor: business customers only, ordering by e-mail, what the service is and is not, prices, delivery, liability.
Copyright © 2026 Safe and Informed S.R.L. All rights reserved.
These Terms of Service ("Terms") are a binding agreement between the organisation or person that orders the Service ("Customer", "you") and Safe and Informed S.R.L., a company incorporated in Romania, with registered office at Aleea Slt. Adrian Cârstea, Nr. 13, Bl. 37, Sc. 2, Et. 8, Ap. 141, Sector 3, Bucharest, Romania, Trade Register No. J2026050848009, sole registration code (CUI) 55462821 ("Safe & Informed", "we", "us", "our"). They govern ConsentVeil Monitor (the "Service" or "Monitor"). Safe and Informed S.R.L. is the seller and service provider. Payment is by bank transfer against our invoice; any hosted payment link we later offer only collects payment for the Order already agreed with us, and the payment provider does not replace us as seller.
By placing an Order you accept these Terms and the Policies. If you act for an organisation, you confirm that you are authorised to bind it. If you do not agree, do not order.
2.1 Monitor is a technical audit service. Our staff run our own scanner on company equipment located in Romania against public pages of your Website, review the results by hand and deliver a Report by e-mail. A recurring audit is run for each period you have ordered; our staff start each Scan, and our internal tooling does not run Scans on its own unless a recurring audit has been agreed in the Order.
2.2 The Service does not include, and we do not offer:
2.3 Monitor is completely separate from the free ConsentVeil browser extension. The extension processes data only locally on the user's device and sends nothing to us. Monitor never receives any data from extension users.
2.4 The Service is offered to Customers acting for purposes relating to their trade, business, craft or profession. We do not currently conclude contracts with Consumers. A Consumer who writes to us receives the consumer information required by law, in Romanian, before any contract is proposed. The provisions of these Terms and the Policies that refer to Consumers apply only if a contract with a Consumer is nevertheless concluded.
3.1 You order by e-mail to [email protected], naming the Website and the audit you want. We reply with a quotation.
3.2 Before the contract is concluded, Safe & Informed sends the Customer the quotation, these Terms, the applicable Policies and, where a contract with a Consumer is proposed notwithstanding section 2.4, the model withdrawal form in a durable medium. The contract is concluded only when the Customer replies with clear acceptance and Safe & Informed confirms the Order.
3.3 Before any Scan starts, you confirm that you are responsible for the Website by exactly one of four methods:
(a) DNS TXT record (dns_txt): you place the verification token we send you in a DNS TXT record at _consentveil.<host> for the Website's host;
(b) Well-known file (well_known_file): you place the token in a file at /.well-known/consentveil-verify.txt on the Website (read over TLS only, at the address the scanner checked, without following redirects, at most 4096 bytes);
(c) Domain e-mail (domain_email): the Order comes from an e-mail address at the Website's registrable domain; our staff pass that address to the scanner, which checks that the domain matches;
(d) Written order (written_order): a signed or otherwise documented order from the organisation responsible for the Website, which we record by reference.
Our scanner will not proceed unless exactly one of these verification methods has been recorded for the Website, and the Report names the method used.
3.4 Verification is a technical check, not a legal one. You authorise Safe and Informed S.R.L. to perform the public-page loading, consent interactions, observations and screenshots described in the agreed Methodology on the domains and pages identified in the Order. You confirm your authority to grant that permission, including any necessary client or hosting permissions. This does not authorise access to unrelated systems, authentication or circumvention. A material breach occurs where you neither control the Website nor hold the required written authorisation. You confirm that the Scan is lawful where the Website is operated, and you provide the written authorisation to us when we ask for it.
3.5 Before every Scan our staff check the Website against the Exclusion Register, and the scanner refuses to scan a domain that is on it. A verified domain owner may ask to be added to the Exclusion Register by e-mail to [email protected]. An excluded domain is not scanned for anyone until the owner lifts the exclusion in writing.
3.6 We may decline or stop a Scan of a Website whose Verification fails or is disputed, or which is on the Exclusion Register.
4.1 The scanner loads public pages of the Website, one page at a time, in isolated automated browsers with a clean profile. Chromium runs only as Playwright's bundled headless shell. WebKit is supported. Firefox is used only where available, included in the Order and passing the required startup checks. Browser-channel and executable-path overrides are refused. It observes: request URLs, methods and resource types; browser console errors, counted and sampled; cookies and storage keys with their attributes and value lengths; the visible behaviour of consent controls; the state of IAB TCF and Google Consent Mode signals as counts and flags; and screenshots of the pages as rendered. Each Report also states the browser, locale, User-Agent string, Methodology version and time of the Scan.
4.2 The scanner clicks consent controls (accept, reject, withdraw) inside its own browser in order to observe what they do. Such a control may itself be implemented as a form button. It may also open the banner's settings layer and press keyboard keys (Tab, Escape) to measure whether the banner can be operated without a mouse; it reads the toggles in that layer and never changes them, and it never uses an accept, reject, save or close control for those measurements. On sites that implement the IAB TCF API or Google Consent Mode, it reads the consent signal's state in its own browser (counts and flags only, never the consent string or vendor identifiers). The scanner does not modify source code, CMS content or server configuration. Ordinary page loads and interactions with consent controls may create server or CDN logs, cookies, consent records, analytics events or similar operational records on your side. The scanner does not sign in, create accounts, complete business forms or place orders. It does not authenticate into, circumvent or bypass paywalled or otherwise access-controlled areas.
4.3 For HTTP and HTTPS requests intercepted by the browser-context route (the document, every frame, every sub-resource), supported request types are judged against the same rules as the scan target before the scanner fetches them: local, private, link-local and cloud-metadata addresses are refused, and a navigation of the page itself to another registrable domain is refused. Requests eligible for fetching are fetched by the scanner's own client with redirects disabled, so the browser does not make the connection; a redirect has its destination judged hop by hop before it is followed, and a refused hop is aborted before any connection and listed in the Report. Media, event-stream and unsupported request types are refused without fetching; WebSockets are refused separately; service workers are blocked. For requests eligible for fetching, hostname checks use fresh DNS resolution by default, and the scanner's client resolves the name again when it fetches. These are application-layer controls, not a complete browser-network sandbox or socket-level IP pinning: a name that answers differently to two consecutive lookups can still reach a different address than the one checked, and browser traffic outside these routing controls (WebRTC) is removed in every scanner context by a script whose required protections are verified on a startup probe, in the supported browser configurations only, and, on the documented server deployment, by host-level egress rules bound to the scanner's user that reject the listed prohibited address ranges while those rules remain intact. Chromium runs only as Playwright's bundled headless shell. WebKit is supported. Firefox is used only where available, included in the Order and passing the required startup checks. Browser-channel and executable-path overrides are refused. Engine settings supplement the checked initialisation protections where available.
4.4 The browser identifies itself with a dedicated User-Agent header: the browser's own User-Agent string followed by ConsentVeilMonitor/<version> (+https://www.safeandinformed.com/monitor). The string is printed in every Report, including the PDF, so that you can recognise Monitor traffic in your own logs.
4.5 Header values, cookie values and storage values are not included in Reports at all; for cookies and storage only keys, attributes and value lengths are kept. Before any report file is written, the redaction rules are applied to the target URL, the Findings, the list of refused requests and the records of the outbound-request guard: query parameters not on an allowlist and path segments that look like e-mail addresses or long identifiers are replaced.
4.6 A Scan may fail or be inconclusive because of the Website, network conditions, blocking by the Website or its providers, or limitations of the Methodology. An inconclusive result is reported as such. An inconclusive finding is not by itself a defect where the agreed work was carried out with reasonable skill and care and the relevant limitation applies. Disclosure of a limitation does not excuse failure attributable to us to provide the agreed scope. We agree any substitute scope with you or provide the remedies required by the contract and applicable law.
4.7 Alert e-mails. When a scheduled or requested Scan of your Website finishes, we may send a short notification to the address you named in the Order or for the schedule. It states which Website was scanned, the kind and time of the Scan, a one-line summary of the alert conditions met, taken from a fixed list (a test that regressed; a result that could no longer be established; a classified tracking hostname newly present in the pre-consent inventory; a change of consent platform), the score and result counts, and the previous Scan's score. No other condition is alerted. Each condition is evaluated on the primary page's aggregate result and, separately, on each browser-and-locale combination and each additional page of the Scan, against the same-named result of the previous comparable Scan. The primary page is scanned in every agreed browser-and-locale combination; each additional page is scanned once, in the primary combination that ran, and each produced report is compared only with its same-named report of the previous Scan when the recorded engine, locale, viewport, timezone, flows and page address match. Two Scans are compared only when they have the same recorded scope (pages, browsers, locales, viewport, timezone) and the same Methodology version; otherwise no condition is evaluated and, if a completion message was requested and delivery is configured, the message states that no comparable previous Scan was available. It contains no evidence: no screenshots, no page content, no cookie or storage values, no raw request records and no full URLs; a tracking host is named by its host name and nothing else about a request is included. It has no attachment and no link to our systems. Alert e-mails do not replace the Reports due under the Order, including the monthly PDF summary. Additional underlying run Reports can be requested by e-mail. A message stating "No configured alert condition was detected" is sent only if you asked for it. Each notification is logged (recipient address, subject, outcome) for the life of the related Scan record and deleted with it. The recipient of a Scan's alert is fixed when the Scan is queued: a Scan queued by a monitoring schedule is reported to that schedule's alert address or, where it has none, to the client contact address recorded at that time; a Scan queued by our staff is reported to the client contact address only; no other schedule is ever used to determine the address, and a Scan queued without any address produces no message. Messages are rendered from a validated summary only (host name, never a URL; kind and time; score and result counts; alert categories with test identifiers, statuses, tracker host names, the consent platforms named before and after a change, and the browser-and-locale or page identifier the condition was seen in; the previous Scan's score and date), passed through the report redaction. Configuration and delivery problems are recorded only as fixed codes; the mail credentials are kept only in a restricted configuration file on our equipment and, like the mail server's replies and any authentication material, are never included in console or API output, delivery records or diagnostic logs. One delivery task and one delivery record are kept per Scan; a temporary delivery failure is retried once after 60 seconds, in memory only, and a restart of our tooling cancels a pending retry; a retry after a lost acknowledgement can occasionally deliver a second copy of the same message. A Scan that finishes while alert delivery is not configured on our side is recorded as not notified and is not notified later; a message already accepted by the mail server cannot be recalled by a later deletion. Records of a purged Scan are deleted with it.
5.1 You must comply with the AUP. In particular, you must not order a Scan of a website you neither control nor are authorised in writing to have scanned, of internal networks, or of a third party's website without that party's written authorisation.
5.2 Ordering a Scan of a Website where you neither control it nor hold the required written authorisation is a material breach of these Terms and a breach of the AUP. An agency or service provider that holds its client's written authorisation under AUP section 2.3 is authorised for the purposes of this section.
6.1 Nature of Findings. ConsentVeil Monitor provides automated technical observations. It is not legal advice, a legal compliance certification or a substitute for professional legal review. A Finding describes what the scanner observed on a given page, at a given time, in the browsers and locales actually run. It does not state whether a website is lawful or unlawful.
6.2 No certification. We do not issue certifications, seals or statements of legal compliance, and no Report may be presented as one. An absence of failed tests does not mean that a website complies with any law.
6.3 Independence of Findings. No plan, payment, commercial relationship or request changes a Finding, a severity, a score or a piece of evidence. Severity is fixed per test by the Methodology. An inconclusive result is never presented as a pass.
6.4 Limitations. Every Report includes the standing limitations of the Methodology and any limitation specific to a test. Host classification uses packaged provider lists; an unclassified host is not a safe host.
6.5 Disputing a Finding. If you believe a Finding is wrong, quote the test identifier, the scan timestamp and the Methodology version and write to [email protected]. Where a Finding is shown to be wrong, we correct it and repeat the Scan free of charge. Customers should notify us of an alleged report defect within 30 days so that it can be investigated promptly. This contractual procedure does not limit any mandatory consumer remedy, statutory limitation period or other right that cannot lawfully be excluded.
6.6 Your responsibility. You remain solely responsible for your own compliance decisions, for interpreting Findings, for any action you take or do not take on the basis of a Report, and for obtaining legal advice where you need it.
7.1 Prices are those in the Price List in force at the time of the Order. The quotation states the package, the included pages and deliverables, any extra pages or locales, the net price, the applicable VAT or the reason none is charged, and the total payable in EUR. No charge is added without your agreement. At the date above the Price List states, all excluding VAT: Quick Scan EUR 149; Audit EUR 490; Re-scan EUR 190, available after an Audit; Monitoring EUR 99 per month per website, available after an Audit; EUR 79 per extra page and EUR 49 per extra locale for an Audit or a Re-scan. A Quick Scan fee is credited in full against an Audit of the same Website ordered within 30 days of delivery of the Quick Scan Report. The Price List in force at the time of the Order prevails over this paragraph.
7.2 You pay by bank transfer against our invoice; at the date above this is the only payment route. Safe and Informed S.R.L. is the seller and service provider. Where we later offer a hosted card payment link, the payment provider, its role, the destinations of the payment data, the payment mechanism and how to obtain its transfer safeguards are identified before payment; such a link only collects payment for the Order already agreed with us, the payment provider does not replace us as seller, and card data never reaches us. Where we later offer purchase through a merchant of record, that route, the seller of record, the applicable buyer terms and the invoice issuer are identified before purchase; it is not in use at the date above.
7.3 Fees for a one-time service (Quick Scan, Audit, Re-scan) are invoiced as stated in the Order confirmation, either on Order or on delivery of the Report. Subscription fees are invoiced in advance for each monthly period. If an invoice is not paid when due, we may withhold delivery or suspend the subscription after notice.
7.4 VAT and invoice treatment follow applicable law and are stated in the quotation and invoice. Where required, invoices are transmitted through RO e-Factura; e-mail copies do not replace mandatory transmission. The invoice issuer is identified before purchase.
8.1 A one-time service is delivered as a Report within the time agreed in the Order confirmation. A Re-scan compares the scope recorded in the Audit it follows, under the same Methodology version; additional pages or locales ordered with a Re-scan are scanned as a separate run and reported separately, not as a before-and-after comparison. Where the audited scope is replaced or the Methodology version has changed since the Audit, we say so before the Order and quote a new Audit instead.
8.2 A subscription, where offered in the Price List, runs for one month and renews for successive monthly periods until cancelled. We run the Scans agreed in the Order for each paid period and deliver the monthly summary Report by e-mail. You may cancel at any time by e-mail; cancellation takes effect at the end of the paid period.
8.3 We may change subscription prices with at least 30 days' written notice by e-mail. The change applies from the first renewal after the notice period. If you do not accept it, cancel before that renewal.
Refunds are governed by the Refund Policy. In summary: a one-time service is fully refundable before the Scan starts; after full performance there is no refund for change of mind, but a materially defective Report is re-scanned or refunded; paid Monitoring periods are not refunded merely because you cancel, except as provided in the Refund Policy, these Terms, the DPA or applicable law. The post-delivery no-refund rule is subject to section 18 and to section 5 of the Refund Policy where a contract with a Consumer is concluded. Full performance means completion of all ordered deliverables; for an Audit or a Re-scan it also includes answering the questions received within, and keeping the question service available throughout, the 10 days after delivery of the Report; delivery of the first Report alone does not complete a service containing further deliverables; a continuing subscription is not fully performed because its first summary was delivered. Where a Consumer withdraws, we refund within 14 days of receiving the withdrawal, without fee, by the original means of payment unless agreed otherwise.
10.1 For personal data about you and the people who act for you, we are controller, as described in the Privacy Policy.
10.2 For personal data that may incidentally appear inside scan evidence of your Website, you act as controller or, where you order the Scan on behalf of another controller, as processor; we act as your processor or sub-processor, as applicable. The DPA applies and is incorporated into these Terms. You confirm that you have a lawful basis for the scanning of your Website and for the storage of the resulting evidence.
11.1 The scanner, the Methodology, the provider lists and all related software and documentation are proprietary to Safe & Informed and its licensors. You receive no rights in them except those stated here.
11.2 You own the content of your Website. We claim no rights in it.
11.3 Reports are prepared for you. You may use, copy and share Reports for your own purposes provided you do not remove the Methodology reference, the limitations or any Finding, and do not present a Report as a certification.
Each party keeps the other party's non-public information confidential and uses it only to perform these Terms. Reports and scan evidence are your confidential information. This section does not apply to information that is public, already known, independently developed or required to be disclosed by law.
13.1 We perform the Service with reasonable skill and care and in accordance with the Methodology.
13.2 Except as stated in 13.1, and to the extent permitted by law, the Service and the Reports are provided without any other warranty, express or implied, including any warranty of accuracy, completeness or fitness for a particular purpose. We do not warrant that a Scan will detect every tracker, cookie, consent control or behaviour, or that the absence of a Finding means the absence of an issue.
14.1 Sections 14.1 and 14.2 apply only to Business Customers. To the extent permitted by law, neither party is liable to the other for indirect, incidental, special or consequential loss, loss of profit, loss of business, loss of goodwill or loss of data, however arising.
14.2 To the extent permitted by law, our total liability to a Business Customer arising out of or relating to the Service and these Terms, whether in contract, tort or otherwise, is limited to the fees you paid us in the 12 months immediately preceding the event giving rise to the claim.
14.3 Nothing in these Terms excludes or limits liability for gross negligence, wilful misconduct, fraud, death or personal injury, or any other liability that cannot be excluded or limited under applicable law. Nothing in these Terms excludes or limits our liability for our own breach of these Terms where such exclusion or limitation is prohibited by applicable law. A Consumer keeps every statutory remedy, and sections 14.1 and 14.2 do not apply to a Consumer.
14.4 We are not liable for any regulatory fine, penalty, claim or loss arising from your Website's own practices, from your interpretation of a Report or from any compliance decision you make. You remain solely responsible for your own compliance decisions.
15.1 You indemnify Safe & Informed against third-party claims, fines and reasonable costs arising from a Scan of a website you were not authorised to have scanned, from your breach of the AUP, or from your use of a Report in breach of section 6.
15.2 This indemnity applies only to Customers acting for purposes relating to their trade, business, craft or profession. It does not apply to Consumers.
16.1 We may end an Order or a subscription immediately if you breach section 3 or 5, fail to pay after notice, or if continuing would be unlawful or would expose us or a third party to legal risk. Where we end an Order or a subscription for unlawfulness or legal risk, we explain the reason where the law permits us to do so, and we refund the portion of the fees that corresponds to the part of the Service not performed. A Consumer's paid period is never forfeited automatically; any amount retained is limited to what the law allows for the part of the Service performed.
16.2 We may end a subscription for convenience with 30 days' notice, refunding any prepaid fees for the unused period.
We may update these Terms. Changes apply to Orders placed after the effective date of the change. For a running subscription we give at least 30 days' notice of material changes by e-mail; if you do not accept a change, cancel before it takes effect.
18.1 This section is a savings provision. Under section 2.4 we do not currently conclude contracts with Consumers. If a contract with a Consumer is nevertheless concluded, the mandatory consumer-protection rules of the Consumer's country of residence apply in addition to these Terms, and nothing in these Terms limits them. You have the 14-day right of withdrawal described in the Refund Policy, and sections 13 and 14 apply only to the extent permitted by consumer law.
18.2 We start a Scan for a Consumer before the end of the 14-day withdrawal period only if the Consumer has first replied with the following statement: "I expressly request Safe and Informed S.R.L. to begin the service before the end of the 14-day withdrawal period. I understand that, once the service has been fully performed and the Report delivered, I lose my right of withdrawal." The consequences of withdrawing after the Scan has started are set out in the Refund Policy.
19.1 These Terms, the Policies, the Order confirmation and the Price List are the entire agreement between us for the Service. If a provision is unenforceable, the rest remains in force.
19.2 Neither party is liable for failure caused by events beyond its reasonable control.
19.3 Notices to us go to [email protected]. Notices to you go to the e-mail address you ordered from.
These Terms are governed by the laws of Romania. The courts of Bucharest, Romania have jurisdiction over any dispute arising out of or relating to these Terms or the Service, without prejudice to any mandatory right a consumer has to bring proceedings in, or to rely on the mandatory law of, their country of residence.
Safe and Informed S.R.L. Aleea Slt. Adrian Cârstea, Nr. 13, Bl. 37, Sc. 2, Et. 8, Ap. 141, Sector 3, Bucharest, Romania Email: [email protected] Telephone: +40 746 447 444