Service privacy notice

Data categories

• Account data: email, role, assigned sites and login metadata.
• Site profile data: domain, policy configuration, services, workflow status and owner-entered legal fields.
• Consent evidence: pseudonymous visitor ID hash, choices, action/event type, selected services, site/domain, policy/banner versions, page URL, banner language, user agent and hashed network identifier. Raw visitor IP addresses are not retained in consent records.
• Operational data: scanner runs, technical events, billing event summaries and transactional mail logs.

Roles and purposes

The customer is the controller for website visitor consent choices and configured policy content. Black Lotus / Lean Cookie Consent acts as processor for consent-log storage and related platform operations. Consent evidence is processed to provide pseudonymous proof of visitor choices, support export and audit workflows, enforce security and tenant isolation, troubleshoot integrations and maintain the service.

Retention

Consent evidence is retained according to the active service plan: Free 365 days; Pro, Developer, Agency and Agency Plus 1095 days; Enterprise 2190 days unless a future custom agreement says otherwise. These are service policy periods, not durations expressly imposed by the GDPR. Technical events are retained for 90 days, scanner runs for 180 days and acquisition events for 90 days.