> How FlowConsent collects, uses and protects your personal data in line with the GDPR, including the FlowConsent MCP server. > > Canonical: https://www.flowconsent.com/en/legal/privacy Legal # Privacy Policy Updated on 3 October 2026 · 5 min read ## [1. Introduction](#1-introduction) FlowConsent is committed to protecting your privacy and your personal data. This policy explains how we collect, use and protect your information. ## [2. Data collected](#2-data-collected) We collect the following information: - Identification information (name, email) - Service usage data - Cookies and similar technologies - Payment information (processed by our secure providers) ## [3. Use of data](#3-use-of-data) Your data is used to: - Provide and improve our services - Communicate with you - Manage your account - Keep our services secure - Comply with our legal obligations ## [4. Data sharing](#4-data-sharing) We never sell your personal data and we do not use it to train artificial intelligence models. We rely on the following processors, which only access your data to perform the service entrusted to them: - **Vercel**: hosting of the application and the MCP server - **Cloudflare**: delivery of consent banners to the visitors of your site (CDN, Workers, KV storage), and bot check on the scan form (Turnstile) - **Browserbase**: hosted browser that opens the site to analyse during a scan; only the site address is sent to it - **Supabase**: database, authentication and server functions - **Stripe**: payment processing; your full card details are never sent to us - **Resend**: sending of transactional emails (invitations, account notifications) - **PostHog** (European instance): product usage analytics and triggering of transactional emails - **Sentry**: detection and diagnosis of technical errors Some of these providers may process data outside the European Union. These transfers are governed by the European Commission's standard contractual clauses or by an adequacy decision. We may also disclose your data to the authorities where the law requires it. ## [5. Retention period](#5-retention-period) We keep your data for as long as necessary to provide our services and in accordance with our legal obligations. ## [6. Your rights (GDPR)](#6-your-rights-gdpr) Under the GDPR, you have the following rights: - Right of access to your data - Right to rectification - Right to erasure - Right to restriction of processing - Right to data portability - Right to object ## [7. Data security](#7-data-security) We implement technical and organisational security measures to protect your data against any unauthorised access. ## [8. Cookies](#8-cookies) flowconsent.com uses its own FlowConsent banner. Audience measurement tools (Google Analytics, Microsoft Clarity) are only loaded after you agree, and no non-essential tracker is set before you choose. You can change or withdraw your consent at any time from the banner. ## [9. MCP server (mcp.flowconsent.com)](#9-mcp-server-mcpflowconsentcom) FlowConsent provides an MCP (Model Context Protocol) server that lets an AI assistant of your choice (Claude, Cursor or another compatible client) manage your banners on your behalf. Using it is optional and requires your explicit authorisation. **Data processed.** When you authorise an MCP client, we store: your account identifier and email address, the tokens of your FlowConsent session, the permissions you granted, and the name and redirect addresses of the authorised client. No additional data is collected in the process. **Purpose.** This data is used solely to carry out, on your behalf, the actions covered by the permissions you granted: viewing your workspaces and banners, creating or editing them, publishing them, and viewing your consent statistics. The server has no rights of its own: it acts strictly within the limits of your account. **Storage and security.** This data is stored in our Supabase database, in dedicated tables that cannot be accessed from the browser. Tokens are never stored in clear text: only their cryptographic fingerprint (SHA-256) is recorded. The server is hosted by Vercel. **Sharing.** The responses to the commands you trigger are sent to the MCP client you authorised, and therefore to its publisher, under that publisher's privacy policy. We do not share any data with other third parties, we do not sell it and we do not use it to train artificial intelligence models. Our technical processors remain Vercel (hosting) and Supabase (database). **Retention period.** Authorisation codes expire after 10 minutes and are deleted within 24 hours. Access tokens expire after one hour and are deleted after 7 days. Refresh tokens remain valid until revoked, then are deleted after 30 days. A daily automatic purge enforces these periods. **Revocation.** You can withdraw the access granted to an MCP client at any time by writing to [\[email protected\]](https://www.flowconsent.com/cdn-cgi/l/email-protection#1b6b69726d7a78625b7d77746c787475687e756f35787476). Deleting your account also deletes all associated authorisations. ## [10. Cookie scanner (free audit)](#10-cookie-scanner-free-audit) When you request a free audit on flowconsent.com, we process: - the email address you enter; - the address of the site to analyse and the result of the analysis (cookies, trackers and services detected); - an encrypted fingerprint of your IP address, computed on the fly: the IP address itself is never stored. **Purposes and legal bases.** Your email is used to send you the link to your report, which you request by filling in the form (pre-contractual measures, Article 6(1)(b) GDPR). If you do not create an account, we send you at most three follow-up emails about this report, 1, 3 and 7 days after the scan (legitimate interest, Article 6(1)(f)); each one contains a one-click unsubscribe link. The IP fingerprint is only used to limit the number of scans per visitor and to protect the service against abuse (legitimate interest). A Cloudflare Turnstile bot check runs in the form for the same reason. **Report.** The report is reachable through a unique, unguessable link; it does not contain your email address and is not indexed by search engines. **Retention period.** The report, the email and the IP fingerprint are kept for 30 days after your last request, then deleted automatically by a daily job. You can ask for earlier deletion at [\[email protected\]](https://www.flowconsent.com/cdn-cgi/l/email-protection#a5d5d7ccd3c4c6dce5c3c9cad2c6cacbd6c0cbd18bc6cac8). ## [11. Changes](#11-changes) We may change this policy at any time. Changes will be published on this page. ## [12. Data controller and contact](#12-data-controller-and-contact) Personal data is collected by **BeBranded SAS**, with a share capital of €10,000, registered under number 984 530 212, whose registered office is at 34 Avenue Chanzy, 93250 Villemomble, France. The data protection officer is **Maxime Konzelmann**, who can be reached at the same address, by phone on +33 1 89 70 89 35 or by email at [\[email protected\]](https://www.flowconsent.com/cdn-cgi/l/email-protection#7418111315183416111606151a1011105a0c0d0e). For any question about this policy or to exercise your rights, write to us at: [\[email protected\]](https://www.flowconsent.com/cdn-cgi/l/email-protection#addddfc4dbccced4edcbc1c2dacec2c3dec8c3d983cec2c0) If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the competent supervisory authority, at [www.cnil.fr](https://www.cnil.fr).