Test your privacy policy against your product
Send the policy you already published and the questionnaire you were sent. We will show you where your running product disagrees with them.
Start with the document that is blocking you
Two good outcomes. A scoping conversation, or a straight answer that you do not need this yet.
CNIL restricted committee, decision SAN-2025-005, 1 September 2025, under Article 82 of the French Data Protection Act.
CNIL, SAN-2025-005, 1 September 2025.
Method, not a measured outcome.
*Disclaimer: Article 82 binds anyone placing cookies on devices in France. A regulator's finding about another company, not our result, and not legal advice.
Two situations bring people here
The distinction almost nobody makes
Permission and withdrawal are separate
Load with no history
Getting permission to collect
Almost every team has already built this. The banner with its toggle and its stored flag, shipped in the fortnight before launch and rarely opened again afterwards.
Accept, withdraw, then look
Honouring the withdrawal
Almost nobody builds this. It is every system that already received the data hearing that permission ended: analytics tags, ad platforms, warehouses, and the vendor you told six months ago.
CNIL decision SAN-2025-005
This is not our opinion
France's data protection authority held in September 2025 that these are two separate obligations, binding controllers handling people in France. We are software engineers rather than a law firm, and this is not legal advice.
Show data table
| Item | Value |
|---|---|
| California | 88.41% |
| Ireland | 86.09% |
| United Kingdom | 84.75% |
| Michigan | 84.65% |
| Singapore | 82.22% |
| South Africa | 81.97% |
| Canada | 81.63% |
| Australia | 80.74% |
If your reject button is ignored you are in the majority, and that is a reason to budget for it rather than relax.
Show data table
| Item | Value |
|---|---|
| Cookies not deleted after consent was revoked | 57.5% |
| More effort to revoke than to accept | 20.5% |
| Revocation hard to reach | 19.87% |
| No way to revoke at all | 2.48% |
In a separate group of 281 sites running the IAB Europe Transparency and Consent Framework in the same study, 22 stored a positive consent string after consent was revoked, and on 101 the third parties told about the acceptance were never told about the revocation. That is the failure that reaches furthest, because it happens in systems you do not own.
Li and colleagues, RADS-Checker, October 2024.
Same study, 2024, on 200 top-ranked apps from the same market.
Same study, 2024, on the 34 copies that arrived.
*Disclaimer: An audit of other companies' apps, not our result. This is what a published policy is worth until someone tests it.
| The case | What was found | Where the data was living | What to check yourself |
|---|---|---|---|
| Italy's data protection authority, the Garante, order doc. web 9256486, fine EUR 27,802,946 | What was foundCustomer data belonging to other operators still held past the ten-year limit, and opt-out lists that never propagated into the company information systems | Where the data was livingThe CRM, and the lists downstream of it | What to check yourselfThe system your sales and support teams work in, and every list built from it |
| Spain's data protection agency, the AEPD, PS/00140/2020, fine EUR 5,000,000 under Article 17 of the GDPR | What was foundPassing personal data from content-removal requests to an outside project meant the erasure was not honoured, with what the decision called grave deficiencies in the process | Where the data was livingA recipient outside the company that had already been sent the data | What to check yourselfEvery third party you send data to, and whether any of them hears that a deletion happened |
None of it was on the policy page. Each binds controllers in that regulator's own country. Both are published findings about other companies rather than our results, and none of it is legal advice.
Three legislatures, three continents, the same three system requirements
We are software engineers rather than a law firm, and nothing here is legal advice. Take the legal reading from your own counsel.
| What the system has to do | GDPRthe EU and EEA | The Digital Personal Data Protection Act 2023India, staged commencement | The CCPA as amended by the CPRACalifornia residents only |
|---|---|---|---|
| Withdrawal as easy as consent | GDPRArticle 7(3) | The Digital Personal Data Protection Act 2023Sections 6(4) to 6(6) | The CCPA as amended by the CPRA1798.135(a) and (b), including an opt-out signal sent by the browser |
| Deletion reaches every recipient | GDPRArticles 17(2) and 19 | The Digital Personal Data Protection Act 2023Section 8(7), passing the obligation to your processors | The CCPA as amended by the CPRA1798.105(c)(1) |
| Stated purpose and retention clock | GDPRArticle 5(1)(e) | The Digital Personal Data Protection Act 2023Section 8(7) retention | The CCPA as amended by the CPRA1798.100(a)(3) and (c), per category |
We engineer for GDPR, HIPAA and SOC 2. The Indian and Californian instruments appear here as facts about the category, and nobody certifies anyone here. The GDPR was adopted by the European Parliament and the Council, and binds controllers and processors handling the personal data of people in the EU and EEA. The Digital Personal Data Protection Act 2023 was enacted by the Parliament of India and published in The Gazette of India Extraordinary on 11 August 2023, with commencement staged by government notification, binding data fiduciaries handling digital personal data in India. The CCPA as amended by the CPRA comes from the California Legislature and Proposition 24, and binds qualifying businesses handling the personal information of California residents.
What lands on your desk
01
Documents into claims
The policy you published and the questionnaire you were sent, turned into numbered assertions that can be tested one at a time.
What you receive
A one-page numbered list of the promises you are currently making.
02
Data map
Every place a name, an email, a device identifier or a session token comes to rest, including systems you do not control.
What you receive
A data map you can read, with every third-party recipient named.
03
Live requests
Ask for a copy, withdraw permission, ask for deletion, and record what the system does, including whether the deletion job completes. Regulators run this stage themselves.
What you receive
A recorded run of each request, step by step, in your own accounts.
04
Produce the diff
Every assertion marked met or not met, with the evidence beside each one, sized so it can be bought on its own.
What you receive
The written diff between what your documents say and what your product does.
05
Ordered fixes
The gaps ranked, with the ones your team owns named separately from ours. Each change goes through code review, tests and a CI gate.
What you receive
An ordered plan with owners, and the tests holding each fix in place.
One engagement from our own record, and the part it does not prove
| The claim | The figure | The mechanism | What backs it | What it does not prove |
|---|---|---|---|---|
| We rebuild who can reach what across a fragmented estate | The figureFive separate login platforms centralised into one authentication architecture, with a 70 percent drop in access-related support tickets | The mechanismOAuth 2.0 and user federation, which means one login works across separate applications, deployed across a fragmented application ecosystem | What backs itAn anonymised engagement from our own record. No client is named. | What it does not proveThis is access work, not data-protection work, and we will not dress it as a privacy programme. |
| We build data separation into the model rather than bolting it on | The figureOne multi-tenant architecture, meaning several customer organisations run on one system without seeing each other’s data, deployed across three industries | The mechanismMulti-tenancy means one system serving several customers where each one can only ever reach its own data, deployed across three industries | What backs itAn anonymised engagement from our own record. | What it does not proveOn subject, and still not a delivered deletion or consent programme. We hold no privacy result we can show you. |
Your users' data while we work
The data ends up somewhere new because you touched it
What we commit to
It does not move. You own the code, the cloud and the data from day one. We work inside your Git hosting, cloud accounts and storage, or set them up and hand you the keys if you have none.
You call us compliant and it turns out you could not
We hold no SOC 2, GDPR or HIPAA certification ourselves, we certify nobody, and we are not a law firm.
What we commit to
We engineer systems that pass your audits and document the architecture so your compliance people and your counsel can check the design intent. If an engagement needs a certified vendor or a legal opinion, we say so and refer you.
An outsider writes a report about our gaps that our board reads
What we commit to
The diff is written for you and goes to you, with the fix plan and its owners beside it. What you forward, and to whom, is entirely your own call.
We end up depending on you to keep it working
What we commit to
Every project starts with the documentation: architecture, deployment, CI/CD pipelines, requirements and change notes. Moving the work in-house or to another partner is a handoff rather than a hostage situation.
Whose problem this is
This is the work
You have a live product, real users, and a policy written before anyone looked at the code
A customer or an investor sent a data-protection questionnaire and the deal has stopped
You know there is a soft delete, a suppression list or a warehouse never wired into deletion
You need the answer in writing with the evidence beside it, not an assurance
Where to go instead
You need a penetration test, hardening or perimeter work rather than a data-flow and consent audit
There is no product yet, so there are no live data flows to map
What you need is WCAG accessibility compliance, which is a different regulatory category
You are building something new and privacy by design is one input among many
You are not ready to scope and want to talk about the questionnaire on your desk
The next step is the document on your desk
Send both and we will tell you which of your assertions are testable.
Before you get on a call with us
The questions that actually get asked, including the one where the honest answer is that there is no clean answer.
What about backups? Nobody ever gives a straight answer.
- The UK's Information Commissioner's Office, whose guidance binds controllers in the UK, takes the position that you can fulfil an erasure on live systems while the data remains in a backup until that backup is overwritten on an established schedule, provided the backup is not used for anything else meanwhile, and it calls the outcome context specific rather than a safe harbour.
- Its conditions for putting data beyond use all have to hold together, and its own next paragraph says data put beyond use is still held and can still be produced under a court order.
- That document is version 1.1 dated 26 February 2014, from the Data Protection Act 1998 era, and the ICO's cover note says it has not been updated since the 2018 Act, so treat it as a historic articulation.
- We are software engineers, not a law firm, and this is not legal advice.
- What we can do is make the schedule real, show the backup is not read for anything else, and record the restore-time suppression.
What does my team actually have to do, and for how many hours?
Is a soft delete good enough?
- Articles 17(2) and 5(1)(e) of the GDPR, adopted by the European Parliament and the Council and binding controllers in scope of Article 3, are what a row with a deleted flag has to answer to, because it is still stored personal data.
- We are software engineers, not a law firm, and this is not legal advice.
- What we can do is engineering: restore-time suppression, where a restored backup replays the deletions before it serves anyone, is where careful teams land, and it is defensible because it can be tested.
- Anonymising an IP address does nothing while a session identifier beside it still points at the same person.
Send the policy and the questionnaire
The same offer as the top of the page, now that you have what you need to decide.
Two things start this: a link to the privacy policy you published, and the questionnaire that is blocking you. Redact whatever you need to.
What comes back within one business day is a first read from a software engineer rather than a sales desk, saying which of your assertions look testable, what checking them involves, and whether you need us at all. That last answer is a real one and we have given it before.
- This form does not return a price. It returns a scoping conversation.
- We hold no certifications and we are not a law firm. If you need either, we will say so and point you somewhere.
- Your documents stay yours. Nothing is forwarded, published or used as an example.