Privacy policy

Controller: Consent Management Inc (“Inth,” “we,” “us”), a Delaware corporation, operating the c15t open-source project and c15t.com

Notice address: 2261 Market Street STE 86311, San Francisco, CA 94114

Contact: privacy@inth.com

This Privacy Policy describes how we process personal information in connection with:

• c15t.com (documentation and project website);
• c15t examples and related demo properties we operate that link here;
• c15t CLI telemetry (when not disabled);
• c15t GitHub comment action as configured in GitHub (processing primarily on GitHub’s side);
• communications about the c15t project.

Open-source library runtime: The c15t browser/library packages, when used in offline or self-hosted mode by developers, do not send end-user personal data to Inth by default. Developers who point the library at Inth-hosted consent backends are Inth customers; end-user processing is described in the Inth Privacy Policy (processor section) and the customer’s DPA.

If c15t.com links to Inth platform login or shared services, the Inth Privacy Policy (https://inth.com/legals/privacy-policy) also applies to that processing.

Main markets: United States (including California), United Kingdom, and Europe (EEA). UK GDPR, EU GDPR, and California/US state rights apply to our controller processing where those laws apply. Fuller rights language is in the Inth Privacy Policy.

Consent Management Inc (Delaware) publishes c15t and operates c15t.com. For EEA/UK users, Inth is controller of website and CLI telemetry processing described here unless noted otherwise.

Article 27 representatives (EU and UK)

Status: appointed.

We do not maintain an establishment in the EEA or the United Kingdom. Where GDPR Article 27 / UK GDPR Article 27 requires a representative, we have appointed:

EU Representative

Euverify Limited (Ireland)

Unit 3D North Point House

North Point Business Park

New Mallow Road

Cork

T23 AT2P

Ireland

Email: gdpr@euverify.com

UK Representative

Euverify Ltd (UK)

3rd Floor

86-90 Paul Street

London

EC2A 4NE

United Kingdom

Email: gdpr@euverify.com

If you are located in the EU/EEA or the UK and have questions or concerns regarding your personal data, you may contact our appointed representative above.

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, use the secure portal:

https://gdpr.euverify.com/verify/0ef2b25b-75a8-4b05-ac18-f0364f18a4f9

The portal lets you verify our appointed representative and submit GDPR requests directly. Requests submitted through the portal are logged and tracked.

You may also contact privacy@inth.com, the ICO (UK), or your EEA supervisory authority.

2.1 c15t.com visitors

• Automatically: IP address, user agent, pages viewed, referrers, diagnostics.
• Consent tech: c15t cookie and consent API calls (backend may be Inth-hosted).
• Analytics (after measurement consent where required): PostHog (EU), Databuddy.
• Marketing (after marketing consent where required): LinkedIn Insight (9588490), X pixel (rc5sn), Meta Pixel, Reddit Pixel, Google Ads conversion/remarketing tags (IDs as configured). For our paid campaigns (incl. on Google), not third-party ads on the site.
• Performance / errors: Sentry for errors/diagnostics. Vercel Speed Insights and Sentry Session Replay are disabled on c15t properties until they are gated behind measurement consent. When re-enabled, they will follow measurement permission.
• Server-side docs analytics: Non-browser clients (e.g. AI agents fetching markdown) may generate analytics events without a cookie banner.

2.2 Developers (CLI)

If telemetry is enabled (default unless you opt out), we may collect: install/machine identifier, command names/metadata (not secret argument values), version, and coarse environment signals, sent to endpoints such as https://telemetry.c15t.com/....

Opt out: --no-telemetry and/or C15T_TELEMETRY_DISABLED. If the CLI delegates to @inth/cli, also disable Inth CLI telemetry (INTH_TELEMETRY_DISABLED or equivalent).

2.3 GitHub Action

The c15t GitHub comment action processes repository/event data inside GitHub’s environment per your workflow configuration.

2.4 Contact

If you email us, we process the content of your message.

• Operate and secure c15t.com and docs;
• Understand documentation usage (including agent/markdown traffic);
• Measure marketing campaigns where tags fire;
• Improve the CLI and project (telemetry);
• Respond to communications;
• Comply with law.

We do not use c15t.com visitor data to train third-party foundation models as a primary purpose of the docs site. CLI telemetry is used to improve tooling. We do not claim every vendor never trains on any data.

Lawful bases (EEA/UK): contract/legitimate interests for site security and CLI improvement; consent for non-essential cookies/marketing where required.

We use infrastructure and analytics providers (e.g. Vercel, PostHog, Databuddy, Sentry) and advertising tags (LinkedIn, X, Meta, Reddit, Google Ads) as described in the Cookie Notice. Advertising partners are often independent controllers.

Sale/share: We do not sell personal information for money. Marketing tags may be “sharing” for targeted ads under California law when enabled — opt out via Your Privacy Choices / cookie preferences, GPC, or privacy@inth.com.

Website logs/analytics per provider configuration. CLI telemetry retained for a reasonable product-analytics period. Contact emails retained as needed for support/legal.

US-based Delaware corporation; California notice address; providers may process in the US/EU and elsewhere with appropriate safeguards where required (primarily SCCs and UK Addendum/IDTA).

Consent Management Inc (Inth) DPF certification is pending official Commerce listing. Until listed, Inth does not claim DPF certification for its own transfers. Details: Inth Privacy Policy §9 (https://inth.com/legals/privacy-policy#international-transfers).

Switzerland: short transfer-safeguards approach as in the Inth Privacy Policy; no separate Swiss rep unless published.

Cookie preferences / Your Privacy Choices on c15t.com; CLI telemetry flags; browser controls; email privacy@inth.com. European and US state rights as summarised in the Inth Privacy Policy apply to our controller processing where those laws apply.

Appointed — same Euverify EU + UK details and DSAR portal as in §1 / Article 27 above and the Inth Privacy Policy.

Not directed to children under 16.

We may update this Policy. Contact: privacy@inth.com, Consent Management Inc (Delaware), 2261 Market Street STE 86311, San Francisco, CA 94114. DPO: William De Ath — privacy@inth.com or the notice address above (see Inth Privacy Policy (https://inth.com/legals/privacy-policy) §13).