Privacy Notice

1. Controller

The controller under the GDPR is the operator of consens.io: . The postal address is provided in the Imprint.
Contact:

2. Purposes and data we process

• Prompts and model outputs in the web app: used to provide the service, send requests to selected AI models, and display answers. We do not permanently store prompts or outputs from ordinary web-app runs unless you save them as bookmarks or explicitly create a shared or watched result.
• Consensus API runs: the administrator-issued Consensus API stores the submitted question, server-selected model plan, model outputs, consensus, differences analysis, status, and timestamps in Firestore so clients can retrieve asynchronous results and safely retry requests. API-run content and its idempotency mapping are automatically deleted no later than 30 days after acceptance; clients can delete completed runs earlier. API keys are stored only as a SHA-256 hash plus a short non-secret display prefix and audit timestamps. During account deletion, a minimal UID-bound block record may be retained temporarily if cleanup must be retried.
• Technical logs: timestamps and basic diagnostics for stability, security, and abuse prevention.
• Account data: if you sign up, your e-mail address and a user ID are processed via Google Firebase Authentication (including optional Google Sign-In) for access control, quota handling, and related usage features. Your tier and saved bookmarks (query, answers, sources, attachment metadata) are stored in Google Cloud Firestore until you delete them or your account.
• Abuse prevention: to enforce the one-account-per-person rule, we temporarily process your IP address and match it against the account ID. This mapping is held in volatile server memory only and is not written to a database (legal basis: Art. 6(1)(f) GDPR, prevention of quota abuse).
• Feedback: if you send feedback, we store your message, the e-mail address you optionally provide, your account ID, and a timestamp, for as long as needed to follow up on the feedback.
• Pro interest list: if you click a Pro-interest option, we store your account ID, e-mail address, and a timestamp so we can inform you about this feature.
• Local storage: used for interface preferences, session flags, and optional user settings. We do not use non-essential cookies.
• Your own API keys, optional: if you enter keys, they are stored in your browser only. With each request, the key is transmitted over an encrypted connection through our server to the selected provider. We do not store your keys on the server.

3. Usage analytics with Umami

We use Umami Cloud for privacy-focused web analytics. Umami records page views and selected interaction events so we can understand which parts of consens.io are used, improve the product, find friction, and prevent abuse. The tracker is configured to respect browser Do Not Track signals and to exclude URL search parameters and hash fragments.

Umami may process technical usage information such as visited pages, referrer, browser, operating system, device type, approximate country, timestamps, and the custom events listed below. Umami states that its tracking code does not use cookies, anonymizes collected data, and does not identify users across websites.

The custom events we track are limited to product usage signals: landing-page calls to action, opening or using the app, sending or cancelling a query, completing a model run, generating or cancelling a consensus, copying a consensus or citation, changing interface modes, model selection changes, sidebar section opens, settings/help/feedback actions, login/register/password-reset/account-deletion attempts and outcomes, bookmark save/open/delete actions, API-key test outcomes, and Pro-interest clicks.

Event properties are limited to non-content metadata, for example selected mode, number of selected models, provider or model label, status, trigger type, and boolean states such as logged-in, own-keys, Agent Mode, or Auto Consensus. We do not send prompts, model answers, consensus text, feedback message text, e-mail addresses, passwords, authentication tokens, API keys, bookmark contents, or other user-entered content to Umami as custom event data.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in measuring aggregate product usage, improving the service, maintaining security, and prioritizing development. You can object to this processing under Art. 21 GDPR using the contact details above.

4. Provider routing

Model requests are sent to the model providers selected for the query: OpenAI (USA), Anthropic (USA), Google (USA), Mistral AI (France), xAI (USA), and DeepSeek (People's Republic of China). consens.io does not add an extra model marketplace or router layer between your prompt and those selected providers.

Note on DeepSeek: DeepSeek processes data in China, a country without an EU adequacy decision. If you select DeepSeek models, your prompt and attachments are transmitted to DeepSeek for processing. If you do not want this, deselect DeepSeek models before sending a query; the other models work independently of this choice. See also the Terms of Use.

Consensus API notice: unlike the interactive web app, regular Consensus API v1 runs use a fixed server-selected six-provider comparison. DeepSeek is therefore a mandatory recipient of regular API prompts and cannot be deselected by API customers. Do not use regular API runs for content that must not be transferred to or processed in China. The admin-controlled Scheduled Publisher is the sole exception: it operates on automatically selected public-interest topics and excludes DeepSeek from initial and Watch runs.

Necessary infrastructure providers, authentication services, and selected AI providers may still process data where needed to operate the service.

5. Shared pages (public sharing)

If you publish a consensus answer as a public shared page (an explicit, opt-in action in the app), we store the shared content (question, consensus answer, differences analysis, sources, and model names) together with your internal account ID. The account ID is used solely so that you can manage and revoke your own shared pages and so that we can fulfil our moderation duties; it is never displayed publicly and never embedded in the public page.

Shared pages created through the Share action are public: anyone with the link can read them, and selected pages may appear in search engines after a manual review by us. Watch pages can instead be private. A private Watch page is available only to its creator while signed in, is never submitted for indexing, and is not shown as a related page. Please do not include personal data in content you make public.

Visitors can report a shared page ("Report this page"). Reports are stored without any personal data. as anonymous counters per reason only; we do not store the reporter's IP address or browser data.

If you enable Consensus Watch, we periodically rerun only the original question using a limited set of models. We store compact history points (date, agreement score, verdict, and a short change summary) next to the selected public or private Watch page, but not the full rerun model responses. You can choose service notifications for material changes, for every successful new consensus, or when a condition you enter is met. The selected local run time and time zone are stored with the Watch schedule. Conditions are stored with the private Watch settings and evaluated against each newly generated consensus by an AI judge; they are not displayed on public pages. A condition notification is sent when the result changes to “met”, not repeatedly while it remains met. Result notifications may include the generated consensus text. Repeated failures may also trigger a one-time pause notice. Every watch e-mail includes a signed link that pauses the watch without requiring login.

Optional Telegram delivery: Signed-in users may voluntarily connect a private Telegram chat and enable Telegram separately for individual Watches. For this purpose we store the Telegram chat and user identifiers, the public Telegram username/first name supplied by Telegram, connection status and minimal delivery metadata. The one-time account-link token expires after ten minutes; expired token records are removed by regular maintenance. Telegram receives the alert text required for delivery (question, agreement score and change summary or generated consensus) and callback data for actions such as mute or pause. We do not read unrelated Telegram chats or use Telegram data for model training. Disconnecting removes the account mapping; account deletion also removes pending links and delivery metadata. Delivery metadata is otherwise automatically removed after 90 days. Telegram's own processing is governed by its privacy policy.

Following a public Watch page (visitors): Visitors can subscribe to change notifications for a public Watch page by entering an e-mail address, without creating an account. The subscription only becomes active after the address is confirmed via a link we send to it (double opt-in); if the link is not used, nothing is stored. For active subscriptions we store only the confirmed e-mail address, the followed page, and the confirmation date, but no IP address or browser data. The address is used exclusively to send notifications about material changes to that page. Every notification includes a signed unsubscribe link that removes the address without requiring login. Follower addresses are deleted immediately when the subscription is cancelled and when the followed page is revoked or deleted.

Retention and deletion:

• Consensus results that are eligible for sharing are kept server-side for a maximum of 24 hours; if you do not share them within that period, they are deleted automatically.
• Shared pages remain online until you revoke them or delete your account.
• When you revoke a shared page, it immediately becomes unavailable to the public and is permanently deleted within 30 days. Copies cached by browsers or search engines for a short period are outside our control.
• When you delete your account, all your watches, watch history, shared pages, pending results and Telegram connection/delivery metadata are deleted as part of the account-deletion process.
• Report counters are deleted together with the page.
• Follower e-mail addresses are deleted when the subscription is cancelled via the unsubscribe link and when the followed page is revoked or deleted.

Legal bases: Art. 6(1)(b) GDPR for publishing and managing pages you create and for delivering follower notifications requested via double opt-in; Art. 6(1)(f) GDPR for moderation, report handling, and abuse prevention.

6. Legal bases under the GDPR

• Art. 6(1)(b): performance of the service you request.
• Art. 6(1)(f): legitimate interests in security, stability, abuse prevention, and aggregated product improvement.
• Art. 6(1)(a): where we explicitly ask for consent.

7. Recipients, processors, and international transfers

To provide the service, we use the following categories of providers, who may process data on our instructions as processors or as independent providers when their interfaces are used:

• Hosting: Render (Render Services, Inc., USA) hosts the application server, including technical request logs.
• Authentication and database: Google Firebase Authentication and Google Cloud Firestore (Google Ireland Ltd. / Google LLC, USA) for accounts, tier status, and bookmarks.
• Analytics: Umami Cloud (see section 3).
• AI model providers: the providers selected per query (see section 4).
• Optional notifications: Telegram Messenger Inc. via the Telegram Bot API, only after you connect Telegram and enable that delivery channel. Telegram receives the notification content described in section 5.

Processing may occur outside the EU/EEA, in particular in the USA and, if you select DeepSeek models or submit a regular Consensus API run, in China. Scheduled Publisher runs exclude DeepSeek. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses; for other transfers on appropriate safeguards under Art. 44 et seq. GDPR or, for DeepSeek, on your request to route the query to that provider (Art. 49(1)(b) GDPR).

8. Storage periods

We retain data only as long as necessary for the stated purposes or as required by law. Technical logs are generally kept short-term. Consensus API run content is retained for at most 30 days after acceptance and completed API runs can be deleted earlier through the API. Other model content is retained only insofar as needed for stability, abuse defense, or aggregated and anonymized product improvement. For shared pages and pending share results, the specific retention periods in section 5 apply. On request, we will review earlier deletion.

9. Your rights in the EU/EEA

• Access, rectification, erasure, restriction, and portability, subject to legal conditions.
• Right to object to processing based on legitimate interests under Art. 21 GDPR.
• Withdrawal of consent with future effect.
• Right to lodge a complaint with a supervisory authority, for example the Lower Saxony DPA.

You can delete your account yourself at any time in the app settings ("Delete account"). This removes your authentication account, profile data, bookmarks, watches, watch history, shared pages, pending share results, Telegram connection/delivery metadata, and entries you created in the feedback and Pro-interest lists. For anything else, contact us at the address above.

10. Security

We implement appropriate technical and organizational measures, including access limitation, logging, and up-to-date transport encryption.

11. Children

consens.io is not directed at children. Use the service only if you are old enough to use online services under the law applicable to you.

12. Changes and contact

We may update this notice and indicate the last updated date below.

Email: