Privacy Policy

Last updated: 12 October 2026

The short version. Consently helps a merchant capture a shopper's agreement to a store policy, and keeps the receipt so the merchant can defend a chargeback or refund dispute. It stores the exact wording a shopper agreed to, the time, and enough context to prove it was them: an email if known at checkout, and the IP address and browser the acceptance came from. It reads no card data, it keeps everything scoped to the one store it belongs to, and it sells nothing.

Who this covers

Consently is an agreement- and consent-capture app for OpoShop stores, published by Found. This policy covers the Consently admin app, the agreement checkbox or confirmation the merchant shows on their storefront, and the website at getconsently.com. If you are a shopper who agreed to a policy on a store, the merchant running that store is the controller of your data; Consently processes it on their behalf, and this describes exactly what that amounts to.

What we read from a merchant's store

When a merchant installs Consently, OpoShop grants it access we use for three things:

Verifying who is asking. When the app loads inside the OpoShop admin we confirm, with the caller's own credential, that they really own the store they claim to. No session exists until that check passes.
Your store name and owner email, so the agreement can be brand-matched and so we can reach you.
Order events, via an OpoShop webhook, for the single purpose of linking a recorded agreement to the order it belongs to (the thing that makes a receipt "chargeback-ready"). We do not read, store or export your customer list, your products or your revenue, and Consently never writes anything to your store.

What we record about shoppers

This is the heart of the app, so we will be exact. When a shopper accepts an agreement, Consently records a receipt containing:

The exact agreement text they saw: a snapshot of the wording, its version and the policy link shown with it, copied from the merchant's saved settings by our server at the moment they continued. The app never edits it afterwards.
A positive-acceptance flag and the timestamp.
An anonymous session id the shopper's own browser generated, and their email address only if they were signed in to the store when they agreed. We do not read email fields off the page.
The page and product(s) the agreement was shown on, the cart id, and the order id once the shopper reaches checkout and places the order.
The IP address and browser (user agent) the acceptance was made from. A consent receipt exists to prove who agreed and when, unlike an analytics cookie, that proof is the whole point, so this context is recorded deliberately and only for that.

A record is saved when the shopper presses Add to cart or Checkout with the box ticked, not when they tick it. Consently records no advertising identifier, builds no cross-site profile, and never uses a record for marketing.

Where data lives, and for how long

Store configuration and agreement receipts are held in Consently's own MongoDB database, scoped per store and hosted in the United States. One store's data is never visible to another, even when the same person owns both.

Because a receipt's entire job is to be available if a payment is disputed, which can happen many months after the sale, receipts are kept for as long as they may be needed for chargeback or refund-dispute defense and are not auto-purged. There is no delete button in the app. To have a record, or all of a store's data, erased, the merchant emails brandon@tryfound.io and we delete it. Merchant configuration is kept while the app is installed so a reinstall restores it.

Browser storage the agreement uses

cly_sid: a random session id kept in the shopper's browser, so a record can be tied to their session and then to their order.
cly_rc: the time this browser last recorded an agreement, so the checkout page knows whether there is a record to tie to the order.
cly_pq: a record that could not be saved yet (no connection, or the page changed too fast). It holds the same ids the record is sent with, never the wording or an email, is sent again on the next page, and is dropped once saved or after 30 minutes.

The tick itself is not remembered between pages, so a shopper is shown the box again on each page where it applies.

Neither is used for advertising, profiling or analytics, and neither travels to another site. The Consently admin uses browser storage only to keep a merchant signed in.

Uninstalling

Removing Consently from a store stops the agreement showing. OpoShop stops loading it on the storefront, and once we have confirmed the removal with OpoShop our own configuration endpoint answers "off" as well. Existing receipts are retained (a merchant may still need them to defend a dispute); to have a store's stored data erased instead, email brandon@tryfound.io and we will delete it.

Third parties

OpoShop: the platform the app is installed on, and the source of the order events used to link receipts.
Fly.io: hosting.
MongoDB Atlas: the database.
PostHog: product analytics for the merchant admin, plus anonymous counts of app events (for example that an agreement was accepted on a store). It never runs on a storefront and receives no shopper email, IP address or session id.

We do not sell data, we do not share it for advertising, and we run no advertising of our own.

Payments

Consently does not take payments and never sees a card number, a bank detail or a billing address. Linking a receipt to an order uses only the order's identifier, never its payment information.

Your rights

If you are in the EU, UK, California or another region with a privacy law, you have rights of access, correction, deletion and objection over data we hold. In almost every case the merchant whose store you bought from is the right first contact, since they are the controller, but you can always write to us directly at brandon@tryfound.io and we will help. Note that a merchant may retain an agreement receipt where it is needed to establish a legal claim, such as defending a payment dispute.

Changes

If this policy changes materially we will update the date at the top and, where the change affects merchants, note it in the app's What's New page.

Contact

Found · brandon@tryfound.io