Terms and conditions

These Terms and Conditions ("Terms") are a legal agreement between you and OptinStack LLC, operating the OptinStack consent management platform ("OptinStack", "we", "us", "our").

These Terms govern your access to and use of OptinStack, including our website, dashboard, runtime SDK, APIs, and related services (collectively, the "Service").

By creating an account, accessing, or using the Service, you agree to be bound by these Terms. If you use the Service on behalf of an organization, you represent that you have authority to bind that organization.

The Service is intended primarily for business and professional use. If you use the Service as a consumer, nothing in these Terms excludes or limits any rights, remedies, or protections that cannot lawfully be excluded or limited under the laws that apply to you.

If you do not agree to these Terms, you are not authorized to access or use the Service.

OptinStack is a consent management platform. We provide tools to display consent notices, manage consent preferences, inventory and control third-party trackers, sync consent records, and integrate with signals such as Google Consent Mode v2 and Global Privacy Control.

We may update features over time. Beta or preview features may be offered as-is without warranty.

Domain scans and how tracker inventory may vary between runs are described in our Domain scan disclosure at /legal/domain-scans, which forms part of these Terms.

OptinStack is a software provider and not a law firm, legal advisor, compliance consultant, or regulatory authority. The Service, our documentation, scan results, classifications, templates, recommendations, support communications, and blog content are provided for informational purposes only and do not constitute legal advice.

We provide tools intended to assist you with privacy and consent efforts. Use of the Service does not certify, verify, warrant, or guarantee compliance with any law, regulation, standard, framework, or regulatory guidance, including the GDPR, ePrivacy Directive, UK GDPR, CCPA, CPRA, LGPD, PIPEDA, or any other privacy or consumer protection law. No feature, setting, recommendation, template, scan result, classification, assessment, score, or report generated by OptinStack constitutes a guarantee of legal compliance.

Automated classifications, AI-assisted suggestions, risk assessments, and scan outputs are generated algorithmically and may be incomplete or inaccurate. Jurisdiction and geolocation detection is based on available technical signals and may not accurately identify a visitor's location or legal jurisdiction. Privacy laws and regulatory guidance are subject to differing interpretations by regulators, courts, and supervisory authorities and may change over time.

You should consult qualified legal counsel regarding your compliance obligations and should not rely on any statement, representation, marketing claim, recommendation, scan result, assessment, score, report, template, or output generated by the Service as a guarantee of compliance.

OptinStack is not liable for governmental penalties, fines, sanctions, regulatory investigations, or enforcement actions arising from your use, configuration, deployment, or implementation of the Service, including any failure of the Service to detect, block, categorize, or release a tracker.

You are solely responsible for assessing the laws applicable to you, configuring the Service, deploying and testing it within your environment, validating tracker classifications and disclosures, maintaining accurate notices to your visitors, and obtaining your own legal advice. OptinStack does not control third-party technologies deployed on your websites and is not responsible for their functionality, behavior, availability, data collection practices, or compliance. You are responsible for implementation failures, script deployment errors, tag manager configurations, and any failure to honor visitor consent preferences.

Consent records, audit logs, and reports are informational records. They are not legal proof of compliance and their acceptance is not guaranteed by any regulator, court, or authority.

To the maximum extent permitted by law, you agree to indemnify, defend, and hold harmless OptinStack LLC and its affiliates from and against any claims, damages, losses, liabilities, fines, penalties, costs, and expenses (including reasonable legal fees) arising from or relating to: your use or configuration of the Service; your customer data and any instructions you give us regarding processing; your websites, privacy notices, consent banners, cookie or tracker disclosures, and data collection practices; your failure to comply with applicable laws; inaccurate or misleading content you publish; or any unlawful or unauthorized use of the Service.

When you run a domain scan, OptinStack discovers URLs on the registered hostname (typically from your sitemap, or from links on your homepage if no sitemap is available), selects pages according to the plan tier limit for that hostname, and records trackers observed on those pages.

Default scan limits are: Free: 50 pages with a 24-hour cooldown; Pro: 100; Business: 350; Enterprise: 1,000. Effective limits may be updated in the published pricing policy. Higher plans scan a longer prefix of the same deterministically ordered URL list.

If your site has more discoverable pages than your plan allows, we scan only up to your tier limit. Trackers on pages we do not scan are not automatically included in your inventory, consent banner configuration, or blocking rules. That may leave gaps in the information you present to visitors and can affect compliance with privacy regulations such as GDPR or CPRA unless you upgrade, scan again at a higher tier, or add trackers manually.

Webflow, Framer, and custom hostnames follow the same assignment rules. A development hostname may receive Free or paid coverage and the entitlement may be moved once to a registered, verified production hostname.

If your site is served through a reverse proxy, the assigned hostname is the public hostname visitors use, not the private origin behind the proxy.

When you publish, tracker rules on the live site reflect only what we detected on scanned pages (plus any trackers you add manually). You must review unscanned areas of your site separately.

Scan results and tracker classifications are provided for inventory and configuration assistance and are automated estimates that may be incomplete or inaccurate. We do not warrant that any single scan will detect every tracker on your property, that tracker counts will be identical between scans, or that scans or classifications alone satisfy your legal obligations. You remain responsible for reviewing, validating, and correcting results, upgrading tiers when needed, and maintaining accurate disclosures to visitors.

See /legal/domain-scans for full details on URL selection, consistency, and limitations.

You must be at least 18 years old, or the age of majority in your jurisdiction, to use the Service. By using the Service you represent that you meet this requirement. You are responsible for all activity that occurs under your account and for keeping your credentials secure.

You agree to:

OptinStack offers production Free hostname coverage (unlimited by default), paid Pro and Business hostname subscriptions, Enterprise contracts, and annual Workspace site packs. Free and paid coverage attach to a project hostname; site packs attach to a Workspace.

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

Checkout and recurring billing are handled by Paddle. By purchasing a paid plan, you also agree to Paddle's buyer terms where applicable. Our refund policy is published at /legal/refunds and applies to all paid self-serve plans.

Each hostname may have its own paid Pro or Business subscription. example.com and foo.example.com are separate hostname subscriptions and cannot share one hostname plan. A paid subscription may be assigned to a Webflow or Framer development hostname and moved once to a verified production hostname. A Workspace site pack independently grants Business coverage to 50 active projects in that Workspace, with additional packs adding 50 projects each. Overlapping hostname subscriptions remain active unless you explicitly schedule their cancellation.

Enterprise plans and custom Workspace terms may be activated under a separate written agreement. Contact sales for custom terms.

Business, Enterprise, and eligible Workspace Business projects can confirm one Preferred consent storage region before first production publish. The choice is recorded once and remains associated with the project after downgrade or later upgrade. A live Free, Lite, or Pro project that later becomes eligible may select once for future records only.

The feature covers authoritative consent records, regional cold consent-analytics archives, and temporary CSV export artifacts. It excludes Analytics Engine, edge and transient processing, queues, Pipelines, logs, support, security, and administration. Existing records are not automatically migrated, and historical migration is not included in the self-service feature.

The regions are Cloudflare R2 location hints and are best-effort. They do not guarantee a particular country, data residency, jurisdiction, or that data will only be processed or accessed in the selected region.

Free is provided at no charge for eligible assigned hostnames by default (unlimited Free hostnames unless we publish a different commercial limit), with published feature and usage restrictions. Paid plans include published fair-use allowances. Abuse, security risk, non-payment, or unlawful use may result in restriction or suspension as permitted by these Terms.

Unless separately agreed in writing, OptinStack does not provide service level commitments or guarantees regarding uptime, availability, or response times, and the Service is provided on an "as available" basis.

We are not liable for any delay or failure to perform resulting from causes beyond our reasonable control, including infrastructure outages, internet or network failures, third-party service disruptions, government actions, natural disasters, or other force majeure events.

You may not use the Service in violation of applicable export control laws, trade sanctions, or other trade restrictions, and you represent that you are not located in, under the control of, or a national of any restricted jurisdiction.

OptinStack source code identified as open source is distributed under the ISC License. We retain all rights in the hosted Service, documentation, branding, and trademarks. You retain rights in your content and configuration. You grant us a limited license to host and process your content solely to provide the Service.

The Service is provided "as is" and "as available" to the maximum extent permitted by law. We disclaim all implied warranties, including merchantability and fitness for a particular purpose. We do not guarantee uninterrupted or error-free operation.

To the maximum extent permitted by law, in no event will OptinStack be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, data, or business, arising from the Service. We are not liable for regulatory fines, penalties, sanctions, governmental investigations, or enforcement actions arising from your use or configuration of the Service.

To the maximum extent permitted by law, our total aggregate liability for any claims arising from the Service is limited to the fees you paid us in the twelve months before the claim, or one hundred US dollars if you use only Free.

You may discontinue your use of the Service at any time. Canceling a subscription does not automatically delete your account or project data. Unless a separate written agreement states otherwise, you must export any consent records or configuration you wish to retain before your account or applicable project is deleted or becomes inaccessible. Export availability depends on your active plan and account status.

We may suspend or terminate access for material breach of these Terms, non-payment, unlawful use, or where reasonably necessary to protect the Service, its users, or third parties. Where practicable, we will provide notice and an opportunity to cure a remediable breach.

Upon termination, your right to use the Service ends. We will handle Customer personal data as described in the DPA and Privacy Policy, subject to applicable legal retention requirements. Provisions that by nature should survive (including payment obligations, intellectual-property provisions, disclaimers, limitations of liability, dispute provisions, and indemnification) will survive.

These Terms are governed by the laws of the State of Wyoming, without regard to its conflict of law principles. This choice of law does not deprive a consumer of protections under mandatory laws that apply in the consumer’s place of residence.

Except where prohibited by applicable law, any dispute, claim, or controversy arising out of or relating to these Terms or the Service will be resolved by final and binding arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules (or Commercial Arbitration Rules for business customers), conducted in Wyoming. The arbitrator, and not any court, has exclusive authority to resolve any dispute relating to the interpretation, applicability, or enforceability of this arbitration provision. If applicable law gives you a non-waivable right to bring a claim in your local courts or before a regulator, this paragraph does not restrict that right.

Class action waiver. To the extent permitted by applicable law, any claim must be brought in the party’s individual capacity, and the parties waive the right to participate in a class action, class arbitration, or representative proceeding. This waiver does not apply where prohibited by law.

Notwithstanding the above, either party may bring a claim in the state or federal courts located in Wyoming for matters concerning intellectual property infringement, injunctive relief, or unpaid fees.

Consent records collected through your use of the Service are retained for twelve (12) months on standard plans, unless you request earlier deletion. Records outside the retention window are automatically removed and cannot be recovered from OptinStack. Archiving a project stops runtime activity but does not pause or extend the standard retention window. You may delete individual consent records from your workspace at any time; verified project-wide erasure requires a support request. Enterprise customers may negotiate a different retention period under a separate written agreement. This retention supports your accountability workflows; you are responsible for determining and implementing any longer retention period your legal obligations require, including through available export or Consent Forwarding features. OptinStack does not guarantee that any regulator will accept the records as evidence of compliance.

Entire agreement. These Terms, together with any referenced documents (including our Privacy Policy, DPA, Refund Policy, and Domain scan disclosure), constitute the entire agreement between you and OptinStack regarding the Service.

Order of precedence. If these Terms conflict with an applicable order form or separate written agreement signed by OptinStack, that signed agreement controls for the subject of the conflict. The DPA controls for the processing of Customer personal data, and mandatory transfer terms control as stated in the DPA.

Severability. If any provision of these Terms is held unenforceable, the remaining provisions remain in full force and effect.

Waiver. Our failure to enforce a right or provision is not a waiver of that right or provision.

Assignment. You may not assign or transfer these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, sale of assets, or other transaction without restriction.

We may update these Terms from time to time. We will post material changes on this page with a revised "Last updated" date and, where appropriate, notify account owners by email or in-product notice. Your continued use of the Service after changes become effective constitutes acceptance of the updated Terms. If you do not agree to the updated Terms, you are not authorized to continue accessing or using the Service.

OptinStack LLC operates OptinStack. Questions about these Terms: hello@optinstack.com. Enterprise inquiries: hello@optinstack.com. Buyer support via Paddle: https://www.paddle.com/.

Registered address: 30 N Gould St, STE R, Sheridan, WY 82801, USA.