Early Access Privacy Notice

Last updated: 2026-09-13

This notice covers only the Early Access interest form on our public site. It is not part of, and does not amend, our main Privacy Policy (consentivo.com/en/legal/privacy-policy) — that document governs Consentivo accounts and the consent-banner data our banner collects on an Organization's behalf. Our main Privacy Policy's Section 1 (who we are), Section 5 (who we share data with) and Section 7 (your rights) apply generally and are not repeated in full here; this notice summarizes them where directly relevant.

Who we are

Consentivo is a product operated by Filova Ltd ("Filova", "we", "us", "our"), a company registered in England and Wales.

Company number: 17263134
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Contact: privacy@filova.io
Phone: +44 20 3967 8386

What we collect

Form fields, stored in our Early Access records:

Your email address (required).
Your name and your company or website, only if you choose to provide them — both are optional.

Technical data, processed separately from the form fields above:

Your request's IP address is used to derive a rate-limiting key, for abuse prevention only — for example, to stop an automated script from submitting the form repeatedly. It is not stored in the Early Access record your submission creates, it is not one of the form fields above, and it is not written to any durable database or log storage by this feature. It is kept in our server's own process-local memory, and that key can remain there beyond the moment your own request finishes, and beyond its own rate-limit window: an expired window only changes how the next request from that key is counted, it does not by itself remove the key from memory — the entry is replaced the next time that same key is used again, or cleared entirely if the server process itself ends. This is a simple, best-effort, per-process check: it is not a persistent log, and it is not shared across server instances or a distributed or guaranteed security control.

No other field or technical signal beyond the above is collected by this form.

Why we collect it, and on what legal basis

We use your email, and any name or company/site you give us, to:

manage your Early Access request;
evaluate whether and when to give you access;
contact you specifically about the Early Access you asked about.

Separately, we process your request's IP address to help prevent abuse and enforce a basic rate limit on submissions — not to manage your request or to identify you individually.

We do not use any of this to send newsletters, unrelated product promotion, or general marketing. We do not use automated decision-making or profiling to decide who receives Early Access — every request is handled manually.

Legal basis: our legitimate interests (GDPR/UK GDPR Art. 6(1)(f)). For your email and any name/company-site you give us, this is our interest in managing Early Access requests that people submit to us voluntarily, and in responding to the specific access they asked about. For your IP address, this is our interest in the security and integrity of the Service — the same basis category our main Privacy Policy uses for abuse-prevention and rate-limiting data generally. We keep an internal record of how we weighed this against your interests before relying on it. We are not asking you to consent to marketing, and submitting this form does not opt you into any consent-based communication. (This data is not used for general marketing today. If broader use were ever considered, we would carry out a separate lawful-basis and privacy assessment — including, where relevant, PECR considerations for electronic marketing — and put in place an updated notice and any required permission before starting, not after.)

Your email is necessary to reply to your request at all; name and company/site are optional context you can choose to leave out without affecting your request.

The same infrastructure providers as our main Privacy Policy's Section 5:

Supabase — database (Postgres) storage.
Vercel — application hosting, including the server-side code that handles this form.

No payment provider, CRM, or email-marketing platform is used for this data. We do not sell it, and we do not share it with anyone else, except where required by law applicable to us.

How long we keep it

We keep it only for as long as it is needed to manage your Early Access request and to get in touch with you about it. It is deleted on a verified request, the same way described in our main Privacy Policy's Section 4 — we do not currently offer self-service deletion, so this is handled manually.

Your rights

Subject to applicable law, you may have the right to access, correct, or request deletion of this data, object to or restrict its processing, or request a portable copy. To exercise any of these, contact privacy@filova.io — we may need to verify your identity first.