amadalis Apply to Lighthouse

PROTECT · PRIVACY AND DATA

Consent that follows the visitor.

Every visitor meets the consent rules of where they are, and the server enforces them before a page is sent. Every visitor in your data can be found, explained, exported and erased. The notice you met when you arrived on this site is Praxis's own, chosen for where you are.

Apply to the Lighthouse program Already a customer? Sign in
Every figure on this page is as of October 2026.
Privacy & Data, Consent policy on a demo store: the regime set automatically by visitor location, and the country to regime map, opt-in for 32 countries, opt-out for the United States, and opt-in everywhere else.
Consent policy: the country to regime map
On this pageWhat it does
  1. What it does
  2. The rules by place, set out on one screen.
  3. A clear choice, worded for where the visitor is.
  4. A binding no, enforced on the server.
  5. Your own tags, held to the visitor's choice.
  6. One visitor, what is recorded about them, and why.
  7. Permanent, and on the record.
  8. Your data, out, in a form a warehouse reads.
  9. Kept as long as you decide, and never deleted before there is a copy.
  10. One person, counted the way you choose.
  11. How it works
  12. Before a page leaves the server, in this order.
  13. What keeps it safe
  14. Common questions

What it does

Privacy & Data is one room in your site's admin, with three screens: Consent, Visitor Data and Exports. Its rules also run on every public page, for every visitor, before the page is built.

Privacy & Data, Consent policy on a demo store: the regime set automatically by visitor location, and the country to regime map, opt-in for 32 countries, opt-out for the United States, and opt-in everywhere else.

Consent policy

The rules by place, set out on one screen.

  • The "Consent policy" tab shows the site's policy as it stands: the regime mode; the country map, with each regime, its countries, where it applies and "Everywhere else"; how marketing is treated under opt-out; and "What visitors experience".
  • Three regimes: opt-in, opt-out and essential-only.
  • The default map: 32 countries are opt-in, the 27 countries of the European Union with the United Kingdom, Switzerland, Iceland, Liechtenstein and Norway. The United States is opt-out. Every other country, and any visit whose location is unknown, falls back to opt-in.
  • Regions too. A rule can name a region rather than a whole country, such as California (US-CA), and the more specific rule wins.
  • Three purposes, asked separately: analytics; personalization, which includes A/B tests; and marketing. What is essential to the site is never gated.
  • Changed on the record. The screen itself is read-only. A change is made by asking the copilot, and it waits behind one card, "Change this site's consent policy?", with an undo.
  • In a sentence: "Use opt-in consent in the EU".

What visitors see

A clear choice, worded for where the visitor is.

Where the law asks for consent first.

"We use cookies for analytics and personalization only with your consent." with "Accept all", "Decline" and "Privacy choices". No identifying cookie is written before a yes. On a site that sells or shares data, a page marked as English adds: "With your consent, this site also shares visit data with its marketing partners."

Where the law allows a lighter touch.

In the United States, a one-line notice at the moment of collection, with "Privacy choices" and "OK", and a "Do Not Sell or Share My Personal Information" link when the site sells or shares data.

One choice, only what it names.

"Accept all" turns on analytics and personalization, and marketing only where the banner names it.

A door that stays open.

"Privacy choices" reopens "Choose what you allow on this site.": Analytics, "Personalization & A/B", and "Marketing / data sharing", at any time. On themed pages it lives in the footer's bottom line.

Nothing lost while they decide.

Under opt-in, without Global Privacy Control or Do Not Track, an undecided visitor's landing page is held in their own browser and sent only if they accept. If a browser sends Do Not Track, the page's analytics script stays off until its visitor makes an analytics choice.

Global Privacy Control

A binding no, enforced on the server.

  • A browser that sends Global Privacy Control (the Sec-GPC: 1 header) is refused all three purposes on the server. The signal outranks any click, and a grant submitted under it is stored as a refusal.
  • That visitor is never placed in an experiment, never shown targeted content, never scored for interests, and no live channel is opened to their page.
  • A shopper who sends it keeps everything they paid for.

Head & CSP

Your own tags, held to the visitor's choice.

  • The "Head & CSP" tab holds "Head entries": your own HTML, or a tag manager template, placed in the head of every page. Each entry either waits for the consent of the purpose you choose, "Wait for consent", or loads before it.
  • Tag managers receive the visitor's choice as window.praxis.consent, and a praxis_consent_change event in the dataLayer whenever it changes.
  • One Content Security Policy for the whole site, in "Report only" or "Enforce".
  • Editors and developers work on this tab.

For developers

Visitor Data

One visitor, what is recorded about them, and why.

  • "Find a person": email, user id, visitor id, or person id.
  • A person's record opens in tabs: "Overview"; "Journey", every step and decision; "Identity", every browser joined to this person, with "Take browser off this person"; "Interests and audiences"; "Decisions", each with "Why this?"; "Data held", their consent choices and traits; and "Erase", twelve kinds of record, with "Export this visitor's data".
  • "Why this?" shows what was shown, the version, the reasons that drove it with their weight, the runner-up, and the settings in force, and "Decide it again" asks whether it would decide the same today. Your Admins can see why any visitor saw what they saw.
  • Only the site's Admins can open visitor data. Editors hold almost everything else, and not this.
  • In a sentence: "Find the visitor with this email".

Erase

Permanent, and on the record.

  • Erase one browser record behind "Permanently erase this visitor's data?", or select up to 25 and choose "Erase selected permanently". The copilot can do the same, behind the same card.
  • What goes. Their identity links, profile, traits, audience memberships, consent records, interest scores, raw events, experiment assignments and conversions are deleted. What remains of them in your event history is anonymised. Their live state on Cloudflare's network is reset, and any open live channel to their browser is closed.
  • The archive too. Every id of theirs in your export archive is marked as erased, and the archive is rewritten within seven days.
  • What stays. Your financial records: orders and shopper accounts are kept, without the link to the visitor, and orders keep the name and email given at checkout. Form submissions are deleted on their own, from the form's inbox. An evidence record of the erasure is kept, and it never names the visitor. Erasure is final, by design.
  • Outside systems. An optional door, protected by a token, lets your other systems ask Praxis to erase a browser record too. It is available on request.
  • Erasure is proven on a deployed site, since September 2026.

Exports

Your data, out, in a form a warehouse reads.

  • "Export a range" of eight datasets: events, decisions, goals, audience transitions, audiences, profiles, consent, and daily rollups, as compressed NDJSON files with a manifest.
  • "Run history" keeps every run, with its downloads and a single file for the whole run.
  • "Warehouse ingestion" gives you recipes for DuckDB, BigQuery and Snowflake.
  • Files are written to the platform's export storage, in your site's own folder, and you download them from there.
  • "Export schedule": daily, on the weekdays you choose, or monthly. Scheduled exports are available on request.
  • In a sentence: "Export this site's event data every Monday".

Retention

Kept as long as you decide, and never deleted before there is a copy.

  • "Retention" sets how many days to keep each kind of automatically captured event, from 1 to 3,650. Unless you set it, everything is kept.
  • A day's raw events are deleted only after a completed archive export covers that day.
  • In a sentence: "Keep scroll-depth events for 90 days".

Counting

One person, counted the way you choose.

  • Ask the copilot to set how this site counts people and whether it stores your own customer id. The change waits behind one card, "Change how this site counts people?".

How it works

Before a page leaves the server, in this order.

  1. The site.

    The address picks the site and its own database. An unknown or suspended address fails closed.

  2. The rules.

    The visitor's region gives the regime. Then Global Privacy Control outranks the visitor's own recorded choice, which outranks the regime's default.

  3. The visitor.

    An existing visitor cookie is kept. A new one is created only where consent allows.

  4. The experience.

    Audiences, experiments and targeted content are worked out only with personalization consent. Without it, the visitor gets the default page.

  5. On the way out.

    The consent runtime, your consent-gated tags, the measurement beacon, the notice, and decision records for visitors who allow personalization and have a visitor id.

Under opt-in, the one-year visitor cookie, __em_vid, is created only after the visitor allows analytics or personalization, and it cannot be read by the page's scripts. Each choice is kept as __em_consent. It is also recorded with the regime, the policy version and where the choice came from, if the browser has the visitor cookie or the choice creates it.

How consent works, in detail

What keeps it safe

On the server, not in the browser.

Consent is decided before the page is built, so a page never personalizes first and asks later.

Strict when in doubt.

A visit from a country not on the map, or with no location at all, gets opt-in.

Admins only.

Visitor data, changes to the consent policy, data export and form submissions are held back from every role below Admin.

Approval before anything changes.

The copilot stops at a card before it changes the consent policy, erases anyone, exports data, sets a schedule or a retention period, or switches a capture on or off.

First-party by design.

Events, visitor facts and traits live in your site's own database, with no third-party tag.

Proof without a name.

Every erasure leaves an evidence record, and the record never names the visitor.

Common questions

Does Praxis make my site compliant with privacy law?

Praxis gives you the technical foundation for it: consent by jurisdiction, enforced on the server, and the tools to answer a person who asks what you hold. Your advisers confirm your obligations, and Praxis supports you in meeting them.

What does a visitor from Canada or Australia get?

Opt-in. Every country not on the map, and any visit whose location is unknown, gets opt-in.

Does Global Privacy Control stop experiments too?

Yes. A browser that sends it is never placed in an experiment, and never shown targeted content.

Can I see why a visitor saw something?

Yes. "Decisions" on their record shows each one, with "Why this?".

Can I give a person their own data?

Yes: "Export this visitor's data" on their record.

How long is data kept?

As long as you choose, per kind of captured event. Unless you set a period, everything is kept, and nothing is deleted before an archive export covers it.

Where is my data?

In your site's own database. Your account's Overview names the region it runs in, recorded when the site was created, and says plainly that the network, its caches and AI features run worldwide.

Will my tag manager respect the visitor's choice?

Yes, if you load it as a head entry that waits for consent, or read window.praxis.consent and the praxis_consent_change event.

Run a site your visitors can trust.

As a Lighthouse customer, you run a real site on it, with consent by jurisdiction from the first visitor.

Apply to the Lighthouse program Already a customer? Sign in

This site records the pages you visit and how you found it so it can learn what visitors find useful, and uses the pages you read to tailor and test what it shows you.

These buttons need JavaScript, which is not running on this page.