Privacy
A consent product has to go first.
LTC asks companies to be specific about what they collect. Here is LTC being specific.
What leaves your device
Only when you turn remote analysis on. This is the complete list of fields — it is the actual request schema, not a summary of it:
| Field | Example | Why |
|---|---|---|
| siteDomain | example.com | To find the company’s agreements. Registrable domain only. |
| action | accept | What you are being asked to do. |
| subjects | cookies_advertising | What is being consented to. |
| surface | cookie_banner | The kind of screen. |
| linkedPolicies | /legal/privacy | The site’s own published policy links. |
| metrics | { acceptControlCount: 1 } | Counts and ratios. Numbers only. |
| controlSummary | { role, area, contrast } | Control shapes and sizes. Labels are stripped on your device. |
What never leaves, in any circumstance
- The page URL. Paths and query strings routinely contain identifiers, search terms and tokens.
- Page text. Not the article, not the message, not the document.
- Anything you type. Form values are never read.
- Passwords, card fields, session cookies and authentication tokens.
- Your browsing history. LTC does not keep one, on your device or ours.
This is enforced in code, not policy. The request has no field capable of carrying page content, and an automated test builds a page full of sensitive strings, runs the real detector over it, and fails the build if any of them appear in what would be sent.
The Consent Vault
Off unless you turn it on. When it is on, LTC records what you agreed to, when, and which version of the agreement was in force. Notes you write are encrypted at rest with a key derived per record.
LTC does not record what you clicked unless the decision was directly observable and you asked it to. It does not guess.
Deletion
LTC warns you when a company keeps your data after you close your account. Its own deletion is immediate and complete: no soft delete, no tombstone, no retained copy. You get an itemised receipt of exactly what was removed.
The single exception is one audit row recording that a deletion happened, containing your former account identifier and nothing else. Without it, LTC could not answer a regulator asking whether a deletion request was honoured.
This website
- No analytics. No tag manager. No advertising pixel. No third-party script of any kind.
- Fonts are served from this domain. Nothing is fetched from a font CDN, which would leak your IP address to a third party on every page load.
- There is no cookie banner here because there is nothing to consent to.
- LTC counts pages, not people. When you open a page, LTC increments a number on its own server: the path, an event name like page_view, and a short campaign label if an advert put one in the address. No cookie is set, no identifier is created, and there is no row for you — the database holds counters, so there is nothing to join back into a person even in principle. Refreshing counts twice, which is the price of not knowing who you are.
How LTC makes money
Subscriptions, and only subscriptions. LTC does not sell consent histories, does not take money from companies to change findings, and does not carry advertising. Those are not preferences; they are commitments in the Trust Charter, and the free tier keeps every capability that actually protects you so the incentives cannot drift. During Early Access there is nothing to buy: LTC is free and no payment information is collected at all.
The formal notice
Everything above is what LTC does. This section is the same thing in the shape a data protection regulator asks for.
Who is responsible
LTC is operated by mAIb Tech LLC, a limited liability company registered in Delaware, United States, at 8 The Green, Dover, DE 19901. Contact ltc-privacy@maib.io.
An earlier version of this page said LTC was not yet operated by an incorporated entity. That was wrong, and it is corrected here rather than quietly edited: the company exists and always did. No data protection representative has been appointed in the UK or EU, and that remains outstanding.
What is collected, and why
| Category | Where from | Purpose | Basis | Kept for |
|---|---|---|---|---|
| Consent-event classifications | Extension, only with remote analysis on | To find the agreement that governs the decision in front of you | Your consent, given by switching it on | Not retained against you; aggregated coverage counts only |
| Text you paste into /check | Website | To analyse it and show you the result | Your consent, given by pressing the button | Not stored. Analysed in memory and discarded |
| Account email and password hash | Website, if you create an account | To sign you in | Performance of the service you asked for | Until you delete the account |
| Consent Vault records | Extension, only if you turn the Vault on | To show what you agreed to and which version governed it | Your consent | Until you delete them, or the account |
| Early Access waitlist address | Website, if you ask to be told when the extension is installable | To send that one message | Your consent, given by submitting the form | Until you use the removal link, or we have sent it |
| Page and event counters | Website, automatically | To know whether an advert produced anything | Legitimate interest in not spending blind | Aggregate counts, kept; they identify nobody |
| Feedback reports | Extension or website, when you send one | To fix what LTC got wrong | Legitimate interest in the product working | Until the issue is resolved |
| Server logs | Automatic | Security, and finding faults | Legitimate interest in a service that stays up | 30 days |
| Published agreements | Companies’ own public websites | So LTC does not re-read the same terms for every user | Legitimate interest; these are public documents, not your data | Indefinitely, with their source and retrieval date |
Who else sees it
Two processors, both named, and nobody else:
| Processor | What for | Where |
|---|---|---|
| Hostinger | The server LTC runs on, and the database | Frankfurt, Germany |
| Resend | Sending the one waitlist email, if you ask for it | Ireland (EU), a United States company |
There is no analytics provider, no advertising network, no customer-data platform and no third-party model provider. The model provider is configured off in production, so no content you send reaches an external model. If any of that changes, this section changes first.
This page previously said “nobody” and named the United Kingdom. Both were wrong: a host and a mail provider are processors whether or not they are inconvenient to list, and the server has always been in Germany.
Where it goes
Everything LTC stores is processed in Frankfurt, Germany, inside the European Union. Waitlist email is sent via Resend from Ireland, also inside the EU.
LTC is operated by a United States company, so the people who run it can reach that data from outside the EU. That is a transfer, and saying it plainly is better than a paragraph about safeguards: it is one company, the data does not leave the EU in the ordinary course, and there is no onward transfer to anybody not named above.
The certificate authority that issues this site’s TLS certificate sees the domain name, and not you.
Your rights
You can ask for a copy of what LTC holds about you, correction of anything wrong, deletion of all of it, and a machine-readable export. If you created an account, your privacy page does the export and the deletion immediately and without asking you why. If you did not create an account, LTC holds nothing that identifies you.
Where processing rests on your consent you can withdraw it at any time by switching remote analysis or the Vault off, and that takes effect immediately rather than at the end of a billing period.
Automated decisions
LTC analyses documents automatically and shows you what it found. It does not make any decision about you, does not profile you, and does not produce any score, rating or eligibility outcome attached to you. It never accepts or declines anything on your behalf.
Children
LTC is not directed at children and accounts are for people aged 16 or over. LTC does not knowingly collect data from anyone younger; if you believe it has, write to ltc-privacy@maib.io and it will be deleted.
Security
Transport is HTTPS only, with HSTS. The database is not reachable from the internet and the connection to it is encrypted. Vault notes are encrypted at rest with a key derived per record. Secrets are held outside the code and are never written to logs. Report anything you find to ltc-security@maib.io.
Complaints
Tell us first at ltc-privacy@maib.io — we would rather fix it. You also have the right to complain to a data protection authority: in the UK the Information Commissioner’s Office, and in the EU your own national supervisory authority — LTC’s data is processed in Germany, so the Hessian authority in Wiesbaden also has jurisdiction.
Changes to this notice
LTC exists because companies change their terms quietly. If this notice changes in a way that materially affects you, LTC will tell you before it takes effect, and the previous version stays available.