For businesses

DPDP-compliant consent, integrated in a day.

Replace cookie-banner workarounds with consent your auditors can verify. One API to collect, verify and honour consent, with a free sandbox to build against.

Create a free sandbox Read the quickstart

Compliant by design
Itemised notices, per-purpose choices, no pre-ticked boxes, multilingual.
Simple REST API
Create a request, redirect, verify before processing. Sandbox included.
Cryptographic proof
Every grant and withdrawal is signed and hash-chained for audits.
Interoperable
Works alongside other consent managers your customers already use.

Three calls to compliance

1
Create a consent request
Describe purposes and data items once. We render an itemised, multilingual notice.
POST /v1/consent-requests
2
Redirect the customer
They review and decide on our hosted page or embedded widget. No pre-ticked boxes, ever.
302 → /c/{token}
3
Verify before you process
Check consent is active for the purpose at hand. Withdrawals reach you by signed webhook.
POST /v1/consents/verify

Everything an audit will ask for

Signed receipts
Every grant and withdrawal is signed with a key held in a hardware security module and chained by SHA-256.
Signed webhooks
HMAC-signed events with retries and de-duplication IDs, so you never miss a withdrawal.
SDKs and widget
A drop-in widget, SDKs for TypeScript, Python, Java and Go, and copy-paste snippets for PHP and .NET.
Developer console
API keys, purposes, notices and an OpenAPI 3.1 explorer, all in one place.

ConsentRoom · Consent Management SystemA self-hosted consent management system for your DPO office: encrypted customer vault, local consent checks, rights requests, grievances, breaches and audit log. An independent tool for the ease of Data Fiduciaries, separate from myconsentapp.

Industry guidesWhat DPDP asks of your kind of business (e-commerce, banking, healthcare, schools, employers and more), with a checklist you can download.

Common questions

Do we need to store consent ourselves?

You can keep a reference, but the authoritative, signed record lives in the ledger and can be verified independently at any time.

Is there a sandbox?

Yes. Create a sandbox account in minutes, simulate decisions and withdrawals, and reset at will. No real personal data is involved.

Are you registered with the Data Protection Board?

Not yet. We are a proposed Consent Manager. Registration opens on 13 November 2026, when rule 4 of the DPDP Rules 2025 comes into force, and we will apply to the Board then. We will publish our registration details on this website as soon as it is granted.

Where does personal data flow after consent is given?

The personal data itself stays in your systems. What flows is the consent decision. It is recorded per purpose and per data item, signed into our tamper-evident ledger, and sent to you as a signed webhook naming the purposes and data items. Each of your processors receives it only for the purposes it is linked to. Before you use any data, one API call confirms the consent is still valid.

How is data classified once it enters the system?

Your catalogue marks every data item as low, medium or high sensitivity. Each purpose records its legal basis, retention period, withdrawal period and child-safety rules. The classification is enforced, not just labelled: high-sensitivity data gets shorter access periods and must be checked item by item, and tracking or advertising purposes are never shown to children. You can download the whole classification as a record of processing.

How is a data erasure request fulfilled end-to-end, across every system that received the data?

Every processor linked to the purposes the person consented to receives the erasure request, and each must confirm it. The request cannot be closed while any confirmation is outstanding. Closing it requires a proof of erasure: the systems wiped, the method, the time, and anything kept under which law. We then withdraw the consents, mark them erased and sign the confirmation into the ledger. Overdue requests alert your DPO automatically. Requests can also start automatically when consent is withdrawn or a retention period ends.

How are third-party processors such as vendors, analytics platforms and payment gateways governed?

You register each processor with its country and data processing agreement, and link it to the purposes and data items it handles. It then receives only the consent changes and erasure requests for those purposes. A withdrawal counts as fully honoured only when you and every linked processor have confirmed you stopped. Anyone who misses the deadline is flagged and recorded.

What evidence can we give the Data Protection Board that a withdrawal was honoured?

One download: an evidence pack (PDF or JSON) for the consent. It contains the signed withdrawal event and its independent timestamp anchors, and the deadline to stop and whether it was met. It also holds your acknowledgement and each processor’s confirmation, the webhook delivery records, and any related erasure request. A QR code lets anyone verify the event themselves. You can also export a person-wide pack, a date-range compliance report, and a hash-chained audit log.