Consensus

GDPR overview

There is no mention of the GDPR anywhere on the site. The word does not appear in the Privacy Policy dated 15 May 2026, in the Terms of Service dated 25 June 2025, or in any other page collected. No Article 27 EU representative is designated, no Data Processing Agreement is published or offered, no subprocessor list exists, and no legal basis for processing is stated. The policy is written under United States law: it addresses California privacy rights while declaring the company outside the scope of the CCPA, and it states that the company is headquartered in the United States with all servers located there, users consenting to processing under US jurisdiction. Rights to review, amend or delete personal data are offered to every user on request to the privacy address, but as a contractual courtesy rather than as GDPR data-subject rights.

Who owns the data?

The Terms of Service state that the site, its content, code and intellectual property belong to Consensus NLP, Inc. or its licensors, and that users receive only the limited rights the Terms grant. The Terms contain no clause assigning ownership of the questions, prompts or content a user submits, which the Privacy Policy classes as Service Interaction Information alongside the output generated for that user. The publisher states plainly that it does not sell personal information and does not monetise user data in any form. Access is restricted to staff with a legitimate business need and to business-critical vendors bound by enterprise agreements. Users may ask to review, change or delete their personal data. In a merger or acquisition, data may transfer to the successor, which remains bound by the same policy.

Reuse rights

Consensus grants only a limited right to use the site; it does not hand users a reusable licence over the platform, its content or its code, and the Terms reserve all other rights to the company and its licensors. Search results point to third-party peer-reviewed papers, so reuse of any paper remains governed by that publisher's own licence, not by Consensus. In the other direction, the publisher commits to narrow use of what users put in: information is used to run and secure the service, manage accounts, communicate, personalise the experience, analyse usage on aggregated and de-identified data, and meet legal obligations. Three uses are explicitly ruled out — selling personal information, training large language models on user data, and passing user data to third parties for model training, a commitment the policy extends to every vendor relationship. Data drawn from Google APIs is handled under the Google API Services User Data Policy, Limited Use included. The company does not honour Do Not Track signals.

Data retention & training

Hosting summary

The Privacy Policy is explicit: the company is headquartered in the United States and all of its servers are located there. Any personal information provided is therefore accessed or transferred to the United States, and by supplying it a user consents to storage and processing there. The policy also asks users to acknowledge that the data becomes subject to United States law, including the ability of US governments, courts and law enforcement or regulatory agencies to compel disclosure. No alternative hosting country or region is offered, and no data residency option is advertised. Information is described as encrypted both in transit and at rest using industry-standard protocols, with SSL named in the security section. Note that the domain resolves to a Cloudflare anycast address, which identifies the content delivery network rather than the location where data is stored. The governing law of the Terms of Service is that of Delaware, with arbitration seated in Kent County, Delaware.