How the compliance components fit together

On this page 4 sections

Start with the job each component does. A privacy notice explains data use; a permission control asks for a particular choice; terms describe a service or contract. They can appear in the same journey while serving different purposes.

Compliance responsibilities

Information, actions and evidence

Select components from the actual processing and business model. These groups show relationships, not a checklist or a mandatory sequence.

Explain

Make the relevant facts available

InformationPrivacy & collection noticesExplain data use, purposes, recipients, retention and rights, including at the point of collection.InformationCookie & service informationDescribe declared technologies, third parties and storage.ContractTerms of serviceDescribe the service, commitments and contract conditions.Consumer informationPurchase & guarantee informationPresent product, price, commitment and applicable guarantee information.

Offer the relevant action

Keep different decisions separate

Privacy choiceOptional-service choicesControl consent-managed scripts and storage; support refusal and withdrawal.Separate permissionPurpose/channel permissionRecord an optional permission, such as email updates, separately from form submission.Contract actionTerms agreementBind an explicit agreement to the exact terms version and the host workflow.RestrictionProcessing opt-outsApply separate sale, sharing or targeted-advertising restrictions and applicable browser signals.Request routePrivacy rights requestsProvide clear routes to request access, correction, erasure or other applicable privacy rights.

Retain & follow through

Evidence and actual operations

Version historyReleased wordingKeep the exact policies, offers and revisions associated with an action.EvidenceChoice & action recordsRetain scoped acknowledgements and inspect their history; evaluate current state again at use.Host responsibilityApplication workflowsStop restricted work, handle requests, send required confirmations and carry out contractual actions.

Relevant information supports an informed action. Action records reference their exact released wording.

Publishing a notice, recording a choice and carrying out a request are distinct responsibilities. Applicability, legal basis, wording review and fulfillment remain with the operator.

Read this as a map of responsibilities. A site does not automatically need every component, and processing personal data does not automatically mean consent is the appropriate basis. Establish the actual practices, audience, service and applicable requirements before choosing an integration.

The distinction between information and an affirmative choice is reflected in GDPR Articles 7 and 13. The map describes the library's component roles; use the individual requirements for applicability, sources, implementation limits and review status.

Keep separate actions separate

Component	What the person does	What the host must carry out
Collection notice	Reads information beside a collection surface.	Handle the actual submission and disclosed processing.
Optional-service control	Allows, refuses or withdraws a declared optional purpose.	Gate the actual loaders and stop owned work on restriction.
Purpose/channel permission	Makes a separate optional choice, such as email updates.	Bind the contact context and evaluate current permission before downstream use.
Terms agreement	Takes an explicit action tied to a particular terms version.	Bind the real workflow and retain an acknowledged record when configured.
Order action	Deliberately submits the reviewed payment-obligation action.	Admit the request, handle payment and determine the actual contract state.
Processing opt-out	Restricts a declared processing activity.	Apply the restriction to relevant browser, account and downstream work.
Privacy request route	Starts an applicable privacy request.	Resolve identity/context as needed, respond and complete the actual operation.
Contract declaration route	Submits an applicable withdrawal or cancellation declaration.	Provide the acknowledgement and carry out the required contract handling.

Cookie acceptance does not lift a separate processing opt-out. Submitting a contact form does not grant marketing permission. Reading a privacy policy does not create a terms agreement. The controls keep these actions separate; the surrounding application must preserve that separation.

Assessed storage-exception settings use a separate objection workflow and explicit supported profiles. Do not treat an exception as a consent grant or infer eligibility from a country setting.

Product and purchase journeys

The producer-label example has a focused map of product information, guarantee disclosure, final order review, customer confirmation and later contract routes. These duties depend on the actual transaction and applicable rules; the example does not certify a product or complete a sale.

Records and storage

The software stores different things for different reasons: browser preferences support the current interface; released documents identify the wording; backend records retain particular actions. Retention, access and erasure need their own policy. A historic receipt alone is not a decision that processing remains allowed.

See the separate software and storage diagram for build outputs, browser storage, optional Cloudflare Durable Objects and operator access. To choose exact fields and host tasks, continue with agent setup or guided setup.