The paperwork side
Your cookie banner, requests about someone's data, and the agreements behind it.
Overview
Running a website means holding other people's information — names, addresses, order histories, email sign-ups — and there are rules about how you treat it. The tools here are the practical side of that: a consent banner, a way to answer requests about someone's data, and a record that you did.
These tools help you comply. They don't decide what compliance requires of your business, which depends on where you and your customers are. That part still needs your own advice.
Most of this lives on one page: Privacy & compliance, listed as Privacy in the side navigation under System.
The cookie banner
The banner is what a visitor sees the first time they arrive, asking whether they're happy to be measured.
- In the side navigation, open Home, click the gear button below View site on the Home panel, and choose Settings.
- Under Access & legal, open the Cookie banner card.
- Switch the banner on and adjust the heading and message if the defaults don't suit you.
- Add your Google Analytics or Meta Pixel IDs here if you use them — this is the page that governs when they're allowed to load.
- Save. The banner appears for visitors who haven't yet chosen, and every page's footer gets a Your Privacy Choices link so they can change their mind later. The window it opens also tells them how to ask you to see, correct, or delete their data.
The banner takes its accent and background from your site's email design, so it matches the rest of your brand without setting colors twice.
What agreeing actually changes
This is the part most cookie banners get wrong, and it's worth understanding what yours does.
The cookies that keep a cart and a sign-in working always run — a site can't function without them, and no banner asks permission for those. In Basic consent mode, the default, anything you've added here — an analytics measurement ID or a marketing pixel — loads only after a visitor accepts, and not at all if they decline.
So the banner isn't decoration: in Basic mode, declining genuinely means the tag never loads. Advanced mode, the other choice under Consent mode, loads Google's and Meta's tags up front so they can send cookieless pings for their modeling — if you choose it, say so in your privacy policy.
The flip side is that your analytics will undercount by exactly the number of people who said no. That's the honest number, not a fault.
Requests about someone's data
People have the right to ask what you hold about them, to get a copy, and to ask you to delete it. The Data subject requests tab is built for exactly that conversation.
Look someone up by email and you'll see everything the site holds on them — their customer record, orders, bookings, reviews, saved favorites, inbox mail, and consent history. From there you can export all of it as a file to send them, or erase it.
Export before you erase if there's any chance you'll need the record. Erasure is irreversible, and deliberately so.
What erasing does and doesn't remove
Erasing removes someone's personal details — their name, their address, their contact details — from your site.
It doesn't destroy your financial history. The order itself survives with the figures a tax return needs, minus the person attached to it. That's deliberate: the right to be forgotten doesn't require you to be unable to file your taxes.
The records that prove it
Two tabs exist so that you can show your work, which is usually the part that matters if anyone ever asks.
Every request you handle is logged, with what was asked and when it was answered. Data inventory & retention lists what categories of information the site holds and how long each is kept.
Consent & marketing sits alongside them, but it's a summary rather than a record: it counts your contacts, how many have opted in to marketing, and how many addresses are suppressed. To see who has opted in, look in Customers.
Subprocessors and the DPA
When you use Tropic Arts, we process customer data on your behalf — and so do the services underneath us that send your email and take your payments. The Subprocessors & DPA tab lists exactly who those are, and holds the data processing agreement that covers the arrangement.
If a customer or a client's legal team asks who touches their data, this tab is the answer.
Your privacy policy
Your own privacy policy and terms of use are pages on your site, and they're editable like any other page — find them under Pages. A starting version of each is created when your site is made, and the privacy policy includes a section on cookies, so you're not staring at a blank document.
Read it before you publish. It's written to be a sensible starting point, not a statement about your specific business, and the parts about what you collect and why are the parts you should make true.
Frequently asked questions
It depends on where your visitors are, which is a question for your own legal advice rather than something we can answer for you. What we do is build the banner and, in Basic consent mode, make sure declining actually stops the tags from loading.
For anyone who declines, yes — that's the point. In Basic consent mode, the default, the tags load only for visitors who accept, which is why your analytics numbers will be lower than your true traffic.
Only the ones the site can't work without — keeping a cart, keeping someone signed in. In Basic consent mode, nothing you add for measurement or marketing runs without consent.
Open Privacy & compliance, look them up by email under Data subject requests, and export what the site holds. The request is logged, which is the part that proves you answered it.
You keep the order and its figures; you lose the person attached to it. Erasure removes personal data, not the financial record your books depend on.
No. It's permanent by design, so export first if there's any chance you'll want the record.
On the Subprocessors & DPA tab of Privacy & compliance, along with the list of the services that handle data on your behalf.
A starting version is created with your site and lives under Pages. Treat it as a first draft to check and adjust — it can't know what your business actually collects.
Open Customers, under People in the side navigation. Everyone who has opted in carries a Subscriber label in the list, and Export CSV downloads all your contacts with a yes-or-no Marketing opt-in column. The Consent & marketing tab only counts them. Campaigns go to those people and nobody else.
It gives you the tools compliance asks for — consent, access, erasure, records, and an agreement. Whether your business is compliant depends on what you do with them, and that's a question for your own advisers.