Privatto

Description

Privatto is a self-hosted consent management platform (CMP) for WordPress, built with Brazil’s LGPD and the GDPR in mind. It requires no external service.

Main features:

• Granular consent banner with per-category preferences (necessary, analytics, marketing, embeds).
• Automatic blocking of third-party scripts and iframes via output buffering: matching <script> tags are switched to type="text/plain" before the page reaches the browser, so nothing runs before consent.
• Google Consent Mode v2 injected with everything denied by default, updated when the visitor decides.
• Proof of consent stored in your own database table: unique consent ID, action, categories (JSON), policy version, hashed IP (optional), country, user agent, page URL, and UTC timestamp. Exportable to CSV for audits.
• LGPD document generator: privacy policy, terms of use, cookie policy, returns policy, and a plain-language summary, built from a guided form. Optional AI text refinement (Groq API) for the business description only — mandatory legal clauses never go through AI.
• Data subject rights form (LGPD art. 18) with tracked protocols, 15-day response deadline monitoring, and an admin queue.
• Simplified record of processing activities (ROPA) export, as required by ANPD Resolution CD/ANPD No. 2/2022, including for small-scale processing agents.
• “Cookie preferences” reopen link so visitors can change or revoke consent at any time.

Important notice: the generated documents are a structured starting point aligned with the LGPD; they are not legal advice. Review by a lawyer is recommended, especially for complex operations.

External services

This plugin connects to one optional third-party service:

Groq API — used only if you paste a Groq API key in Privatto → LGPD Documents. It is used to (1) rewrite, in more natural language, the free-text description of your site/business that you typed into the document form, and (2) generate a plain-language summary of your privacy policy for the same document. Only that free text (and the derived facts needed to build the summary) is sent; the mandatory legal clauses are always generated locally and never sent to the API. This call happens only when you click the “Refine with AI” / “Generate summary with AI” buttons — never automatically and never on the public-facing site. If no key is configured, these buttons are disabled and everything works normally without any external call.
Service: Groq ( https://groq.com ). Terms of Service: https://groq.com/terms-of-use · Privacy Policy: https://groq.com/privacy-policy

Note: the plugin also ships a static reference catalog (service name, vendor, and known script/domain signatures) used only to help the document generator recognize and describe third-party services that your own site may already be using (e.g. Google Analytics, Meta Pixel, Stripe) when writing your cookie policy. This catalog does not make any outbound request to those services — it is local, offline pattern-matching against your own site’s HTML.