The paperwork side
Your cookie banner, requests about someone's data, and the agreements behind it.
Overview
Running a website means holding other people's information — names, addresses, order histories, email sign-ups — and there are rules about how you treat it. The tools here are the practical side of that: a consent banner, a way to answer requests about someone's data, and a record that you did.
These tools help you comply. They don't decide what compliance requires of your business, which depends on where you and your customers are. That part still needs your own advice.
Most of this lives on one page: Privacy & compliance, in the side navigation under Support.
The cookie banner
The banner is what a visitor sees the first time they arrive, asking whether they're happy to be measured.
- In the side navigation go to Sites, click your site's action button (the ⋯), and choose Settings.
- Under Access & legal, open the Cookie banner card.
- Switch the banner on and adjust the heading and message if the defaults don't suit you.
- Add your Google Analytics or Meta Pixel IDs here if you use them — this is the page that governs when they're allowed to load.
- Save. The banner appears for visitors who haven't yet chosen.
The banner takes its accent and background from your site's email design, so it matches the rest of your brand without setting colors twice.
What agreeing actually changes
This is the part most cookie banners get wrong, and it's worth understanding what yours does.
The cookies that keep a basket and a sign-in working always run — a site can't function without them, and no banner asks permission for those. Anything you've added here, an analytics measurement ID or a marketing pixel, loads only after a visitor accepts, and not at all if they decline.
So the banner isn't decoration. Declining genuinely means the tag never loads.
The flip side is that your analytics will undercount by exactly the number of people who said no. That's the honest number, not a fault.
Requests about someone's data
People have the right to ask what you hold about them, to get a copy, and to ask you to delete it. The Data subject requests tab is built for exactly that conversation.
Look someone up by email and you'll see everything the site holds on them across customers, orders, and sign-ups. From there you can export the lot as a file to send them, or erase it.
Export before you erase if there's any chance you'll need the record. Erasure is irreversible, and deliberately so.
What erasing does and doesn't remove
Erasing removes someone's personal details — their name, their address, their contact details — from your site.
It doesn't destroy your financial history. The order itself survives with the figures a tax return needs, minus the person attached to it. That's deliberate: the right to be forgotten doesn't require you to be unable to file your accounts.
The records that prove it
Three tabs exist so that you can show your working, which is usually the part that matters if anyone ever asks.
Every request you handle is logged, with what was asked and when it was answered. Consent & marketing shows who has opted in, when, and how. Data inventory & retention lists what categories of information the site holds and how long each is kept.
Subprocessors and the DPA
When you use Tropic Arts, we process customer data on your behalf — and so do the services underneath us that send your email and take your payments. The Subprocessors & DPA tab lists exactly who those are, and holds the data processing agreement that covers the arrangement.
If a customer or a client's legal team asks who touches their data, this tab is the answer.
Your privacy policy
Your own privacy policy and cookie policy are pages on your site, and they're editable like any other page — find them under Pages. A starting version is created for you when your site is made, so you're not staring at a blank document.
Read it before you publish. It's written to be a sensible starting point, not a statement about your specific business, and the parts about what you collect and why are the parts you should make true.
Frequently asked questions
It depends on where your visitors are, which is a question for your own legal advice rather than something we can answer for you. What we do is build the banner and make sure declining actually stops the tags loading.
For anyone who declines, yes — that's the point. The tags load only for visitors who accept, which is why your analytics numbers will be lower than your true traffic.
Only the ones the site can't work without — keeping a basket, keeping someone signed in. Nothing you add for measurement or marketing runs without consent.
Open Privacy & compliance, look them up by email under Data subject requests, and export what the site holds. The request is logged, which is the part that proves you answered it.
You keep the order and its figures; you lose the person attached to it. Erasure removes personal data, not the financial record your accounts depend on.
No. It's permanent by design, so export first if there's any chance you'll want the record.
On the Subprocessors & DPA tab of Privacy & compliance, along with the list of the services that handle data on your behalf.
A starting version is created with your site and lives under Pages. Treat it as a first draft to check and adjust — it can't know what your business actually collects.
The Consent & marketing tab shows who opted in, when, and how it was obtained. Worth checking before any campaign that goes beyond your newsletter list.
It gives you the tools compliance asks for — consent, access, erasure, records, and an agreement. Whether your business is compliant depends on what you do with them, and that's a question for your own advisers.