KEKSONAUT Consent

KEKSONAUT is a consent management service at https://keksonaut.com.
This plugin connects your WordPress site to that service, loads its browser
runtime early in the page head, and provides settings and manual connection
diagnostics under Settings → KEKSONAUT.

Configure banner layout, texts, colours, categories and services in the
KEKSONAUT web app. The plugin needs the website’s public Settings ID; an API
key is optional and is used only for administrator-requested diagnostics.
A KEKSONAUT business account and a configured website are required for the
hosted service. The data processing agreement (AVV) is incorporated into the
terms accepted during registration; no separate acceptance step is needed.
Service plans are described at https://keksonaut.com/de/preise.

Scope: Google Consent Mode v2 signals and configurable script/iframe
blocking. KEKSONAUT is not a TCF-certified CMP. Configure the relevant services
and their script integrations, and verify the result on your site. Scripts or
iframes that start before the runtime has loaded its settings cannot be
blocked retroactively. Site owners remain responsible for their consent setup
and legal obligations.

No runtime or consent defaults are added until a valid Settings ID and HTTPS
API base are configured. Simply opening the plugin settings makes no requests
to the KEKSONAUT API.

Configuration

• Settings ID — the public settings ID shown in the KEKSONAUT dashboard.
  This is different from the internal website ID.
• API base URL (optional) — leave empty to use
  https://api.keksonaut.com. Dedicated or self-hosted deployments may use an
  HTTPS base URL with an optional path, without a query, fragment or embedded
  credentials.

• API key (optional, diagnostics only) — prefer a constant in
  wp-config.php to keep the key out of the WordPress options table:

  define( ‘COOKIEMONSTER_API_KEY’, ‘cm_live_…’ );

  The constant takes precedence over a key saved in the settings. The key is
  never included in the site’s front-end markup. Leave the password field
  empty to keep a saved key; use Remove stored API key to delete it. That
  button does not change a key defined in wp-config.php.

External services

This plugin integrates with KEKSONAUT, https://keksonaut.com, to deliver a
configured consent banner and retain consent evidence. Saving a Settings ID
connects your site’s visitors to the configured service. Until it is configured,
the plugin adds no front-end integration and makes no diagnostic requests.

What is loaded or sent, and when:

• Runtime and banner assets — on front-end page views with a valid
  configuration, the browser requests https://api.keksonaut.com/runtime.js
  (or the configured API host). Banner branding and configured logo assets may
  also be requested. HTTP requests expose the visitor’s IP address, user agent
  and browser-controlled referrer information to the asset host.
• Banner settings and page counts — the runtime requests
  /runtime/settings/{Settings ID} from that API host on page load. The
  service receives the Settings ID and normal HTTP request information. It
  records aggregate page counts per website and day for service statistics
  and plan quotas.
• Browser storage — the runtime stores category/service choices, banner
  version and decision validity in localStorage (cm:consent) by default.
  Depending on the service plan and website settings, sessionStorage or a
  first-party consent cookie (cm_consent_{Settings ID}) can be used instead.
  Decision validity is configurable in the service (default: 365 days).
• Consent evidence — when a decision grants at least one optional category
  or service, the runtime posts the Settings ID, decision type, banner version
  and category/service choices to /runtime/consent/update. The current
  service records the website host, origin verification result, user agent,
  timestamp, banner version and a truncated, salted IP hash scoped to that
  website. The raw IP address is not stored in the consent event. Showing the
  banner, rejecting all optional processing or fully withdrawing consent does
  not create a consent event. Retention is configured per website (default:
  365 days); infrastructure request logging is governed by the service policy.
• Manual diagnostics — only when an administrator with manage_options
  requests diagnostics, the WordPress server fetches the public settings
  endpoint. If an API key is configured, it also requests /api/v1/websites
  with that key in an Authorization header. The API host receives the server’s
  IP address and HTTP headers, the Settings ID and, for the authentication
  check only, the API key. Diagnostics use a bot user agent so that the current
  service excludes them from page counts. This does not send the key to site
  visitors.

Service provider: rocket-ship, Inhaber Florian Bischof, An der Halde 7,
89081 Ulm, Germany. Contact: support@keksonaut.com
Legal notice: https://keksonaut.com/de/impressum
Terms of service: https://keksonaut.com/de/agb
Privacy policy: https://keksonaut.com/de/datenschutz