Consent & Privacy

Gurulu uses a 4-level consent model that controls what data is collected and how identity claims are processed. Consent is enforced at the SDK level before any data leaves the device.

4-Level Consent Model

Each consent level determines which identity claims are created and what processing is allowed.

Level	Description	What's tracked
`none`	No consent	Anonymous aggregates only, no identity claims
`analytics`	Basic analytics	anonymous_id only, no PII (email, phone, oauth)
`marketing`	Marketing allowed	All claims, campaign attribution
`full`	Full processing	All claims + probabilistic matching + profiling

SDK Integration

Set the consent level from any platform SDK. The consent level persists across sessions.

Web

// Set consent level
gurulu.consent.setGranular('marketing');

iOS

Gurulu.setConsent(.marketing)

Android

Gurulu.setConsent(ConsentLevel.MARKETING)

How Consent Affects Processing

none — identify() returns early, no claims created, events still tracked anonymously
analytics — only anonymous_id claim, PII filtered out
marketing / full — all claims processed normally

Consent Changes

Upgrade — immediately enables more processing
Downgrade — stops future PII processing but does NOT delete existing data
Deletion — separate GDPR/KVKK deletion request flow

GDPR/KVKK Compliance

Gurulu is designed for privacy compliance out of the box.

Privacy by default — consent_level starts at 'none'
IP addresses — never stored raw -- only daily-rotated hashes
Device fingerprint — non-invasive (no canvas, WebGL, battery)
Data processor — not controller -- customer owns the data
Retention policies — configurable per DPA

Pseudonymized Identity Graph

All identity operations are designed to prevent cross-tenant and cross-site linking.

All identity claims hashed before cross-site operations
Tenant-scoped hashing prevents cross-tenant linking
PII vault separated from analytics store

Edit this page