Privacy Policy
The short version
Your profiles and scan history are saved on your device. With your permission, label photos, relevant profile entries and follow-up messages pass through Pura’s Cloudflare-hosted service to OpenAI for analysis. Pura’s service processes this content without saving it in its database or application logs. From app version 2.0.8, Pura counts how the app is used, such as scans, purchases and your answer to “Where did you hear about Pura?”, under a random identifier created on your device. This is on by default, with a short notice on the first screen of a new installation. In the European Economic Area, the United Kingdom and Switzerland the app asks before using the random identifier; daily totals without any identifier are counted there too unless you turn usage statistics off. Earlier versions measured daily totals only, with a separate optional setting from 2.0.5. You can turn this off in My profile at any time. Earlier versions use optional PostHog analytics only after you enable them. Photos, profile information and conversations stay out of both forms of measurement. Subscriptions are sold by Apple and their status is tracked through RevenueCat. On this website, separately from the app, we use Google Analytics, and only if you agree to it first. We do not sell your data. We measure Pura’s Apple Ads campaigns separately through Apple and RevenueCat. From version 2.0.6, the app also sends a small set of events (install and open, onboarding finished, first finished scan, trial start and purchases) with device information to Meta and TikTok to measure Pura’s own ads. Your advertising identifier is included only if you allow tracking. Photos, label text, scan results, chats, health preferences and profile details are never shared with Meta or TikTok, and we do not use them for advertising.
This policy covers both the Pura app and the pura.to website. They collect different things, so they are described separately: the app first, then the website.
The rest of this page is the detail, written to meet the requirements of the EU and UK General Data Protection Regulation (GDPR) and Turkey's Law No. 6698 on the Protection of Personal Data (KVKK).
Who is responsible for your data
The data controller, which is also the "veri sorumlusu" under KVKK, is:
Asli Dane Kartal
hello@pura.to
If you have any question about this policy or about your data, that email address is the right place to send it.
What data we handle, and why
Profiles you create
To personalise a scan, you set up a profile: allergies, health conditions, lifestyle preferences and anything you type into your own avoid list. You can create separate profiles for family members. Some of this is health data, which both the GDPR and KVKK treat as a special category needing extra protection.
Profiles are saved on your device. When you request an analysis or ask a follow-up question, the relevant profile entries pass through Pura’s Cloudflare-hosted service to OpenAI. Our service processes them transiently and does not save them in its database or application logs. The app explains this transfer and asks for permission before sharing.
Why: to provide the core function of the app.
Legal basis: your explicit consent to the processing of health and other special category data, under Article 9(2)(a) GDPR and Articles 5(1) and 6(2) KVKK, given before information is shared for AI processing. Performance of our contract with you under Article 6(1)(b) GDPR covers the rest. You can withdraw AI-sharing permission in My profile using “Stop sharing with OpenAI.” A later scan or conversation requires permission again. You can also delete a profile or reset the app’s local personal data.
Photographs of labels
When you scan, the photograph passes through Pura’s Cloudflare-hosted service to OpenAI’s API to be read and evaluated. Pura does not save the photograph in its server database or application logs. OpenAI’s handling and retention are governed by its API data policies; provider operational processing is separate from Pura’s database. If the app keeps a copy or a thumbnail with your scan history, that copy is on your device.
Please try to frame only the label. If you photograph something else by accident, for example a face or a document, that image is sent for analysis in the same way, so it is worth taking a moment to check the frame.
Why: to read the ingredients and evaluate them against your profile.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR, together with your explicit consent where the scan is evaluated against health data, Article 9(2)(a) GDPR and Article 6(2) KVKK.
Follow-up questions and service security
When you ask about a scanned product, the relevant product result, profile information and conversation content pass through the same Cloudflare-hosted service to OpenAI. Pura does not save this content in its server database or application logs. The purpose and consent described above also apply to these requests.
To authenticate the app and prevent abuse, our service stores installation verification keys and counters, hashed short-lived session tokens, one-time challenges, request identifiers and rate counters. IP-based rate counters use a server-secret hash rather than a raw IP address in our database. Cloudflare also processes network requests to deliver and secure the service under its own service terms. This security processing is separate from optional usage analytics.
Scan history
The results of your scans, and when they happened, are stored on your device so you can look back at them. Results pass through our service when generated, and relevant results are sent again when you ask a follow-up question. We do not keep a server-side copy of your history.
Why: so you can find products you have already scanned.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR, and Article 5(2)(c) KVKK.
Product analytics from version 2.0.8
From version 2.0.8, “Usage statistics” covers two things: the daily totals described in the next section, and a record of how the app is used under a random identifier that Pura creates on your device. That record contains installs and launches, onboarding steps, your answer to “Where did you hear about Pura?”, scan outcomes, errors, purchase-screen actions, trials and purchases. Each entry also carries the week the app was installed, the app version, the App Store country, which version of an in-app experiment you see, whether you allowed this after a notice or by tapping “Allow”, and available Apple Ads attribution. Every value comes from a fixed list. Photos, label text, ingredients, product names, scan results, chat text, health preferences, profile details and anything you type are never included.
The random identifier is not your advertising identifier (IDFA) or identifier for vendor (IDFV). It is not given to Meta, TikTok or any advertising service, and it is not used to track you across other companies’ apps or websites. It is excluded from device backups, so a restored or reinstalled app gets a new one. While the setting is on, Pura also stores the identifier, the install week, the experiment version and your onboarding answer as attributes of your RevenueCat customer record, so we can see whether trials and purchases follow from use of the app, and verified RevenueCat purchase notifications are linked to this record. Pura’s Cloudflare-hosted service replaces RevenueCat identifiers and transaction references with secret-key hashes before sending events to PostHog, with IP-based location disabled.
Outside the European Economic Area, the United Kingdom and Switzerland, this starts on a new installation once its first welcome screen, with a short notice, has been shown, and on an installation from an earlier version at its next launch. If you turned usage statistics off before, it stays off. Inside the EEA, the UK and Switzerland, based on your device region or App Store country, the app asks first, and nothing is recorded under the random identifier unless you tap “Allow”. If you choose “Not now”, Pura still counts the daily totals described in the next section, which carry no identifier of any kind; turn off “Usage statistics” in My profile to stop those too.
Turn off “Usage statistics” in My profile at any time without losing features. Collection stops, unsent events on your device are deleted, a withdrawal message is sent to our service and the identifier is removed from your RevenueCat record. Reset Pura also turns it off. Turning it on again starts a new identifier, and histories are not joined. While the setting is on, your analytics identifier is shown under it, so you can quote it when you ask us for access or deletion. Unsent events on your device are limited to 500 records and seven days. Individual records in Pura’s gateway are deleted after 90 days; PostHog copies follow the retention configured for those reports.
Why: to understand which parts of Pura help people, where they get stuck, whether changes to the app work, including comparing two versions of a screen, and which channels bring people who find Pura useful.
Legal basis: outside the EEA, the UK and Switzerland, our legitimate interest in improving our own service, Article 6(1)(f) GDPR and Article 5(2)(f) KVKK, with a one-tap objection in My profile. Inside the EEA, the UK and Switzerland, your consent, Article 6(1)(a) GDPR, for everything recorded under the random identifier, which you can withdraw at any time by turning off “Usage statistics” in My profile; the daily totals without an identifier rely on the legitimate interest described in the next section.
Usage statistics from version 2.0.2
Pura sends a fixed set of counts to its Cloudflare-hosted service: first opens, onboarding progress, scan outcomes and purchase-screen outcomes. The payload contains only these counts, the app version and whether it is an App Store or test build. It contains no installation or session identifier, advertising identifier, device model, language, country, health information, photos, scan contents or messages. The service immediately adds the counts to daily totals; it does not store individual event rows or request bodies. Only the daily totals are sent to PostHog for reports.
For grouped statistics, the app does not initialise the PostHog SDK, save a usage history, set analytics cookies or persist an analytics identifier. Short-lived progress flags in memory allow steps reached during the same app launch to be counted without exporting a journey or linking different launches. Sending is best-effort; offline activity may not be counted.
These statistics start automatically on new installations. A short notice and settings link are on the first welcome screen. Turn off “Usage statistics” there or in My profile at any time without losing features. Previous refusals are preserved. In versions 2.0.2 to 2.0.7, existing installations that had not enabled analytics stay off unless you turn the setting on; from version 2.0.8 they are switched on at the next launch, unless you turned the setting off before. In the EEA, the UK and Switzerland these daily totals continue if you choose “Not now” on the question about the random identifier. Switching off cancels pending sends; counts already included in totals cannot be isolated by person or removed as an individual history.
Why: solely to understand and improve Pura’s own features, reliability and purchase-screen usability. The totals are not shared with ad networks, used to build audiences, or joined to Apple Ads or RevenueCat identities.
Processing basis: our legitimate interest in improving our own service for the transient receipt and immediate aggregation of these limited counts, Article 6(1)(f) GDPR and Article 5(2)(f) KVKK, with a free and simple objection control. Our database does not retain individual usage information. Cloudflare processes network connection information to deliver and secure the requests. Statistics rate limits use a minute-scoped, secret-key hash rather than storing raw IP addresses; expired limits are cleaned hourly. These security records are separate from statistics and are not sent to PostHog.
Optional use over time in versions 2.0.5 to 2.0.7
In versions 2.0.5 to 2.0.7, the separate “Help improve Pura over time” setting is off by default. From version 2.0.8 it is replaced by the product analytics described above, and an earlier opt-in counts as your choice to allow it. If you enable it and the feature is available for your installation, Pura records visits, onboarding completion, scan outcomes, comparison and purchase-screen actions, errors, credit delivery and use, and subscription status under a random identifier. We connect this identifier to your RevenueCat purchase identifier to understand whether purchases are delivered and used. Pura’s Cloudflare-hosted service replaces the RevenueCat identifier and transaction references with secret-key hashes before sending optional events to PostHog. These records can describe an opted-in installation over time; they are pseudonymous, not anonymous daily totals.
Available Apple Ads attribution may be included. Missing attribution remains unknown. Photos, ingredient lists, product names, chat text, health preferences and profile selections are excluded. We do not use session replay or automatic screen recording. This permission is independent of “Usage statistics” and AI-sharing permission. Refusing it does not change scanning, purchases or access. We do not upload activity from before you opted in.
Turn it off in My profile at any time. New collection stops on your device and unsent events are deleted. A minimal withdrawal message retries when a connection is available. Server permission expires after 24 hours unless renewed, and stops earlier when withdrawal arrives. An already-sent request cannot be recalled. Previously received records remain subject to retention and deletion rights. Opting in again starts a new identifier; histories are not automatically joined. Reset Pura withdraws this permission. Reinstallation requires a new permission record.
Unsent optional events are limited to 500 records, seven days and a bounded number of retries. Individual event records in Pura’s gateway expire after 90 days. PostHog copies follow the retention configured for those reports; contact us for details or deletion. Minimal withdrawal records are retained to prevent a delayed request from restoring a withdrawn permission.
Why: to understand whether people find Pura useful, return to it, encounter problems and use what they purchased.
Permission: your separate, voluntary opt-in, which you can withdraw without losing app features.
Optional analytics in earlier versions
Versions 2.0.0 and 2.0.1 use PostHog only when you enable usage sharing. These events include feature usage, bounded error codes and performance information, associated with a random installation identifier. They exclude photos, profile selections, scan contents and conversations. From 2.0.1, IP-based location enrichment is disabled. The legal basis is consent, Article 6(1)(a) GDPR and Article 5(1) KVKK. Turning sharing off stops collection and clears queued local events; it does not delete events already received. You can contact us to request deletion of that earlier information.
Subscriptions and scan credits
Pura Premium is sold and billed by Apple. We never see your payment card, your billing address or your full Apple ID. We use RevenueCat to tell us whether a subscription is active, which product was bought, when it renews and whether it has been cancelled or refunded, linked to an anonymous app user identifier and to the receipt Apple issues.
Why: to unlock the features you paid for, to prevent abuse of the free scan, and to keep proper records of transactions.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR, and compliance with our legal obligations, Article 6(1)(c) GDPR, mirrored by Articles 5(2)(c) and 5(2)(ç) KVKK.
Apple and RevenueCat also handle credit-pack purchases. The remaining credit balance and the transaction-delivery ledger are saved locally. Reset Pura preserves them, but reinstalling Pura or changing devices does not provide guaranteed recovery of unused credits. There is currently no server-side credit wallet or app account for restoring that balance.
Apple Ads campaign measurement
From version 2.0.1, the App Store version of Pura sends Apple’s AdServices attribution token to RevenueCat. RevenueCat asks Apple whether an installation followed an Apple Ads campaign and associates the available campaign, ad group and keyword information with its anonymous app user identifier and purchase records. This helps us understand which campaigns lead to trials and purchases. Missing attribution is not treated as proof that an installation was organic.
This measurement is separate from product usage statistics and does not send your health profiles, scan photos, ingredient results or conversations to advertising services. Apple Ads measurement does not use the iOS advertising identifier (IDFA) or build advertising audiences. Apple Ads measurement does not prevent you from using the app, and it does not change your scan allowance. Apple and RevenueCat process this information under their applicable service and privacy terms. The separate Meta and TikTok measurement from version 2.0.6 is described in the next section.
Why: to evaluate spending on Pura’s own App Store advertising and understand attributed trial and purchase outcomes. Contact hello@pura.to about access, objection or deletion requests relating to this processing.
Advertising measurement with Meta and TikTok from version 2.0.6
From version 2.0.6, Pura includes the Meta SDK (FacebookCore) and the TikTok App Events SDK. They run for every user. To measure Pura’s ads, they send these events to Meta and TikTok:
- the app being installed and opened;
- onboarding being finished;
- the first finished scan;
- the start of a free trial;
- purchases, with the product ID, price and currency.
With these events, the SDKs send your IP address, your device model and iOS version, identifiers that are specific to Pura on your device (the Meta anonymous ID, the TikTok anonymous ID and the identifier for vendor, IDFV) and whether you allowed tracking.
The iOS advertising identifier (IDFA) is included only if you allow tracking when iOS asks. Pura shows that request after your first scan. You can change your choice at any time in iOS Settings > Privacy & Security > Tracking. If you do not allow tracking, the events above are still sent, without the IDFA.
RevenueCat, which manages Pura’s subscriptions, also sends subscription renewals and trial conversions to Meta through Meta’s Conversions API. This includes users who did not allow tracking.
None of the following is ever shared with Meta or TikTok: photos, label text, ingredients, product names, scan results, chat text, health preferences or profile details.
Why: to measure and improve Pura’s own ads.
Legal basis: our legitimate interest in measuring our own advertising, Article 6(1)(f) GDPR and Article 5(2)(f) KVKK. The IDFA is included only with your permission in the iOS tracking prompt. To object to this processing, write to hello@pura.to.
Meta and TikTok handle this information under their own terms and privacy policies: the Meta Privacy Policy and the TikTok Privacy Policy.
Messages you send us
If you email us, we hold your email address and whatever you write, so we can reply.
Why: to answer you and keep a record of the exchange.
Legal basis: our legitimate interest in responding to users, Article 6(1)(f) GDPR, and Article 5(2)(f) KVKK.
This website
Everything above is about the Pura app. The pura.to website is separate and much simpler.
If you do nothing
No analytics cookies are set. The site asks before it sets any, and until you answer, Google Analytics is loaded with every consent signal switched off. Nothing is written to your device.
If you agree
We use Google Analytics 4 to count visits and see which pages people actually read, so we know what is worth writing next. It sets cookies on your device, typically named _ga and _ga_<id>, which usually last up to two years and let Google tell a returning visitor from a new one. It records the pages you view, roughly where in the world you are, and what kind of device and browser you use. We have IP anonymisation switched on.
Why: to find out whether anything we write is reaching anyone.
Legal basis: your consent, Article 6(1)(a) GDPR and Article 5(1) KVKK, given through the banner before any cookie is set. You can withdraw it at any time using the "Cookies" link at the bottom of every page, which costs you nothing and changes nothing else about the site.
If you decline
No cookies are set and nothing is stored on your device. We should be straight about one thing though: Google Analytics still sends Google a cookieless signal that a page was viewed. That is how Google's consent mode works, and it is not something we can switch off while using the product at all. It cannot be tied to you across visits, and we see only aggregate counts. If that is not good enough for you, a content blocker will stop it completely and we will not think less of you for using one.
Advertising
Google's advertising signals are switched off permanently, not just until you consent. This website does not build advertising audiences. Pura’s App Store campaigns are measured separately as described above.
Hosting
The site is hosted by Vercel, which processes ordinary server request logs, including IP addresses, in order to serve pages and to protect the service from abuse. That happens for every visitor and does not depend on consent, because a server cannot answer a request without knowing where to send the answer.
Legal basis: our legitimate interest in running and securing the site, Article 6(1)(f) GDPR, and Article 5(2)(f) KVKK.
Who your data is shared with
We do not sell your personal data, we do not rent it, and we do not use health profiles, label content or conversations for advertising or for training our own models. The advertising measurement described above uses attribution, device and purchase information. Data goes to the following providers. Unless a provider is described below as acting under its own terms or privacy policy, they act as processors on our behalf and are only allowed to use it to provide their service to us.
- Cloudflare hosts Pura’s API gateway and processes the label photos, relevant profile data and follow-up content in transit, together with the authentication and abuse-prevention information described above.
- OpenAI receives label photos, relevant profile entries and follow-up conversation content to produce the requested analysis or answer. Its handling of API data, including how long it retains it, is governed by OpenAI's own API data policies and by the data processing terms we have with it.
- PostHog receives daily grouped totals from version 2.0.2, the pseudonymous product analytics events described above from version 2.0.8 and, when separately enabled and available, the optional pseudonymous events from versions 2.0.5 to 2.0.7. For earlier versions, it receives the optional installation-based events described above.
- RevenueCat receives subscription and purchase status information. From version 2.0.6, it also forwards subscription renewals and trial conversions to Meta, as described above. From version 2.0.8, it also stores the product analytics attributes described above: the random analytics identifier while usage statistics is on, the install week, the experiment version and your onboarding answer.
- Meta receives, from version 2.0.6, the advertising measurement events and device information described above from the Meta SDK in the app, and subscription renewals and trial conversions from RevenueCat. Meta handles them under its own terms and privacy policy.
- TikTok receives, from version 2.0.6, the advertising measurement events and device information described above from the TikTok App Events SDK in the app. TikTok handles them under its own terms and privacy policy.
- Apple handles the sale, the billing and the distribution of the app, as an independent controller under its own privacy policy. Apple's App Store may also report aggregated data to us about downloads and purchases, and Apple Ads supplies the attribution information described above.
- Google receives website analytics data, and only from visitors who have agreed to it. Google acts as an independent controller for some of this under its own privacy policy. This applies to the website only, never to anything from inside the app.
- Vercel hosts the website and processes server request logs, including IP addresses, in order to serve it.
We may also disclose data if the law requires it, for example a valid order from a court or a competent authority, or where it is necessary to establish, exercise or defend legal claims. If our business is ever transferred to someone else, data may transfer with it, and we will tell you before that happens.
Transfers outside your country
Most of the providers listed above are based in the United States, and all of them may process data there or in other countries. This means personal data may be transferred outside the European Economic Area, the United Kingdom and Turkey.
For transfers from the EEA and the UK, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, or on an adequacy decision where one applies, under Chapter V of the GDPR. For transfers from Turkey, we rely on your explicit consent under Article 9 of KVKK, or on another transfer mechanism recognised by KVKK where one is available. You can ask us for details of the safeguards in place at the contact address above.
How long data is kept
- Profiles and scan history: kept on your device until you delete them, or until you delete the app. We hold no copy, so there is nothing on our side to expire.
- AI request content: label photos, relevant profile entries and conversations are processed transiently, not saved in Pura’s server database or application logs. OpenAI and Cloudflare processing is subject to their applicable service and data policies.
- Service security records: expired challenges, sessions, rate counters and request identifiers are cleaned hourly. Inactive installation verification records are deleted after 180 days.
- Local credit records: balances, purchase-delivery records and the local journal of credit additions and spending are retained through Reset Pura so a personal-data reset does not remove purchased credits or grant the same transaction twice.
- Usage statistics: daily totals and, from version 2.0.8, individual product analytics records in Pura’s gateway are retained for 90 days. Aggregated reports in PostHog may be kept longer because they contain no individual usage history. Earlier, consent-based events follow the retention configured in PostHog; contact us for details or deletion.
- Purchase reconciliation: verified RevenueCat purchase and subscription notifications may be stored separately from optional usage, using hashed customer and transaction references, product, amount, currency and timestamps. These records support purchase delivery and reconciliation; optional usage reports are never the balance source of truth. Financial records are retained as needed to provide purchases and meet applicable accounting and consumer obligations.
- Advertising measurement: events go from the app directly to Meta and TikTok, and from RevenueCat to Meta. Pura’s own service does not receive or store them. Meta and TikTok keep them according to their own terms and privacy policies.
- Subscription records: kept for as long as your subscription is active and afterwards for as long as tax, accounting and consumer law require us to keep transaction records.
- Emails you send us: kept for up to 24 months after the conversation ends, unless we need them longer for a legal claim.
- Website analytics: the Google Analytics cookies typically last up to two years on your device, and you can clear them at any time from your browser or by declining through the "Cookies" link at the bottom of any page. Reports on Google's side are retained according to the period configured in that product.
Security
Keeping profiles and scan history on your device is the main protection: what is not collected cannot leak from us. Data in transit is encrypted with TLS. Our providers are bound by data processing agreements and by their own security commitments. No system is perfectly secure, so please also protect your device with a passcode and keep iOS up to date.
Automated processing
The analysis you see is generated automatically by an AI model. It is informational, it does not produce legal effects for you and it is not used to make any decision about you, such as pricing or eligibility. It is not a substitute for professional advice, and the limits of what it can see are explained in our Terms of Use.
Children
Pura is not intended for children to use on their own, and we do not knowingly collect personal data from children directly. A parent or guardian can create a profile for a child on their own device, and is responsible for the information they enter there. If you believe a child has provided us with personal data, please contact us and we will delete it.
Your rights
Under the GDPR and under Article 11 of KVKK you have the right to:
- learn whether your personal data is being processed and, if so, to request access to it and information about it;
- ask for inaccurate or incomplete data to be corrected;
- ask for your data to be deleted, and to ask us to notify third parties of that deletion;
- ask us to restrict processing, or to object to processing based on our legitimate interests, where that legal basis applies;
- receive the data you gave us in a portable, machine readable format, and to have it transmitted to another controller where technically feasible;
- withdraw your consent at any time, without affecting the lawfulness of what was done before you withdrew it;
- object to the results of any analysis carried out solely by automated means, where that analysis produces a result against you;
- claim compensation for damage arising from unlawful processing.
These rights are free to exercise. We will respond within 30 days, as KVKK requires, and in any case within one month, as the GDPR requires. We may need to ask you something to confirm the request comes from you.
How to delete your data
Because your profiles and your scan history live on your device, you are in direct control of most of it:
- Delete a single profile, or a single scan, inside the app.
- Delete the app from your iPhone to remove all profiles and scan history stored on the device. This does not cancel a subscription, which you cancel in your Apple ID settings.
- Use My profile → Reset Pura to remove profiles, scan history, cached products and choices. Purchased credits and the local delivery ledger are preserved; this does not cancel an Apple subscription.
- Turn off “Usage statistics” (from version 2.0.8 this also stops product analytics under the random identifier; called “Share usage analytics” in earlier versions), “Help improve Pura over time” in versions 2.0.5 to 2.0.7, or choose “Stop sharing with OpenAI” in My profile to stop new sharing. Contact us about data previously sent to providers.
- Change whether Pura may include your advertising identifier in iOS Settings > Privacy & Security > Tracking. The other advertising measurement events are sent for every user; write to us to object to them.
For anything held on our side, including analytics tied to your installation, subscription records that are not needed for legal reasons, and any email correspondence, write to hello@pura.to with the subject "Data deletion request" and tell us what you want removed. We will confirm when it is done.
Complaints
If you are not satisfied with how we have handled your data, please tell us first so we can try to fix it.
You also have the right to complain to a supervisory authority. In the EEA, that is the data protection authority of the country where you live or work. In the UK, it is the Information Commissioner's Office. In Turkey, you should first apply to us in writing under Article 13 of KVKK, and if we do not answer within 30 days or you are not satisfied with our answer, you may lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our response and in any case within 60 days of your application.
Changes to this policy
If we change what we do with data, we will update this page and change the effective date at the top. If a change is material, we will tell you in the app before it takes effect, and where the change requires your consent we will ask for it.