Last updated: 8 October 2026
The Nivoli Edge service is operated under the trading name "Nivoli" by a Dutch private limited company (besloten vennootschap), KvK 82568650, De Grebbe 26, 3448 BV Woerden, the Netherlands (the controller for the personal data described below). Contact: support@nivoli.com.
To meter quotas, render your dashboards, and send your reports, the service records per-request metadata: requested URL path, response status, cache outcome, response size, negotiated image format, a bot/browser classification, and the visitor's country, referring site and device class. For a request a security shield refused or flagged, the record also holds the part of the request that tripped it (for example a query string or a form field name, never a cookie or form value), the visitor's network (its autonomous system number and operator name) and a six-character code derived from the visitor's IP address with a key that changes every day and is deleted after eight days. The address itself is never stored, and once that day's key is deleted the code can no longer be linked to it by anyone, us included. This is stored in Cloudflare Analytics Engine for up to 90 days and is used in aggregate. We set no tracking cookies, use no fingerprinting, and run no advertising or third-party analytics.
When visitors load your site through the service, we process their requests as a processor on your behalf. Visitor IP addresses are handled by Cloudflare to route and answer requests and are not part of the usage data. They are kept briefly, up to ten minutes, to apply the flood limits and the scanner lockout, and the address is recorded with each unlock request and lock change in your site's lock activity log (state changes kept up to 200 entries, requests for 90 days). Copies of your images and pages exist only in Cloudflare's edge cache and expire under normal cache rules. A data processing agreement is available on request.
We send transactional email only: license keys, magic links, quota warnings, monthly reports, and failure alerts, delivered via Twilio SendGrid. Report and alert emails can be disabled in the plugin (Account → Email & reports). We send no marketing email.
| Party | Role | What they process |
|---|---|---|
| Cloudflare, Inc. (US, global network) | All service infrastructure: edge delivery, storage (KV), image processing, usage analytics | Request metadata, tenant config, cached content, visitor IPs (transient) |
| Stripe, Inc. (US/IE) | Payments: merchant of record (independent controller) | Payment and billing data, your email |
| Twilio SendGrid (US) | Transactional email delivery | Your email address, email content |
| Tinify B.V. (NL) | Optional source-image compression, only if you enable it | Image files you choose to compress. With your own Tinify key, your site talks to Tinify directly; nothing passes through us. |
Transfers outside the EEA rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses maintained by these providers.
We process customer data to perform our contract with you (Art. 6(1)(b) GDPR), usage and abuse-prevention data under legitimate interest in operating and protecting the service (Art. 6(1)(f)), and billing records where the law requires retention (Art. 6(1)(c)).
You have the GDPR rights of access, rectification, erasure, restriction, portability, and objection. Email support@nivoli.com and we will respond within one month. You can also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
We will update this policy as the service evolves and note the date at the top. Material changes affecting subscribers are announced by email.
Pricing · Terms of Service · Privacy Policy · support@nivoli.com