Privacy Policy

In short. We collect as little as we can. Nvivio never stores IP addresses, sets no cookies by default and keeps all data in the EU. For the visitors of our customers’ websites, our customer decides and we only process on their behalf. For our own customers and the visitors of nvivio.com, we decide, and this policy explains what we do.

1. Who is responsible

1.1. Monto Bleu BV ([registered office to be added], enterprise number 0543.842.970, VAT BE0543842970) runs Nvivio. For questions about privacy, or to use your rights, write to support@nvivio.com. We have not appointed a data protection officer; your question reaches the people who build and run Nvivio.

1.2. We have two roles, depending on whose data it is:

Whose data	Our role	What applies
Our customers and their users: account, team, billing, support	Controller	This policy
Visitors of nvivio.com	Controller	This policy
Visitors of our customers’ websites and apps	Processor, on behalf of the customer	The customer’s privacy notice and our Data Processing Agreement; section 5 below explains how it works

2. Visitors of nvivio.com

2.1. What we measure. We measure our own website, and the use of our dashboard, with Nvivio itself, in privacy mode: without cookies and without storing anything on your device. For each page you view we keep: the address of the page (cleaned, see below), its title, the website that sent you, campaign tags (utm_…), the country, region and city derived from your IP address, the name of your network only if it is a large provider or relay, the browser, operating system and type of device, the language of the browser, the width of the screen, how far you scrolled and how long you stayed, and the buttons you clicked that we count as events (such as “Start free”). You are recognised for one day only, with a code that changes every day: a hash of a daily key, the site, your IP address and your browser. The daily key is deleted after 26 hours. Your IP address and the full user agent are never stored.

2.2. Why, and on what basis. We want to know how people find and use our website and dashboard, to improve them. Our legal basis is our legitimate interest (article 6(1)(f) GDPR). We weighed it against your interests: we cannot identify you, we do not follow you across days or websites, we share nothing with third parties for their own purposes, and you can object at any time. Browsers that send Global Privacy Control are not measured at all.

2.3. How long. Visits and events are kept for at most 13 months; anonymous daily totals, which say nothing about you, may be kept longer.

2.4. Delivering the website. Every request to nvivio.com passes through Cloudflare, which delivers the pages and protects them against attacks. That requires processing your IP address. We do not keep logs of these requests; Cloudflare processes them as our processor and may keep security data briefly under its own data processing terms.

2.5. Object. You can object to being measured on nvivio.com with the box below. Your choice is kept in one cookie (_nvivio_sid=0) for two years; see the Cookie Policy.

3. Our customers and their users

3.1. What we process, and why:

Data	Purpose	Legal basis
Email address, language, sign-in method, time of the last login	Creating and securing your account, logging you in with a link by email	Contract (art. 6(1)(b))
Organisations, roles, invitations (the email address of the invitee), access to sites	Letting you work with your team	Contract
Your sites and settings, goals, funnels, labels and notes, API keys (only a hash of the key)	Providing the Service	Contract
Questions to “Ask Nvivio” and the answers, saved as reports	Providing the feature and showing your earlier reports	Contract
Company name, address, country, VAT number, plan, payments and invoices	Billing, VAT and accounting	Contract and legal obligation (art. 6(1)(c))
Your emails to support@, security@ or team@ and our replies	Answering you	Contract or legitimate interest
Which pages of the dashboard you use (see section 2.1)	Improving the dashboard	Legitimate interest
Actions our staff took in your organisation (audit log), security events	Security and accountability	Legitimate interest and legal obligation

3.2. Emails we send. We send you the emails that belong to the Service: login links, invitations, notices about your plan, your volume, your trial and your payments, and the weekly email and monthly reports, which you can switch off or unsubscribe from at the bottom of each email. We do not send newsletters or advertising without your consent. If we ever send you news about Nvivio as a customer, you can unsubscribe with one click.

3.3. Payments. Payments are handled by Mollie B.V. (the Netherlands). Mollie receives what it needs for the payment, such as your name and your card or bank details; we never see your full card number. Mollie is responsible for that data under its own privacy statement as a regulated payment institution. We make the invoices ourselves; once we switch to Billit (Belgium), Billit makes them for us and also sends them through Peppol where the law requires it.

3.4. How long:

• Account data: as long as your account exists. When you delete your account or your organisation, we delete it within 30 days, except what we must keep by law.
• Invoices and the data on them: 10 years after the end of the year they relate to, as Belgian accounting and VAT law requires.
• Support emails: as long as needed to help you and to keep a record of our agreements; we review and delete conversations we no longer need at least once a year.
• Audit log and security events: as long as the organisation exists, and up to one year after it is deleted.

4. Who receives the data

4.1. We do not sell personal data and do not share it for advertising. We use a small number of service providers, each bound by a data processing agreement. They are listed, with what they do and where, on Subprocessors:

• Cloudflare for the network, the script, the collection of events, the queue, the configuration, sending and receiving email;
• Supabase for the database and sign-in, in Frankfurt;
• Amazon Web Services for the language model behind “Ask Nvivio”, in Frankfurt, once that feature is switched on. Our team can use the same model to improve or translate a reply to your email; it then receives that reply and, to translate it into your language, the first lines of your last email;
• Mollie for payments and, once we switch to it, Billit for invoices.

4.2. We may disclose data to an authority or a court when the law obliges us to. We check each request and, where the law allows, tell the customer concerned first.

4.3. Where. All data is stored in the EU. Cloudflare and Supabase are American companies; we use them with the European Commission’s standard contractual clauses and, for Cloudflare, the EU-US Data Privacy Framework. A request first arrives at the Cloudflare data centre closest to the visitor; for visitors in the EU, that is in the EU.

5. Visitors of websites that use Nvivio

5.1. Who decides. If you visited a website that uses Nvivio, the owner of that website (our customer) decides whether and how your visit is measured. We process the data only on their behalf and on their instructions, under our Data Processing Agreement. The website’s own privacy notice tells you who they are and on what basis they measure.

5.2. What is collected. The same kind of data as described in section 2.1: the page (with only known campaign and search parameters kept, an email address in an address replaced by :email and long codes by :id), its title, the referring website, campaign tags, country, region and city derived from the IP address, the network name only if it is a large provider (in privacy mode), browser, operating system, device, language, screen width, scroll depth, time on the page, the events the website sends, and any label or note the website owner gives a visit.

5.3. What is never stored. Your IP address is only used in memory, to make the daily code and to recognise addresses the website owner excluded; it never reaches our queue or database. The full user agent is not stored either.

5.4. Privacy mode or cookie mode. By default, a site is in privacy mode: no cookies, nothing stored on your device, and you are recognised for one day only. A website owner can switch on cookie mode, which uses one first-party cookie (_nvivio_sid, about 13 months) to recognise you on later visits; the script only sets it after the website asks for your consent, unless the website owner chose otherwise.

5.5. Not measured. If your browser sends Global Privacy Control, you are never measured. If you untick the box on a website’s privacy page, that website stops measuring you, also on its subdomains.

5.6. Your rights. Contact the website owner: they can export or delete your data in Nvivio in a minute. In cookie mode, the box on their privacy page shows your code, which they need to find you. In privacy mode, a visit can no longer be linked to you after the day it took place. If you contact us, we pass your request on to the website owner and help them.

5.7. How long. The website owner’s plan decides how long visits and events are kept (see the pricing page); anonymous daily totals may be kept longer. When a site or an organisation is deleted, all its events and daily totals are deleted within 24 hours, and the owner receives a confirmation by email.

6. Security

We protect personal data with technical and organisational measures that fit the risk, described on Security. If a breach affects your data and is likely to put your rights at risk, we tell you without undue delay.

7. Your rights

7.1. You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a common format (data portability), and to object to processing based on our legitimate interest. Where we rely on your consent, you may withdraw it at any time.

7.2. Write to support@nvivio.com. We reply within one month; if your request is complex, we may extend this by two months and tell you why. We may ask you to confirm your identity, for example from the email address of your account.

7.3. You may lodge a complaint with a supervisory authority, in particular in the country where you live or work. In Belgium that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be. In the Netherlands it is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would like to hear from you first.

8. Other things you should know

8.1. No automated decisions. We take no decisions about people that are based only on automated processing and that have legal or similarly significant effects for them. The AI features describe your website’s figures; they decide nothing about visitors.

8.2. Children. Nvivio is not meant for children. Accounts are for people aged 18 or over.

8.3. Cookies. Which cookies and browser storage Nvivio uses, on nvivio.com and on websites that use Nvivio, is in the Cookie Policy.

9. Changes

We update this policy when our processing changes. We announce important changes to our customers by email at least 30 days before they take effect. The version number and date are at the top of this page, and earlier versions are listed below.

Versions

• 1.0, 25 October 2026: first version.