Privacy and GDPR
Why Nvivio needs no cookie banner
Nvivio measures without cookies and stores nothing on your visitor’s device. There is nothing to ask consent for, so Nvivio needs no banner.
- 0 cookiesso no cookie banner for Nvivio
- 0IP addresses stored
- EUyour data stays in Frankfurt
How Nvivio recognises a visit
A visitor gets a code that changes every day: a hash of a daily key, your site, the IP address and the browser. The daily key is deleted after 26 hours, so after midnight a visitor can no longer be linked to yesterday. Because your site is part of the code, nobody can be followed from one site to another.
The price of that privacy: in this mode a visitor is only recognised within the same day, so “returning” is not reliable.
7f3a…c91eIP address · Used in memory, never stored
The daily key is deleted after 26 hours: tomorrow the same visitor gets a code that cannot be linked to today’s.
What a visit stores, and what it never stores
Stored
- The page, and the site that sent the visitor
- Country, region and city
- Browser, system and type of device
- Language and screen width
- Time on the page and how far they scrolled
Never stored
- The IP address
- The full user agent
- A cookie, or anything else on the device
- Unknown parameters in addresses
- The name of a small company network; only large providers are kept
Clean addresses, before anything is stored
Only known parameters such as utm_source stay. An email address in a path becomes :email, long codes become :id. A reset link never ends up in your statistics. This is what the clean-up does with an example address:
In the browser
https://yoursite.example/account/jane@example.com/invoices/3f2b8c1d-9a4e-4c7b-8d2f-5e6a7b8c9d0e?token=a81f6c2d&utm_source=newsletterStored by Nvivio
/account/:email/invoices/:id?utm_source=newsletterWhere your data lives
The database and login run at Supabase in Frankfurt (eu-central-1). The queue and site settings are at Cloudflare under EU jurisdiction. The dashboard runs next to the database in Frankfurt; no query results are cached and no logs are kept. The database cannot be reached directly via REST or GraphQL.
Good to know: a request first arrives at the Cloudflare data centre closest to the visitor. For visitors in the EU, that is in the EU.
- 1Your visitor
- 2Nearest Cloudflare data centreIn the EU for visitors in the EU
- 3Queue and site settingsCloudflare, under EU jurisdiction
- 4Database and loginSupabase in Frankfurt
- 5Your dashboardNext to the database in Frankfurt, no logs kept
Privacy mode or cookie mode
Privacy mode is on for every new site. Need to recognise visitors over months, for a shop or an app with a login? Switch to cookie mode at any time; your data stays.
| Privacy mode | Cookie mode | |
|---|---|---|
| Cookie on the device | None | One first-party cookie, _nvivio_sid, about 13 months |
| Consent needed | No | Yes: the script sets it after nvivio.consent(); until then a visitor counts as in privacy mode |
| A visitor is recognised | Within the same day | Over days and months |
| Plans | Every plan | From Starter |
You decide how long
Data is kept for 30 days in the free plan and up to 365 days in Agency, and older data is deleted every night. In the danger zone you delete all data of a site at once.
- Free 30 days of data
- Starter 90 days of data
- Pro 180 days of data
- Agency 365 days of data
Icons without a third party
The icons next to sources such as Google or LinkedIn are fetched by Nvivio itself and kept for a week. Your browser asks nothing of an external icon service, so nobody outside Nvivio sees which sites send you visitors.
Good to know
This page describes how Nvivio works; it is not legal advice. Other tools on your site, such as ads, embedded videos or chat widgets, may still need a banner.
Measure your site without a banner
Enter your email address, click the link, add your site and paste one line. That is all.
3 sites free · no credit card · log in with a link by email