Privacy Policy

This Privacy Policy describes how Nodium collects, uses, discloses and otherwise processes personal data in connection with the Nodium website, applications, analytics script and related services (the "Service"), and the rights available to you.

1. Who We Are

Nodium is operated by Zachary Johnson, an individual doing business as Nodium, Kentucky, USA. Questions about this Privacy Policy may be sent to privacy@usenodium.com.

The Service involves several kinds of people, whose data is processed in different capacities:

• Customers hold a Nodium account and add their websites to it. For account and billing data, Nodium determines what is collected and why, and acts as the controller.
• Visitors visit a customer's website, where the customer has installed Nodium's analytics script. The customer determines what is collected about them and why, and acts as the controller; Nodium processes that data on the customer's behalf as a processor, under our Data Processing Addendum.
• People who use the free site check on our website. For the check, Nodium acts as the controller.
• Visitors to our own website, usenodium.com, and people who send its support form. We use Nodium on our own website, in exactly the way a customer does, and we are the controller of what it collects there: the same data as section 3.2 describes, with us in the customer's place. The app and the sign-in pages are not measured.

2. Cookies and Similar Technologies

Nodium sets one cookie, for customers only: when a customer signs in on usenodium.com, a cookie keeps them signed in. It is strictly necessary and is used for no other purpose. The analytics script sets no cookies and stores nothing on a visitor's device: no local storage, no session storage. If a customer chooses to pay, Paddle's checkout opens over the page; it is operated by Paddle under Paddle's own privacy policy, and it loads only when the customer starts a checkout.

3. Information We Collect

3.1 From customers

• Email address, to send sign-in links. The Service does not use passwords.
• The workspace's name; each website's name, address and time zone; the names the customer gives the forms on their website and what each counts as; the notes they add to their chart and the history they bring in from another analytics tool; the network addresses they ask us to leave out of their counts (kept only with that website's settings, never with a visit); and the addresses they add to receive the weekly report.
• A record of each sign-in, stored as a hash of the cookie, never the cookie itself.
• Billing records: the plan, its dates, each month's pageview count and Paddle's identifiers. Payment details are held by Paddle, never by us.

3.2 From visitors, on behalf of the customer

When a visitor's browser sends neither Do Not Track nor Global Privacy Control, the analytics script sends, for each page they open:

• the page's address without its query string, apart from any utm campaign tags;
• the name of the website they came from, never its page;
• a tap on the customer's phone number, email address or a map link;
• a click on a link to another website or to a file (its address, without its query string), the address of a page the website answered as not found, and the name of any event the customer set up;
• how the visitor used the forms already on the customer's website, described in section 3.3.

We also record the visitor's country, region and city, from Cloudflare, and whether their device is a phone, a tablet or a computer and the names of their browser and operating system, read from their browser's description. We keep only those, never the description itself. A visitor is counted under a key computed from a random value that changes every day, the visitor's network address, their browser's description and the website. The random value is deleted the day after its day, so the key cannot be traced back to the address or linked to another day. We never store the network address. "On the site now" counts the keys of the last 5 minutes' page views; nothing else is kept for it.

3.3 The customer's own forms, on behalf of the customer

Nodium puts no forms on customers' websites and never receives what anyone types into theirs. For each form on a customer's page, the script sends the form's name (from its button, or its own name or id), the label and type of each of its fields, and which form builder made it. For each visitor, under the same daily key as their pages, it sends: that they saw the form, started it, reached each field, whether a field was left empty when they pressed Send, whether the form marked a field wrong, that they pressed Send, and whether the website showed the form was sent and how (for example, the form plugin's own sign). The only thing ever read from a field is whether it is empty. Password, hidden, payment and file fields are skipped entirely, and so are fields meant only for spam robots. Nothing is sent when the visitor's browser sends Do Not Track or Global Privacy Control.

When the customer tests a form from Install, we record which builder it was, how the send was recognised and whether it was, so that we can make recognising sends more reliable. We record nothing the customer typed.

3.4 The free site check

When someone uses the free site check, we keep the address of the page they asked us to check and what the check found, for 7 days, at its own link. Anyone with the link can see it, and someone who asks to check the same address within the hour is shown the same result. We do not ask who they are. To limit how often the check runs, we count checks from each network address for up to a day, under a code derived from the address and a random value that changes every day, and Cloudflare's spam check (Turnstile) runs on each request. We never store the address itself.

3.5 The weekly site checks

For customers' websites, and for a page checked by the free site check, our crawler NodiumBot reads public pages as any visitor could. It keeps each page's address, status, title and description while a check runs, and keeps what it found (an address, a kind of problem and what was seen), speed measurements and accessibility results. It records nothing about anyone who visits those pages.

3.6 From people who report abuse

When someone reports a website using Nodium, we keep the link, the description provided and, if given, the reporter's email address, so we can act on the report and reply. The report is sent to our abuse mailbox. We do not keep the reporter's network address, and we never disclose the reporter's email address to the website's owner. The reporter's email address is deleted 90 days after the report is handled; the report itself is kept to protect the Service from repeat abuse.

3.7 From people who write to support

When someone sends the support form, their name (if given), email address and message are emailed to our support mailbox so that we can reply. The Service's database keeps no copy; the message is in our support mailbox. Cloudflare's spam check (Turnstile) runs on each message, and messages from each network address are counted for up to an hour, under a code derived from the address and a random value that changes every day.

3.8 To operate and protect the Service

Counts of requests and errors, without names. An error record holds the page's address without its query string. Requests from each network address are counted for up to two hours to limit floods, under a code derived from the address and a random value that changes every day.

4. How We Use Information

We use the information described above to:

• count each customer's visitors, who reached out, how their forms are used and what visitors looked at, and show it to the customer with the methods defined on How we count;
• check customers' websites each week, and run the free site check when someone asks;
• send customers their weekly report and notices about their account and plan;
• answer people who write to support;
• sign customers in, keep the Service secure and prevent abuse.

We do not sell personal data, display advertising, combine visitors' data across customers, or use any of it to train a model or system.

Legal bases. For customers' account data, we rely on the performance of our contract with the customer, and on our legitimate interests in securing the Service and preventing abuse. For the free site check, we rely on our legitimate interest in showing what Nodium does and on the request of the person using it. For visitors to our own website and people who send its support form, we rely on our legitimate interest in understanding how our website is used and in answering the person who wrote to us. For visitors' data on customers' websites, the customer, as controller, determines the legal basis and is responsible for informing them.

5. Email

Nodium emails only its customers: sign-in links, notices about their account and plan, and the weekly report to the addresses they choose. It emails no visitor of a customer's website, and sends no marketing email to anyone. No email of ours tracks whether it was opened or which links were clicked.

6. Sharing and Subprocessors

The companies below process data on our behalf. We will announce any change on the changelog at least 30 days before it takes effect.

We may also disclose information where required by law, or where necessary to protect the rights, property or safety of Nodium, our users or others.

7. Data Location and International Transfers

The Service's database, each website's visit records and the nightly backups are held with Cloudflare in eastern North America. A request is handled by the Cloudflare location nearest the person making it. Our scheduled jobs, queues and the browser the site checks use run on Cloudflare's network, read from and write to that storage, and keep nothing elsewhere. Every email the Service sends goes through Cloudflare's email service, and Cloudflare keeps delivery records and our services' logs for a limited time under its data processing terms. What you write to our support, abuse, legal and privacy addresses, and our replies, are kept with Purelymail in the United States. When we access a workspace for support (Section 10), we read it from where we are.

Where personal data is transferred outside the EU, the EEA or the UK, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK addendum) and, where a subprocessor is certified under it, the EU-U.S. Data Privacy Framework, as set out in our Data Processing Addendum.

8. Data Retention

• Each page a visitor opened, each tap, click and event, and each step of a form a visitor used: 90 days.
• Daily totals per website, including history brought in from another tool (no keys, no addresses): 3 years.
• The daily random value behind visitor keys: deleted the day after its day.
• A form's name and its fields' labels: until the customer deletes the website or their account.
• The weekly checks: a check's page details are deleted when it ends; what it found, once resolved, and accessibility results are kept 90 days; speed measurements 13 months.
• Free site check results: 7 days. Their counts per network address: up to a day.
• Sign-in links: valid for 15 minutes; used or expired links are deleted a day later. A sign-in lasts 30 days.
• Addresses that unsubscribed, bounced or asked to be deleted: kept as one-way hashes, so that we never email them again.
• Backups: a copy of the database, and of each website's visit records that changed that day, is made every night and kept for 30 days, so deleted data may remain in a backup for up to 30 further days.
• Error records: for as long as necessary to diagnose and resolve the error.

When a customer's plan ends, nothing is deleted early: their data stays under the periods above until they delete it.

9. Security

We protect personal data with HTTPS everywhere, encryption at rest by our host, sign-in links, sessions and emailed links stored only as hashes, a spam check on our sign-in and support forms, rate limits, and nightly backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Access by Our Personnel

We access a workspace's data only to provide support, when the customer asks or a report requires it. Opening it is an explicit step in our operations console, lasts one hour, and is recorded in an audit log every time.

11. Your Rights

• Visitors can stop being counted by turning on Do Not Track or Global Privacy Control. Because the key that counts them can't be traced back to them, we cannot find one visitor's records; the website's owner is the place to ask (for usenodium.com, that is us).
• Customers may export a website's figures and lists as a spreadsheet, delete a website, or delete their whole account. Deletion is permanent, not hidden.
• Anyone may ask us what personal data we hold about them, ask us to correct or delete it, or object to its processing, at privacy@usenodium.com. You also have the right to lodge a complaint with your data protection authority.

12. Children

Customer accounts are not intended for anyone under 18, the minimum age set out in the Terms of Service. We do not knowingly create accounts for children.

13. Changes to This Policy

When this Privacy Policy changes, the "Last updated" date above changes and the changelog describes what is different.

14. Contact Us

Requests and questions about this Privacy Policy may be sent to privacy@usenodium.com.