DPA
For visitor data collected on your site, you are the controller and Nolgard is the processor.
Data
- IP addresses: salted hashes; event IP hashes use a daily salt. Raw IPs not stored.
- Browser and device signals, interaction timing.
- Customer-supplied account ids: stored as given, up to 256 characters, alongside salted account-link hashes.
- Customer-supplied emails: hashed for correlation; account directory stores only a masked email (first character and domain), not the full mailbox.
- Email domain.
Retention
- Events and account links: 30 days. Account directory: 30 days since last seen.
- Audit log: 365 days.
- Hourly aggregates: 90 days, no visitor identifiers.
Optional abuse network
On a customer's opt-in instruction, Nolgard processes keyed hashes of device fingerprints, normalized emails and non-freemail email domains across participating customers for fraud prevention. These hashes are retained for 90 days; raw values, visitor ids and IP addresses are never shared. Non-participating sites neither contribute nor receive matches. Customers must include this optional processing in their notices and determine its lawful basis.
Storage
Cloudflare EU jurisdiction: D1 and Durable Objects.
Subprocessors
| Name | Purpose | Location |
|---|---|---|
| Cloudflare | Hosting, edge, storage | EU storage; global edge |
| Resend | Transactional email to portal users | US |
Legal basis
Suggested for your notice: legitimate interest in fraud prevention (GDPR Recital 47).