Legal

Privacy

This policy describes what we actually do with data, not what the law would allow us to do. Every line here matches something that exists in the code.

In effect since 14 September 2026.

1. The short version

• We collect nothing about the people who visit your site. No IP address, no browser, no record of which page they opened.
• We count bytes and formats per site. That is where the number on your settings screen comes from.
• From you, the customer, we keep the minimum needed to bill you and to serve your site.
• We do not sell data and we do not run advertising, anywhere.
• Our own pages — this site, nimbocdn.net, not your site — are the one place where we measure: Google Analytics, on every page. Which pages are read, from which countries, on what devices. No names, no emails, no ad profiles — Google's advertising signals are switched off. Section 3 says exactly what it sees, and section 12 how to switch it off. And where the law asks first — the European Economic Area, the United Kingdom and Brazil — none of it loads until you accept: a bar at the foot of the page asks, with Accept and Reject the same size. Elsewhere it loads when you arrive, and the same link switches it off.
• If we wrote to you and you are not a customer, it is because we measured the images your home page shows publicly. We do not keep your images, and the report is deleted in one click from its own footer. Section 19 tells the whole story.
• We set no cookies of our own anywhere in the service. The only cookie our pages set is Google's measurement cookie, _ga, and in the European Economic Area, the United Kingdom and Brazil it is set only if you accept it. The cookies page lists every single thing your browser stores here, including what it stores without asking because the page could not work otherwise.

2. Three different relationships

We hold three different roles, and it helps to keep them apart.

You are our customer. Your account data — email, domain, billing — is ours to look after, and we decide what to do with it within what is written here. In the language of the GDPR and the LGPD, we are the controller of that data.

You entrust us with your images. We convert and deliver them because you asked us to, the way you configured it. You decide what goes in and what comes out. In that part we are the processor.

Or you do not know us yet. If we write to you to introduce NimboCDN, we are the controller of the little public data from your site we use for that. Section 19 says what it is and how to erase it.

3. What we collect from you

There are exactly two places in the whole system where we store an IP address, and neither belongs to a visitor of your site. One is the server that hosts your site, recorded for one hour when the connector registers, because the limit on registration attempts counts the last hour. The other is whoever runs the image size checker, recorded for 24 hours so that one script cannot scan thousands of sites — it is counted against a limit and never attached to the report it produced. Both are deleted automatically.

4. What we do not collect

About the people who visit your site, nothing. The connector makes no network call during a visit: when someone opens a page of your site, the software installed on your server does not talk to us.

The visitor's browser asks our network for the image, and that request carries their address and the list of formats the browser accepts — as happens with any file delivery on the internet, because there is no way to answer without them. None of that is written to any record of ours. What is recorded from the request is the delivered size, the format and the cache state, against your site's identifier.

There are also no cookies of ours, no advertising, no third-party measurement, no behavioural profiles and no sale of data. None of them.

On this site — nimbocdn.net, not the site where you installed the connector — your browser keeps three choices of yours: the language you picked in the selector, the light or dark theme, and your answer about the measurement. It also keeps, for as long as the tab is open, a note that you closed the language notice and a note that a form was just sent, so a double click does not send it twice. They stay in your own browser, never reach us and identify no one. They are not cookies: they travel in no request. The cookies page lists them one by one, and clearing the site's data in your browser removes all of them.

And on this same site there is one cookie: Google's _ga, set by Google Analytics to tell one browser apart from another. It is the only cookie here, and in the European Economic Area, the United Kingdom and Brazil it only exists if you accepted it: until you answer, nothing of Google's is requested — not the script, and not even a connection, because opening one already hands them your address. Elsewhere it is set when you arrive, which is what the law of those countries allows. If you accepted and change your mind, the link at the foot of every page reopens the choice, and rejecting deletes the cookie there and then.

5. The map on the settings screen

When you open the settings screen, or a page on this site that shows prices, your browser asks our network which data centre answered it and what the approximate country and city of your address are. It is used to draw the map on screen and to decide which currency to show the price in.

That appears on screen and is discarded. It is not written to a database, to a log, or to any statistic.

6. Your images

We fetch the original image from your site, convert it to a lighter format, and keep the converted version so the work is not repeated on every visit. It is that converted version that gets delivered.

• The original file's metadata is discarded during conversion. If a photo had the location where it was taken embedded inside it, that information does not survive the conversion and is delivered to no one.
• Your original files are not touched, moved or deleted. They stay on your site, exactly as they were.
• We do not look at the content of your images, do not classify them, and do not train any model on them.

7. Why we may process this data

• Performance of the contract — for almost everything: registering the site, converting and delivering the images, billing the subscription, showing the figures on your screen. That is Art. 6(1)(b) GDPR and Art. 7(V) LGPD.
• Legitimate interests — for security and abuse prevention: the registration IP for one hour, the address of a refused image. That is Art. 6(1)(f) GDPR and Art. 7(IX) LGPD. The interest is keeping the service standing for every customer, and the impact on you is minimal because the data is little and short-lived.
• Legitimate interests, again, for the product emails — occasional notes about NimboCDN to someone who already uses NimboCDN. Same articles, plus Art. 13(2) of the ePrivacy Directive, which is written for exactly this: our own customers, our own similar service, and a way out offered both when we take the address and in every message. We would rather spell out the two halves of that promise. You are told before the first one is sent, on the connector's settings screen, where the switch sits next to the sentence explaining it — and until that screen has been opened, nothing about the product is sent at all. And the way out is one click, from the panel or from the foot of any of those emails, with no login and no questions. Switching it off never touches the account and billing notices: those are part of the service, and a plan lost in silence is the thing we are trying to prevent.
• Legal obligation — for keeping billing records for the period tax law requires.
• Legitimate interests, to write to someone who is not a customer yet — section 19 explains what we measure, what we keep and how to object.

8. Who we share it with

For the service, with four suppliers, and only what it needs to work:

• Our global network, processing and cloud storage provider, based in the United States, which performs the conversion, stores the converted versions and delivers the images.
• Our payment processor, based in the United States, which charges the subscription, issues receipts and sends billing notices. It is the one that receives your payment details; we never see them.
• Our email provider, based in the United States, which delivers the messages we send you. It receives your address and the message; it does not use either for anything of its own.
• Google, which measures the visits to our own pages, on nimbocdn.net. Under our instructions it receives the pages, countries and devices of those visits, with its advertising signals switched off, as our processor. It is the only third-party script our pages load, and in the European Economic Area, the United Kingdom and Brazil it loads only after you accept it.

Beyond that, we share only when a competent authority requires it through legal process.

Writing to people who are not customers yet involves other suppliers, detailed in section 19.

We do not sell your data or the data of anyone who visits your site. Not ever, to anyone.

If you are signing up on behalf of a company and need the named list of those suppliers in writing, for your own records of processing, ask at hello@nimbocdn.net and we will send it.

9. Where the data lives, and why it leaves your country

The account, the converted versions and the billing are processed outside your country, on our suppliers' infrastructure. Image delivery happens on the global network: the copy served to a visitor may sit in any data centre on that network.

The basis for that international transfer is that it is necessary to perform the contract you asked for: without a global network there is no global delivery. We keep data protection contract clauses with our suppliers that meet the standard required by the GDPR and the LGPD.

The applicable framework is Chapter V of the GDPR, and Arts. 33 to 36 of the LGPD together with ANPD Resolution 19/2024. The specific mechanism for transfers out of the European Economic Area is the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, which is what Art. 46(2)(c) of the GDPR provides for. Ask at hello@nimbocdn.net and we will send you a copy of the ones we hold with each supplier.

10. How long we keep it

Why bounces and complaints are kept longer. They are what stops us writing again to a mailbox that no longer exists, or to someone who marked us as spam. Deleting them would mean resuming exactly the sending that person refused. They are erased with the account.

One point we would rather spell out: delivery statistics are kept per domain and survive uninstalling the connector. That is deliberate — if you reinstall, your history shows up again instead of starting from zero — but it does mean that uninstalling the connector does not erase those figures. To erase them, use the next section.

11. Erasing everything

Write to hello@nimbocdn.net asking for erasure, from the account's contact email or otherwise proving the account is yours. Within 30 days we erase the account, your email, the site identifier, the addresses of your home page images and the converted versions we hold.

Today a person carries that out, on request. We would rather say so than promise an automatic sweep the service does not have yet.

What we do not erase: the billing records tax law requires us to keep, and aggregate figures that no longer identify you or your site.

If you are not a customer and we wrote to you, there is no need to write back: the report's footer has Delete report and my data, which erases it right away (section 19).

12. Your rights

About your data, you can ask for:

• confirmation that we process data about you, and access to it;
• correction of anything incomplete, out of date or wrong;
• erasure, anonymisation or blocking of anything unnecessary or excessive;
• portability of the data to another provider;
• to know who we share it with;
• to withdraw a consent you gave, and to know what happens if you do;
• to object to processing based on legitimate interests.

Switching off the measurement of our pages. For the Google Analytics on nimbocdn.net there is Google's own opt-out add-on, for every browser: tools.google.com/dlpage/gaoptout. It stops the _ga cookie before it is set, and from then on nothing about your visits to our pages is measured.

These are the rights in Arts. 15 to 22 of the GDPR and Arts. 17 to 22 of the LGPD. If you are in Argentina, the access, rectification and erasure rights of Law 25.326 apply as well.

To exercise any of them, write to hello@nimbocdn.net. We answer within 15 days, which is the deadline in Art. 19(1)(II) of the LGPD, and within the GDPR's one-month deadline. The request is free.

If our answer does not satisfy you, you can complain to the data protection authority in your country. In Brazil that is the ANPD. If you are in the European Union, it is the authority of the country where you live, where you work, or where the problem happened — the European Data Protection Board keeps the list of all of them at edpb.europa.eu. You can also go to our representative in the Union, in section 13, instead of coming to us.

13. Contact channel

NimboCDN is a small processing agent under ANPD Resolution 2/2022. We therefore have no formally appointed data protection officer, and in place of one we keep the communication channel that Art. 11(1) of that resolution requires.

If you are in the European Union. NimboCDN is established outside the Union. We do not direct the service at the European Union yet — there is no price in euros and no European payment method — so Art. 27 of the GDPR does not require us to have designated a representative there. We will designate one, and publish their name and address on this page, before we start offering the service in euros. Until then, and after, this same address answers you: write to hello@nimbocdn.net and your request is handled the same way and within the same deadline as anyone else's.

That channel is hello@nimbocdn.net. Requests about personal data arrive there, and the answer comes from there.

14. If something goes wrong

If a security incident happens that could put you at material risk, we notify you and the competent authority, within whatever deadline the law sets. The notice carries what we know: what happened, which data was affected, what we have already done and what you can do.

If we do not know everything yet, we send the notice anyway with what we have and complete it later. An incomplete notice on time beats a complete one that arrives late.

15. Children

The service is aimed at people who run a website, not at children, and we do not knowingly collect their data. If you believe that has happened, write to us and we will erase it.

16. Security

What we do in practice: all traffic is encrypted in transit; delivery addresses are signed, so a tampered address is refused; database access is restricted and uses its own credentials; and the connector stores nothing about your payment method because it never sees it.

What we do not do: promise that nothing will ever go wrong. No service can promise that honestly, and we do not publish promises we cannot measure.

17. Changes to this policy

When this policy changes, the effective date at the top changes with it. Material changes are announced to the account's contact email before they take effect.

18. Get in touch

NimboCDN is a service of DIO Digital E-Commerce Services LLC, 30 North Gould St, Sheridan, WY 82801, USA.

For anything about privacy: hello@nimbocdn.net. The commercial rules of the service are in the Terms of service.

19. If we wrote to you and you are not a customer

To introduce NimboCDN we measure the image weight of sites that do not use the service yet, and we write to the contact they publish. If you got one of those emails, this is exactly what we did.

• What we measure. The images your home page shows publicly to any visitor: their address, weight, format and dimensions, and how much they would weigh in a modern format. To find out, we re-encode them in memory and throw the result away. We do not keep your images or converted copies, and we do not use them for anything else.
• What we keep. The report with the measurement result, a thumbnail view of your home page, and the contact details your site publishes: email, phone, social profiles and business name. Also the site's industry, inferred from the title and public text of the home page.
• The report. It is not listed in search engines and only opens from the private link in the email. If you open it or follow its links, we record that to know whether the email was useful.
• What for. Showing you a concrete problem on your site and offering NimboCDN. Nothing else: we do not sell this data, we do not combine it with other sources and we do not build profiles.
• Why we may. Legitimate interests in making the service known to sites whose public content shows the problem it solves: Art. 6(1)(f) GDPR and Art. 7(IX) LGPD; in Argentina, Art. 27 of Law 25,326. You can object whenever you like, as explained below.
• Who with. On top of the suppliers in section 8: our cloud database and storage, the server that composes the thumbnail, our email provider, and an artificial intelligence provider that receives the title and part of the public text of your home page — never the images — to infer the industry. To find sites we use a search service with generic phrases, with nobody's data. They process in the United States, under the clauses in section 9, and the named list is available from hello@nimbocdn.net.
• How long. The report, the thumbnail and the contact details, six months from the last email or reply: after that they are deleted automatically. Sooner, if you delete them yourself. If you become a customer or we are in a conversation, they stay for as long as that relationship lasts. The content and record of the emails, six months. If you ask not to hear from us again, your address and your domain stay on the exclusion list: it is the only thing that stops us writing again.
• Erase it all, in one click. The report's footer has Delete report and my data. It erases the report, the thumbnail, your contact details and the content of the emails on the spot, and we will not write to you again. You can also unsubscribe from the link at the foot of the email, reply "no", or write to hello@nimbocdn.net.
• Your rights are those in section 12, and they apply just the same if you are not a customer.