Legal
Privacy policy
Last updated: 23 October 2026
This policy explains how Nodiver d.o.o. (“we”, “us”) handles personal data on nodimag.com, in the NodiMagazines app at app.nodimag.com and in the e-Publications our customers publish with it. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Slovenian law.
1. Who we are
Nodiver d.o.o., Cesta Zore Perello-Godina 2, 6000 Koper – Capodistria, Slovenia (registration no. 16780361), runs NodiMagazines and is the controller for the data described in sections 3 and 4. Contact for all privacy questions: info@nodimag.com.
2. Two roles: controller and processor
For our own website, accounts and billing we decide why and how data is processed — we are the controller.
For the content our customers upload and for the people who read their e-Publications, the customer decides — the customer is the controller and we are their processor. We process that data only to provide the service and on the customer’s instructions, as set out in our Terms of service (section “Data processing for customers”).
3. Data about our customers
Account — name, e-mail address, password (stored only as a one-way hash), the organisations you belong to and your role in them.
Billing — plan, invoices, billing name and address, VAT number. Card payments are handled by Stripe; we never see or store full card numbers.
Use of the app — technical logs (date and time, pages requested, errors) to keep the service secure and working.
Messages — what you write to us by e-mail or with the contact form on nodimag.com (name, e-mail, company, team size and your message), kept to answer you and follow up.
4. Data on nodimag.com
Our website uses only cookies that are needed for it to work. Fonts are loaded from Google Fonts, which receives your IP address when a page loads. We do not use advertising or tracking cookies on nodimag.com.
5. Data about readers of e-Publications
Statistics — when someone reads an e-Publication we count views, pages read and link clicks. We do this without IP addresses and without tracking cookies, so readers cannot be identified.
Protected and paid e-Publications — readers who unlock an e-Publication with a password, or buy access, get a cookie that remembers the access. Buyers pay with Stripe; we keep the order (e-mail address, amount, date) for the publisher and e-mail the buyer a link to read on other devices.
Publisher’s own tags — publishers can add Google Analytics, Google Tag Manager, Meta Pixel or LinkedIn tags. These load only after the reader agrees (the choice is remembered in the reader’s browser), and the publisher is responsible for that processing.
6. Why we process data and on what legal basis
To provide the service you signed up for — performance of a contract (Art. 6(1)(b) GDPR).
To issue invoices and keep accounting records — legal obligation (Art. 6(1)(c)).
To keep the service secure, prevent abuse and improve it — our legitimate interest (Art. 6(1)(f)).
To answer your messages — your request or our legitimate interest.
We do not sell personal data, and we do not use it for advertising or for automated decisions about you.
7. Who processes data for us
Hostinger — hosting of the application and e-mail delivery.
Cloudflare — storage of uploaded files (R2, EU jurisdiction) and customers’ own domains.
Stripe — payments, subscriptions and payouts to publishers.
Google — reCAPTCHA, which checks that sign-ins and registrations come from people.
They process data only on our instructions under data processing agreements. When you search for free photos in the Studio, the search words are sent to Pixabay without any personal data.
8. Transfers outside the EU
Where a provider processes data outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission or by the EU Standard Contractual Clauses.
9. How long we keep data
Account data and content — for as long as the account exists. When an organisation is deleted, its files and e-Publications are deleted too.
Reader statistics — for as long as the publisher’s plan shows them (7 days to 2 years).
Invoices and accounting records — as long as Slovenian law requires (currently 10 years).
Technical logs — for a short time, about two weeks.
10. How we protect data
Encrypted connections (HTTPS) everywhere, passwords stored only as hashes, each organisation’s files kept apart from all others, private files served only through short-lived signed links, and access to our systems limited to the people who need it.
11. Your rights
You can ask for access to your data, its correction or deletion, a copy in a portable format, restriction of processing, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time.
Write to info@nodimag.com — we answer within one month. If you read an e-Publication of one of our customers, please contact that publisher first; we will help them answer.
You can also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si).
12. Children
NodiMagazines is a service for businesses and organisations. It is not meant for children under 16, and we do not knowingly collect their data.
13. Changes
We publish changes to this policy on this page with a new date and tell account owners about important changes by e-mail.