Privacy & Cookies Policy

Last Update: July 3, 2026.

This document explains our Privacy and Cookie policy.

Privacy Policy

This Privacy Policy explains how information about you, that directly identifies you, or that makes you identifiable (“personal information” (also referred to as “personal data” in some jurisdictions)) is collected, used, disclosed, and otherwise processed by Nelio.

1. Definitions

These definitions should help you understand the privacy and cookie policies described below.

“Nelio“, “we“, “us” or “our” in this Privacy Policy refer to the Nelio Software S.L. a company registered in Spain (EU-VAT Number: ES-B66034794), with registered address: Carrer de Pomaret 83, 08017 Barcelona, governed by Spanish law (without application of conflict of law rules).

“Channels” means the various means by which we may collect information including our Websites, the Services, social media pages, HTML-formatted e-mail messages and through offline sales and marketing activities.

“data subjects“, “you” ,”your” mean individuals who visit our Websites, and/or use our Services as described in this Privacy Policy below.

“personal data” means any information that identifies or can be used to identify an individual directly or indirectly, including, but not limited to, first and last name, identification number, date of birth, email address, gender, occupation, or other demographic information.

“Premium Services” means the Services that are offered upon payment.

“Services” refers to:

• the online WordPress products, including the plugins Nelio A/B Testing, Nelio Content, Nelio Session Recordings, Nelio Popups, Nelio Forms and the plugins published by Nelio in the WordPress.org plugin Directory;
• our applications for third-party platforms such as Shopify; and
• any related features, integrations, APIs, and support services we provide to individuals, bloggers, and businesses to help them improve their websites, online stores, and digital presence.

“User” refers to the data subject that uses our Services. This may include individuals who have downloaded and installed a free version of one of our plugins, subscribed to or purchased a Premium Service, or installed and used our applications on third-party platforms such as Shopify.

“Websites” means all content included in our domain neliosoftware.com.

“Website Visitor” refers to anyone visiting our Websites.

2. Updates and Modifications

Nelio’s services and business may change over time, and we may revise this Privacy & Cookies Policy at any time and from time to time. The most recent version of the Privacy Policy is reflected by the version date located at the beginning of this Privacy Policy. All updates and amendments are effective immediately upon notice, which we may give by any means, including, but not limited to, by posting a revised version of this Privacy Policy or other notice on the Website. We encourage you to review this Privacy Policy often to stay informed of changes that may affect you, as your continued use of the Website signifies your continuing consent to be bound by this Privacy Policy.

At Nelio, we respect your privacy and are committed to protecting your personal data.

3. Basic Information on Data Protection

Nelio as Data Controller: This Privacy Policy applies to the processing of personal data by Nelio in its capacity as a “data controller” (or similar term under applicable laws) of personal data.

Nelio as a Data Processor: In providing our Services, our Users may collect and process data in their utilisation of Services (“Customer Data”), or we may collect such data on their behalf, which may in either case include the personal data of our customers’ authorized users. Here, Nelio is a “data processor” (or similar term under applicable laws), and we have contractually committed ourselves to our Users (in accordance with our Terms and Conditions and Data Processing Agreement) to process that Customer Data (and personal data) under the instruction of the respective client, who is the data controller in these cases. As such, this Privacy Policy does not apply to the processing of Customer Data (including personal data), and we recommend you read the privacy notice of the respective client if their processing concerns your personal data.

4. Responsible for the Processing

We inform you that the data you provide us by any means (website or email) are treated confidentially and are incorporated into the corresponding processing activity owned by Nelio Software. S.L.

5. For What Purposes We Use Your Personal Data

When conducting our business and operating our websites, services, and communication channels, Nelio collects and processes limited personal data from individuals we interact with—this includes customers, partners, suppliers, vendors, and others. We use this data for the following purposes:

(a) To Manage Business Relationships and Fulfill Contracts

We use your personal data to establish, maintain, and manage our business relationships, including:

• Processing orders and delivering products or services.
• Managing subscriptions and accounts.
• Confirming purchases and sending related information (payment notices, legal disclosures, contract updates).
• Providing customer support and responding to inquiries.
• Communicating with you through email, live chat, forms, telephone, or other channels to handle requests, complaints, or service issues.

Where required, we may record phone calls or chat sessions to improve our service quality, but we will inform you beforehand and obtain your consent where applicable.

(b) To Provide, Support, and Improve Our Services

We process your data to:

• Operate and deliver our Services.
• Support and enhance your user experience.
• Aggregate and analyze usage information to improve our Services and features.
• Share information (where necessary) with trusted third parties who help us operate the Services. We ensure these third parties process your data securely and in accordance with our instructions.
• This may also include data obtained from connected platforms such as Shopify, where applicable, in order to provide features such as A/B testing, analytics, and optimization.

This also includes the optional use of Nelio AI features, where data such as website content, historical test results, WooCommerce or Shopify store data, and analytics insights may be processed to provide automated suggestions or analysis.

(c) To Send Product, Service, and Marketing Communications

We may use your information to:

• Notify you about new product releases, service updates, or promotional offers.
• Tailor your experience on our websites or marketing channels based on your preferences and interests.
• Respond to your information requests or newsletter subscriptions.
• Share your contact details with our authorized merchant of record (FastSpring) for follow-up related to your interests.

You can opt out of receiving these communications at any time.

d) To Interact on Social Media

We may engage with you through third-party social networks (subject to those platforms’ privacy policies and terms) for marketing or support purposes.

(e) To Share Testimonials

With your consent, we may post public testimonials you provide on our website or social networks. You may contact us if you wish to update or remove your testimonial.

(f) To Personalize and Adapt Our Services

We use data to personalize your experience, including:

• Remembering items in your shopping cart.
• Preserving your order information between sessions.
• Displaying targeted marketing campaigns.

For more information, please see our Cookies Policy

(g) To Analyze and Measure Marketing Effectiveness

We track and evaluate the success of our online advertising, email campaigns, and marketing activities.

(h) To Operate Our Affiliation Program

If you choose to join our affiliation program, we will process your personal data to:

• Manage your participation.
• Track referrals and commissions.

(i) To Contact Referral Third Parties (Affiliation Program)

If you refer someone through our affiliation program, we may send them a one-time message on your behalf. We only use their contact details for this referral and to track the success of the program. They can opt out at any time.

(j) To Manage Events and Conferences

We use personal data to organize and manage events or conferences you attend, including:

• Sending logistical information and updates.
• Following up after the event with relevant information or offers.
• Sharing event attendance information with your company, if applicable.

(k) To Engage Trusted Service Providers

We may share personal data with third parties who provide services on our behalf (e.g., hosting, payment processing, analytics). All such providers are contractually required to protect your data in compliance with applicable laws.

(l) To Comply with Legal Obligations

We may process or disclose personal data to comply with applicable laws, court orders, valid subpoenas, or other lawful requests.

(m) To Manage Business Transfers

In the event of a sale, merger, acquisition, or other business transaction, we may transfer personal data to the new entity. Any such transfer will honor the commitments made in this Privacy Policy. We will notify you in case of significant changes.

6. What Personal Data do We Collect and Use

To provide our services and operate effectively, we collect and process two main types of information: personally identifiable information and non-personally identifiable information.

We process various categories of personal data when you interact with us through our websites, products, applications for third-party platforms (such as Shopify), or communication channels (collectively, the Services). Some of this data is collected directly from you, some is collected automatically when you use our Services, and in some cases, we may receive data about you from third parties who have a lawful basis to share it.

Categories of Personal Data We Collect

Information You Provide To Us

We collect and store any personal information you provide when you interact with us directly, including when you:

• Subscribe to our newsletter: email address.
• Post a comment on our blog: name and email address.
• Contact us through forms: name and email address.
• Subscribe to or purchase our Premium Services: name, email address, postal address, telephone number, and company name.
• Download or subscribe to free services: name and email address.
• Join our Affiliation Program: name, email address, postal address, telephone number, and company name.
• Contact us via email or customer support: any personal data you voluntarily provide.

Information Provided by Our Merchant of Record (FastSpring)

When you purchase or subscribe to our Premium Services, FastSpring collects your payment information as our merchant of record. From this relationship, we may receive:

• Contact details and details of the products or subscriptions you purchased.
• Links to your FastSpring invoices.
• Links to your FastSpring account (we do not have access to your payment method details).

Information Provided by Third-Party Platforms (e.g. Shopify)

When you install or use our applications on third-party platforms such as Shopify, we may receive certain information from those platforms in order to provide the Services.

The specific data we access depends on the permissions (scopes) granted by you during installation and on the features you choose to use.

Depending on these permissions, this may include:

• Store-related information (such as store name, domain, and configuration)
• Product, content, or theme data required to run experiments
• Usage and analytics data related to your store and the use of our application

We only access and process the data strictly necessary to provide, maintain, and improve the Services.

For more information, see the Third-party Providers section.

Information Collected Automatically

When you use our Services, we automatically collect certain information about your visit, your usage, and your browsing behavior, including:

• Log Data: such as IP address, general geographic location, and technical details of your device or browser.
• Content Data: any content you create or share (e.g., social posts or experiments).
• Activity Data: interactions with the Services (emails opened, actions taken, support tickets).
• Website Analytics Data: device and browser details, website behavior (clicks, scrolls, form fills)—this data is anonymized.

Cookies and Similar Technologies

We use cookies and similar technologies to collect some of the data listed above. This helps us:

• Recognize you when you return.
• Analyze how you use our website.
• Improve your experience and service quality.

You can control certain cookies and tracking. For full details, see our Cookies Policy

Publicly Available Data and Other Sources

We may also collect publicly available information, including:

• Your WordPress username from public forums.
• Your public social media account when interacting with our content or leaving reviews.

7. Legal Basis of Processing

We process your personal data in accordance with applicable data protection laws, including the Spanish Organic Law 3/2018 (LOPDGDD), the General Data Protection Regulation (EU GDPR), and, where relevant, the UK GDPR as incorporated into the laws of the United Kingdom.

Depending on the context of our interaction with you, we rely on one or more of the following legal bases:

a) Performance of a Contract

We process your personal data when it is necessary to fulfill our contractual obligations to you. This includes:

• Providing the Services you have purchased or subscribed to.
• Managing your account and transactions.
• Delivering support and related communications.

b) Consent

We process your personal data when you have given your clear and informed consent. This applies, for example, when:

• You subscribe to receive marketing communications from us.
• You agree to the terms governing the use of our free services.

You can withdraw your consent at any time.

c) Legitimate Interests

We process your personal data where it is necessary for our legitimate business interests and where your interests, fundamental rights, and freedoms do not override those interests. This includes:

• Analyzing how you use our Services to improve your experience.
• Ensuring the security and proper functioning of our websites and systems.
• Developing new features and services.

d) Legal Obligations

We process your personal data when required to comply with legal and regulatory obligations, including:

• Responding to lawful requests from public authorities.
• Complying with applicable laws, court orders, or legal processes.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, and always in accordance with our legal obligations, contractual requirements, and legitimate business interests. The specific retention period for your personal data may vary depending on the legal basis for processing.

We determine the appropriate retention period by considering:

• The nature, scope, and sensitivity of the data.
• The risk of harm from unauthorized use or disclosure.
• The legal and regulatory requirements that apply.
• The purposes for which we process the data.

Below is a summary of how we determine retention periods based on the legal basis for processing:

a) Performance of a Contract

When we process personal data to perform a contract (such as providing purchased or subscribed services), we retain the data for the duration of the contractual relationship, plus any additional period required to:

• Comply with legal obligations, or
• Cover the statute of limitations for potential legal claims arising from the relationship.

b) Consent

When processing is based on your consent (e.g., for marketing communications), we retain your personal data until:

• You withdraw your consent, or
• The purpose for which the data was collected is fulfilled.

You may withdraw your consent at any time.

c) Legitimate Interests

Where processing is based on our legitimate interests, we retain personal data for a reasonable period reflecting:

• The specific legitimate interest pursued.
• The need to balance our interests with your fundamental rights and freedoms.

d) Legal Obligations

When we process personal data to comply with legal obligations (for example, for tax, financial, or regulatory purposes), we retain the data for the period required by the applicable law.

e) Legal Claims

If we are involved in actual or potential legal proceedings, we may apply a “legal hold” to retain relevant data beyond standard retention periods until:

• The claim is resolved, or
• The threat of a claim no longer exists.

We regularly review the personal data we hold and delete or anonymize data that is no longer necessary for the identified purposes.

9. Data We Share and Disclose to Third Parties

At Nelio, we do not sell or disclose your personal data to third parties for their own marketing or advertising purposes.

We only share your personal data in limited circumstances, as described below, and always with appropriate safeguards.

a) Security and Data Protection

We implement appropriate technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

All personal data we collect is stored on secure servers provided by trusted cloud hosting partners. We will never request sensitive information such as credit or debit card details by unsolicited email or telephone.

b) International Data Transfers

Your personal data may be transferred to and stored in countries outside the European Economic Area (EEA), the United Kingdom, and Switzerland—including the United States—where we and our service providers operate.

Whenever we transfer your personal data to a country outside the EEA, UK, or Switzerland, we ensure that one of the following safeguards is in place:

• The destination country has been officially recognized as providing an adequate level of data protection by the European Commission, the UK government, or the Swiss Federal Data Protection and Information Commissioner, or
• We have implemented appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the relevant authorities, to ensure that your personal data remains protected.

If you would like more information about these safeguards, please contact us at support@neliosoftware.com.

c) Legal Requirements and Compliance

We may disclose your personal data when necessary to:

• Comply with applicable laws and regulations (including laws outside your country of residence).
• Respond to lawful requests from public authorities, courts, or law enforcement agencies.
• Comply with legal processes such as subpoenas, court orders, or similar requirements.
• Enforce our Terms and Conditions or other contractual rights.
• Protect our legal rights, pursue available remedies, or limit potential damages.

d) Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, joint venture, or other business transaction, your personal data may be transferred to the relevant third party as part of that transaction. In such cases, any new owner will be bound by the commitments outlined in this Privacy Policy.

10. Use of Artificial Intelligence (Nelio AI) and OpenAI

Some features of our services may include the use of artificial intelligence technology, known as Nelio AI, to assist users in generating content suggestions, analyzing test results, or providing other automated assistance.

When you choose to use these optional features, Nelio AI may process information automatically generated from your website content, historical A/B testing results, WooCommerce or Shopify store data, and Google Analytics insights. These prompts are created without manual input and are sent to OpenAI, L.L.C., an artificial intelligence service provider located in the United States, which acts as a sub-processor on our behalf solely for the purpose of providing the requested AI functionality.

We do not intend for this process to include sensitive personal data. However, if your website or data sources contain personal or confidential data, please apply caution.

• Legal basis: processing is necessary for the performance of your contract and also based on our legitimate interest in improving and enhancing the service.
• Data transfers: Protected by Standard Contractual Clauses (SCCs), ensuring adequate safeguards under GDPR.
• Optional use: Nelio AI is entirely optional—no data is shared with OpenAI unless you activate and use the feature.

11. Your Rights – Communication and Support

You have certain rights under data protection laws regarding how we process your personal data. You can exercise these rights at any time by contacting us via our website contact form or by email at support@neliosoftware.com.

You will never be penalized, discriminated against, or disadvantaged for exercising any of these rights.

Below is a summary of your key rights:

Right of Access

You have the right to obtain information about how we process your personal data, including:

• Confirmation of whether we process your personal data.
• Details about the categories of personal data we process, the purposes of processing, and how we determine retention periods.
• Information about the recipients or categories of recipients with whom we may share your data.
• A copy of the personal data we hold about you.

Right to Data Portability

In certain circumstances, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that we transfer this data to another organization.

Right to Rectification

You have the right to request the correction of any inaccurate or incomplete personal data we hold about you, and we will rectify it without undue delay.

Right to Erasure (“Right to be Forgotten”)

In some cases, you have the right to request the deletion of your personal data without undue delay, particularly where:

• The data is no longer necessary for the purposes for which it was collected.
• You have withdrawn your consent and there is no other legal ground for processing.
• The processing is unlawful.

Right to Restriction of Processing

You have the right, in certain situations, to restrict or limit how we process your personal data. This may apply, for example, where:

• The accuracy of the data is contested.
• You have objected to the processing and we are considering whether our legitimate grounds override yours.

Right to Withdraw Consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before your withdrawal.

Right to Object

You have the right to object to the processing of your personal data when such processing is based on our legitimate interests. We will assess your objection and inform you if we have compelling legitimate grounds to continue processing.

You may also object at any time to the use of your personal data for direct marketing purposes, and we will stop processing your data for that purpose immediately.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe that your personal data is not being processed in accordance with applicable law.

• If you are based in the EU, you can find your local authority’s contact details here
• .If you are based in the UK, you can contact the Information Commissioner’s Office (ICO) here.
• If you are based in Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC) here.
• If you are based in Spain or wish to contact our lead supervisory authority, you may also reach out to the Agencia Española de Protección de Datos (AEPD), Spain’s data protection authority, via their website: here.

12. Notice to Visitors of Your Websites

When you use our Services on your own websites, online stores, or digital properties, you may collect personal data from your own visitors or users. In such cases, you remain solely responsible for your own privacy and security practices, including how you collect, process, and protect that information.

Nelio is not responsible for the privacy or security practices you apply to your own users, which may differ from the practices described in this Privacy Policy.

To clarify the responsibilities and obligations of both parties, our Data Processing Agreement (DPA) governs the relationship between you (as the data controller) and Nelio (as the data processor) with respect to the processing of your visitors’ personal data, in accordance with applicable data protection laws.

We encourage you to review our Data Processing Agreement to ensure compliance with your own legal obligations when using our Services.

13. Children’s Privacy

Our Services are not directed to individuals under the age of 16, and we do not knowingly collect or solicit personal data from children.

If you are under 16, you should not use our Services or provide us with any personal information, either directly or through any other means.

If we become aware that we have inadvertently collected personal data from a child under the age of 16, we will take immediate steps to delete that information from our systems.

If you believe that a child under 16 has provided us with personal data, please contact us at support@neliosoftware.com, and we will promptly investigate and remove the information where appropriate.

14. Additional Notice for California Residents (CCPA/CPRA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). This section supplements the information provided in our Privacy Policy and applies solely to California residents.

a) Your Rights under California Law:

Subject to certain limitations, you have the following rights regarding your personal information:

• Right to Know: You have the right to request information about the categories of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Access: You have the right to request a copy of the specific pieces of personal information we have collected about you.
• Right to Deletion: You have the right to request that we delete the personal information we have collected about you, subject to legal exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing: Nelio does not sell or share personal information as defined under the CCPA. We also do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.

b) How to Exercise Your Rights:

You can exercise your California privacy rights by contacting us via our website contact form or by email at support@neliosoftware.com.

We will not discriminate against you for exercising any of your CCPA rights.

c) Categories of Personal Information Collected:

In the preceding 12 months, we have collected the categories of personal information described in Section 6 of this Privacy Policy.

d) Global Users:

If you are located outside the European Economic Area, United Kingdom, Switzerland, or California, your personal data will be processed in accordance with this Privacy Policy and applicable local laws.

Cookies Policy

15. Types of Data Processed / Links to Other Websites

At Nelio, we respect your privacy. Through our Websites, we do not collect or process personal data unless it is provided by you through contact forms, purchase forms, or collected through cookies and similar technologies, as described in this policy.

Please note that our Websites may contain links to other websites, including those of related companies, service providers, or social media platforms. When you follow a link to a third-party website, their own privacy and cookie policies will apply. We encourage you to review those policies before using their websites.

Nelio is not responsible for the privacy practices or content of any third-party websites.

16. Does Nelio Use Cookies and Other Tracking Mechanisms?

Yes. Nelio uses cookies and similar tracking technologies such as single-pixel gifs, web beacons, and local storage. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain on your device until deleted or until they expire).

We use these technologies to:

• Recognize you when you visit our Websites or use our Services.
• Remember your display preferences, such as selected language.
• Remember if you have already responded to surveys or cookie banners.
• Enable checkout processes with our merchant of record.
• Measure website traffic and page performance.

We use both:

• First-party cookies (set by Nelio), and
• Third-party cookies (set by external service providers, such as Google Analytics).

To learn more about cookies in general, visit aboutcookies.org.

17. What Types of Cookies Do We Have?

We use two main types of cookies based on who sets them:

(a) First-party (Own) Cookies:
These cookies are set and controlled by Nelio. They are essential for core functionalities such as running A/B tests, heatmaps, and tracking basic visitor behavior on our Websites. See the Nelio A/B Testing Cookies section for more details.

(b) Third-party Cookies:
These cookies are set by external providers that help us analyze usage or provide additional features. Examples include:

• Google Analytics: to measure website traffic and usage patterns.
• Mailchimp: to track email engagement (opens and clicks).
• YouTube: to remember user preferences for video playback.

See the Third-Party Service Providers section for more information.

18. How You Can Control or Delete Cookies

Our Websites include a cookie consent banner that allows you to accept or reject the use of cookies when you first visit. You can adjust your cookie preferences at any time through your browser settings.

Most web browsers allow you to control, delete, or block cookies. Please note that disabling cookies may affect your experience and limit the availability of certain features.

For more information on managing cookies, please refer to your browser’s official documentation:

• Google Chrome
• Internet Explorer
• Microsoft Edge
• Mozilla Firefox
• Safari (Desktop)
• Safari (Mobile)
• Android Browser
• Opera
• Opera Mobile

For more general information, visit aboutcookies.org.

Third Party Service Providers

To ensure transparency and keep you fully informed, we list below the third-party service providers (sub-processors) who may process personal data on our behalf, along with the types of information they handle.

Each of these providers acts as a data processor and has contractually committed to complying with applicable data protection laws, including the GDPR. We have signed a Data Processing Agreement (DPA) with each provider to help ensure that your personal data is handled securely, lawfully, and in accordance with our instructions.

For more details, including the list of our sub-processors and the data processing terms applicable to them, please refer to our Data Processing Agreement (DPA).