PIPA Art. 15(1)(1) (consent)

Event Attendees or Participating in Research Studies

Name, email address, and other contact information: We may ask for and collect personal information such as your name, address, phone number and email address when you visit our offices, register for or attend a sponsored event or other events at which Cloudflare (and/or its representatives) participates, or participate in Cloudflare's studies such as user experience research.

Image and voice: When you participate in a Cloudflare study, we may ask for your permission to record your voice and/or image during your participation in the study.

Cloudflare only processes personal information in a way that is compatible with and relevant to the purpose for which it was collected or authorized.

- Process and complete transactions, and send you related information, including purchase confirmations and invoices;
- Send transactional messages, including responses to your comments, questions, and requests; provide customer service and support; and send you technical notices, updates, security alerts, and support and administrative messages;
- Comply with legal obligations as well as to investigate and prevent fraudulent transactions, unauthorized access to the Services, and other illegal activities;
- Send commercial communications, in accordance with your communication preferences, such as providing you with information about products and services, features, surveys, newsletters, offers, promotions, contests, and events about us and our partners; and send other news or information about us and our partners. See Section 9 below for information on managing your communication preferences.
- Process and deliver contest or sweepstakes entries and rewards;
- Monitor and analyze trends, usage, and activities in connection with the Websites and Services and for marketing or advertising purposes;
- Personalize the Websites and Services, including by providing features or content that match your interests and preferences;
- To register visitors to our offices and to manage non-disclosure agreements that visitors may be required to sign, to the extent such processing is necessary for our legitimate interest in protecting our offices and our confidential information against unauthorized access;
- For other purposes for which we obtain your consent.

We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of the Privacy Policy or as long as needed to fulfill and comply with legal obligations. The criteria we used to determine how long we store your personal information will vary depending on several different factors. See Section 11 of the Privacy Policy for more information.

PIPA Art. 15(1)(1) (consent); PIPA Art. 15(1)(4) (performance of contract)

Website Visitors

Name, email address, and other contact information: We ask for and—at your option—collect personal information from you when you submit web forms on our Websites, including opportunities to sign up for and agree to receive email communications from us. We may ask you to submit such personal information if you choose to use interactive features of the Websites, including participation in surveys, contests, promotions, sweepstakes, or studies, requesting customer support, submitting feedback, or otherwise communicating with us. We will send such communications in accordance with applicable law.

Log files: Just as when you visit and interact with most websites and services delivered via the Internet, when you visit our Websites, including the Cloudflare Community Forum, we gather certain information and store it in log files. This information may include but is not limited to Internet Protocol (IP) addresses, system configuration information, URLs of referring pages, and locale and language preferences.

Cookies and other tracking technologies: We may use cookies and other information-gathering technologies for a variety of purposes, such as providing us with information about how you interact with our Websites and assisting us in our marketing efforts. You may view a complete list of cookies and change your cookie preferences by clicking on the "Cookie Preferences" link (or, in the United States, the "Your Privacy Choices" link) in the footer of the Cloudflare homepage at cloudflare.com or in the banner displayed when you visit our Websites from certain countries (such as the European Economic Area and the UK). Note that if you disable cookies entirely, Cloudflare's Websites may not function properly. We may also use cookies and similar technologies to provide you advertising on third-party sites based upon your browsing activities and interests. In addition to exercising cookie choices through our "Cookie Preferences" or "Your Privacy Choices" links, if you do not want to have cookies and similar technologies used for the purpose of serving you interest-based ads, you may opt-out by clicking here (or if located in the European Union, the United Kingdom, or Switzerland, click here). For more information about the cookies Cloudflare uses and your privacy choices, please see our Cookie Policy.

Material contributed in Interactive Areas: The Websites may offer publicly accessible blogs, community forums, comments sections, discussion forums, or other interactive features ("Interactive Areas"). If you choose to participate in any of these Interactive Areas, please be aware that any information that you post in an Interactive Area might be read, collected, and used by others who access it. If you wish to remove your personal information from any of our Interactive Areas, please see Section 8 of the Privacy Policy.

Cloudflare only processes personal information in a way that is compatible with and relevant to the purpose for which it was collected or authorized.

- Provide, operate, maintain, improve, and promote the Websites and Services for all users of the Websites and Services;
- Enable you to access and use the Websites and Services;
- Process and complete transactions, and send you related information, including purchase confirmations and invoices;
- Send transactional messages, including responses to your comments, questions, and requests; provide customer service and support; and send you technical notices, updates, security alerts, and support and administrative messages;
- Comply with legal obligations as well as to investigate and prevent fraudulent transactions, unauthorized access to the Services, and other illegal activities;
- For other purposes for which we obtain your consent.
- Send commercial communications, in accordance with your communication preferences, such as providing you with information about products and services, features, surveys, newsletters, offers, promotions, contests, and events about us and our partners; and send other news or information about us and our partners. See Section 9 below for information on managing your communication preferences.
- Process and deliver contest or sweepstakes entries and rewards;
- Monitor and analyze trends, usage, and activities in connection with the Websites and Services and for marketing or advertising purposes;
- Personalize the Websites and Services, including by providing features or content that match your interests and preferences;
- To register visitors to our offices and to manage non-disclosure agreements that visitors may be required to sign, to the extent such processing is necessary for our legitimate interest in protecting our offices and our confidential information against unauthorized access;

We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of the Privacy Policy or as long as needed to fulfill and comply with legal obligations. The criteria we used to determine how long we store your personal information will vary depending on several different factors. See Section 11 of the Privacy Policy for more information.

PIPA Art. 15(1)(1) (consent); PIPA Art 15(1)(4) (performance of contract)

Customers and Administrative Users

Customer Account Information: When you register for an account, we collect contact information. Depending on subscription level, this contact information may include your Customer name, the email address(es) of your account administrator(s), telephone number, and addresses necessary to process payment and delivery of Services. In addition, when you use the Services, we collect information about how you configure your account and the Services (e.g., firewall settings for the domains you administer). We refer to all of this information collectively as "Customer Account Information" for the purposes of this Policy. Customer Account Information is required to enable your access to your Cloudflare account and Services. By providing us with any personal information, you represent that you are the owner of such personal information or otherwise have the requisite consent to provide it to us. We also maintain logs of Administrative Users' activity (e.g., actions taken to configure settings in Customers' account).

Payment information: We do not require our Customers to have payment information on file with us unless they have a paid subscription to our Services. When you sign up for one of our paid Services, you must provide payment and billing information. The information you will need to submit depends on which payment method you choose. For example, if you pay with a credit card, we will collect your card information and billing address, although we do not store full credit card numbers or personal account numbers.

Crash Reports: When our Services encounter an unexpected error, you may be asked to submit a crash report, which may contain personal information. You will have an opportunity to review the content of the report prior to submitting the report to us.

Cloudflare only processes personal information in a way that is compatible with and relevant to the purpose for which it was collected or authorized.

- Provide, operate, maintain, improve, and promote the Websites and Services for all users of the Websites and Services;
- Enable you to access and use the Websites and Services;
- Process and complete transactions, and send you related information, including purchase confirmations and invoices;
- Send transactional messages, including responses to your comments, questions, and requests; provide customer service and support; and send you technical notices, updates, security alerts, and support and administrative messages;
- Comply with legal obligations as well as to investigate and prevent fraudulent transactions, unauthorized access to the Services, and other illegal activities;
- For other purposes for which we obtain your consent.
- Send commercial communications, in accordance with your communication preferences, such as providing you with information about products and services, features, surveys, newsletters, offers, promotions, contests, and events about us and our partners; and send other news or information about us and our partners. See Section 9 below for information on managing your communication preferences.
- Process and deliver contest or sweepstakes entries and rewards;
- Monitor and analyze trends, usage, and activities in connection with the Websites and Services and for marketing or advertising purposes;
- Personalize the Websites and Services, including by providing features or content that match your interests and preferences;
- To register visitors to our offices and to manage non-disclosure agreements that visitors may be required to sign, to the extent such processing is necessary for our legitimate interest in protecting our offices and our confidential information against unauthorized access;

We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of the Privacy Policy or as long as needed to fulfill and comply with legal obligations. The criteria we used to determine how long we store your personal information will vary depending on several different factors. See Section 11 of the Privacy Policy for more information.

PIPA Art. 15(1)(4) (performance of contract)

Public DNS Resolver Users

Limited DNS query data: We will collect limited DNS query data that is sent to our 1.1.1.1 resolver. Our 1.1.1.1 resolver service does not log personal information, and the bulk of the limited non-personally identifiable query data is only stored for 25 hours. You can learn more about our 1.1.1.1 resolver commitment to privacy here.

Please note that our data handling practices for our 1.1.1.1 Application, which is not covered by this Policy, are somewhat different than our 1.1.1.1 resolver data handling practices and are described here and here.

We use information we collect from 1.1.1.1 resolver users to operate and improve the 1.1.1.1 resolver, such as to assist us in our debugging efforts if an issue arises. Our 1.1.1.1 resolver service does not store 1.1.1.1 resolver users' personal information. We will not combine any information collected from DNS queries to our 1.1.1.1 resolver with any other Cloudflare or third party data in any way that can be used to identify individual end users. Cloudflare may store aggregated data, as outlined within our 1.1.1.1 resolver commitments to privacy, indefinitely in order to power Cloudflare Radar and assist Cloudflare in improving Cloudflare services, such as, enhancing the overall performance of the Cloudflare Resolver and identifying security threats. Learn more about our 1.1.1.1 resolver commitment to privacy here and here.

We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of the Privacy Policy or as long as needed to fulfill and comply with legal obligations. The criteria we used to determine how long we store your personal information will vary depending on several different factors. See Section 11 of the Privacy Policy for more information.

PIPA Art. 15(1)(4) (performance of contract)

End Users

Cloudflare processes End Users' interactions with Customer's Internet Properties and the Services. This information is processed when End Users access or use our Customers' domains, websites, APIs, applications, devices, end points, and networks that use one or more of our Services, and when End Users access or use Services, such as Cloudflare Zero Trust. The information processed may include but is not limited to IP addresses, traffic routing data, system configuration information, and other information about traffic to and from Customers' websites, devices, applications, and/or networks.

The End User data that we make available to our Customers via the Service dashboard or other online interface are specifically defined as "Customer Logs".

Cloudflare only processes personal information in a way that is compatible with and relevant to the purpose for which it was collected or authorized.

- Provide, operate, maintain, improve, and promote the Websites and Services for all users of the Websites and Services;
- Enable you to access and use the Websites and Services;
- Process and complete transactions, and send you related information, including purchase confirmations and invoices;
- Send transactional messages, including responses to your comments, questions, and requests; provide customer service and support; and send you technical notices, updates, security alerts, and support and administrative messages;
- Comply with legal obligations as well as to investigate and prevent fraudulent transactions, unauthorized access to the Services, and other illegal activities;
- For other purposes for which we obtain your consent.

We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of the Privacy Policy or as long as needed to fulfill and comply with legal obligations. The criteria we used to determine how long we store your personal information will vary depending on several different factors. See Section 11 of the Privacy Policy for more information.

PIPA Art. 15(1) (consent); PIPA Art. 15(1)(4) (performance of contract)

Registrants

Contact and domain information: We collect data such as domain name and status, contact information (such as name, organization, address, phone number and email address), name server, DNSSEC, and Form of Approval (i.e., full WHOIS capture at time of transfer into our system, including the IP address that initiated the transfer).

Cloudflare only processes personal information in a way that is compatible with and relevant to the purpose for which it was collected or authorized.

- Provide, operate, maintain, improve, and promote the Websites and Services for all users of the Websites and Services;
- Enable you to access and use the Websites and Services;
- Process and complete transactions, and send you related information, including purchase confirmations and invoices;
- Send transactional messages, including responses to your comments, questions, and requests; provide customer service and support; and send you technical notices, updates, security alerts, and support and administrative messages;
- Comply with legal obligations as well as to investigate and prevent fraudulent transactions, unauthorized access to the Services, and other illegal activities;
- For other purposes for which we obtain your consent.

We store your personal information for a period of time that is consistent with the business purposes set forth in Section 3 of the Privacy Policy or as long as needed to fulfill and comply with legal obligations. The criteria we used to determine how long we store your personal information will vary depending on several different factors. See Section 11 of the Privacy Policy for more information.

PIPA Art. 28-8(1)(3) (performance of contract)

Slack Technologies, Inc. (privacy@slack.com)

United States

Personal information necessary for customer support (including name, email address, and other similar contact information), usage information (including IP address), and cookie information.

Over the network, upon collection of personal information

Customer support communications

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Zendesk, Inc. (privacy@zendesk.com)

Zendesk operates servers globally using Amazon Web Services (AWS) as described here. Current hosting locations are the United States, the European Economic Area, Japan, and Australia

Personal information necessary for customer support (including ticket details, and contact information) and usage information (including IP address).

Over the network, upon collection of personal information

Customer support and account management

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Salesforce, Inc. (privacy@salesforce.com)

United States

Personal information necessary for customer relationship management (including your name and contact information).

Over the network, upon collection of personal information

Customer support and account management

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Amazon Web Services (AWS) (aws-privacy@amazon.com)

United States, European Economic Area

Cloudflare Email Security leverages AWS as a subprocessor for various aspects of its service delivery. As a cloud infrastructure provider, AWS helps provide the underlying infrastructure and platform services upon which Cloudflare's Email Security solution runs. Therefore, the personal data processed by AWS as a subprocessor would largely be the data that flows through or is stored by Cloudflare's Email Security system.

Over the network, upon collection of personal information

Cloudflare Email Security (formerly Area 1)

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Google LLC (support-deletion@google.com)

United States

The personal information processed depends on how the customer chooses to use the service to address their needs. For Business Intelligence, personal information processed includes contact information (including name and email address), customer account information (including account number and contracted services), billing information, and usage information (including IP address).

Over the network, upon collection of personal information

Cloudflare Developer Platform, Cloudflare Zero Trust, AI Gateway, and Business Intelligence.

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

CoreWeave, Inc. (privacy@coreweave.com)

United States

Cloudflare uses Coreweave as an infrastructure provider for GPU-intensive workloads. The specific personal information potentially processed by Coreweave depends on the data created by Cloudflare customers through use of the Cloudflare services. For example, data processed by Coreweave might include a prompt to an AI model made available on Workers AI. The prompt could include personal information if the customer chooses to include such information in their prompt.

Over the network, upon collection of personal information

Workers AI

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Nebius BV (privacy@nebius.com)

England

Cloudflare uses Nebius as an infrastructure provider for GPU-intensive workloads. The specific personal information potentially processed by Nebius depends on the data created by Cloudflare customers through use of the Cloudflare services. For example, data processed by Nebius might include a prompt to an AI model made available on Workers AI. The prompt could include personal information if the customer chooses to include such information in their prompt.

Over the network, upon collection of personal information

Workers AI

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Anthropic PBC (privacy@anthropic.com)

United States

Cloudflare routes customer requests to third-party AI providers such as OpenAI, Anthropic, XAI, and Groq as part of its AI Gateway service at each customer's specific request and in accordance with their chosen configuration. The specific personal information potentially processed by such third-party AI providers depends on the data created by Cloudflare customers through use of the Cloudflare services. For example, data processed in this context might include a prompt to an AI model made available by a third-party AI provider. The prompt could include personal information if the customer chooses to include such information in their prompt.

Over the network, upon collection of personal information

AI Gateway

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

OpenAI, Inc. (privacy@openai.com)

OpenAI operates servers globally using Azure as described here.

Cloudflare routes customer requests to third-party AI providers such as OpenAI, Anthropic, XAI, and Groq as part of its AI Gateway service at each customer's specific request and in accordance with their chosen configuration. The specific personal information potentially processed by such third-party AI providers depends on the data created by Cloudflare customers through use of the Cloudflare services. For example, data processed in this context might include a prompt to an AI model made available by a third-party AI provider. The prompt could include personal information if the customer chooses to include such information in their prompt.

Over the network, upon collection of personal information

AI Gateway

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

X.AI Corp. (privacy@x.ai)

United States

Cloudflare routes customer requests to third-party AI providers such as OpenAI, Anthropic, XAI, and Groq as part of its AI Gateway service at each customer's specific request and in accordance with their chosen configuration. The specific personal information potentially processed by such third-party AI providers depends on the data created by Cloudflare customers through use of the Cloudflare services. For example, data processed in this context might include a prompt to an AI model made available by a third-party AI provider. The prompt could include personal information if the customer chooses to include such information in their prompt.

Over the network, upon collection of personal information

AI Gateway

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Groq, Inc. (privacy@groq.com)

United States

Cloudflare routes customer requests to third-party AI providers such as OpenAI, Anthropic, XAI, and Groq as part of its AI Gateway service at each customer's specific request and in accordance with their chosen configuration. The specific personal information potentially processed by such third-party AI providers depends on the data created by Cloudflare customers through use of the Cloudflare services. For example, data processed in this context might include a prompt to an AI model made available by a third-party AI provider. The prompt could include personal information if the customer chooses to include such information in their prompt.

Over the network, upon collection of personal information

AI Gateway

As long as necessary to fulfill the purposes on the left.

PIPA Art. 28-8(1)(3) (performance of contract)

Cloudflare, Inc. and its subsidiaries (For name of contact and contact information, please see Section 19 of the Cloudflare Privacy Policy.)

United States, United Kingdom, Singapore, Australia, Germany, Portugal, France, Japan, Canada, Netherlands, UAE, India, Mexico, Malaysia, Sweden

All Personal information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Over the network, upon collection of personal information

To operate and improve the Application, such as to assist us in our debugging efforts if an issue arises.

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Adobe, Inc. (dpo@adobe.com)

United States, Ireland, France, India, Singapore, Japan, Australia

All Personal information as described in section 2 ("Website Visitors") of the Cloudflare Privacy Policy, "Information We Collect"

Over the network, upon collection of personal information

Marketing automation

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Amplitude (privacy@amplitude.com)

United States

All Personal information as described in section 2 ("Website Visitors") of the Cloudflare Privacy Policy, "Information We Collect"

Over the network, upon collection of personal information

Marketing Analytics

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

BoostUp (privacy@boostup.ai)

United States

Name, email address, contact information, job title, company information, customer/prospect activity data, and aggregated product use data.

Over the network, upon collection of personal information

Revenue operations

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Demandbase (privacy@demandbase.com)

United States, United Kingdom, Germany, Singapore

Name, email address, contact information, job title, company information, customer/prospect activity data, and aggregated product use data.

Over the network, upon collection of personal information

Marketing automation and sales engagement

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Iterable, Inc. (privacy@iterable.com)

United States

All Personal information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Over the network, upon collection of personal information

Marketing automation

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Just Global (privacy@justglobal.com)

United States

All Personal information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Occasionally as needed to facilitate the marketing services provided by the third party.

Sales and marketing

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Pulley Ascent (info@pulleyascent.com)

South Korea

Name, email address, and other contact information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Occasionally as needed to facilitate the marketing services provided by the third party.

Sales and marketing

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Pipeline 360 (privacy@pipeline360.com)

United States

All Personal information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Occasionally as needed to facilitate the marketing services provided by the third party.

Sales and marketing

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

ThinkABM (privacypolicy@thinkabm.com)

Singapore, United Kingdom, Dubai, and Australia

All Personal information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Occasionally as needed to facilitate the marketing services provided by the third party.

Sales and marketing

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Acquisition Inc. (dpo+acquisioninc@privasee.io)

United Kingdom & Ireland

All Personal information as described in section 2 of the Cloudflare Privacy Policy, "Information We Collect"

Occasionally as needed to facilitate the marketing services provided by the third party.

Sales and marketing

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Liveramp (https://liveramp.com/privacy/my-privacy-choices)

United States

Browsing information, contact information, and employment information.

Over the network, upon collection of personal information

User research and advertising and marketing assistance

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

Goldcast (dpo@cvent.com)

United States

Browsing information, contact information, and employment information.

Over the network, upon collection of personal information

Virtual event platform

As long as necessary to fulfill the purposes on the left.

PIPA Art. 17(1)(consent and where the personal information is provided within the scope of purposes for which it is collected )

ZoomInfo (privacy@zoominfo.com)

United States

Name, email address, contact information, job title, company information, customer/prospect activity data, and aggregated product use data.

Over the network, upon collection of personal information

Sales intelligence

As long as necessary to fulfill the purposes on the left.