> How Carrd handles cookies, Cloudflare bot management and third party widgets, with practical GDPR and ePrivacy guidance for site owners. > > Canonical: https://www.flowconsent.com/en/services/cms/carrd CMS # Carrd Analytics · [Official website](https://carrd.co) Single page website builder by AJ. Carrd hosts static personal sites, portfolios and landing pages on Cloudflare with minimal first party cookies. [Block Carrd until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Analytics - Prior consent Not required - Documented cookies 2 - Third-party domains 2 - Servers United States (Carrd LLC infrastructure) with global edge delivery through Cloudflare. Visitor traffic is routed through the nearest Cloudflare PoP. Overview ## What does Carrd do? ## **What Carrd is** Carrd is a single page website builder created by an independent developer known as AJ. It is widely used for personal profiles, portfolios, link in bio pages and lightweight landing pages. Published Carrd sites are essentially static HTML pages served from Cloudflare edge locations, which keeps the tracking footprint very small compared with full content management systems. ## **Cookies and data flows** By default a visitor encounters two cookies. Cloudflare drops a strictly necessary bot management cookie called \_\_cf\_bm to protect the site from abusive traffic. The Carrd platform itself sets an authentication session cookie when the site owner is logged into the editor. Neither cookie is used for marketing or cross site profiling. Published pages may, however, embed Google Fonts, Google Analytics, Stripe, MailChimp, YouTube or custom scripts when the site owner enables those features. Each of those embeds brings its own cookies and trackers. ## **GDPR and ePrivacy implications** The Cloudflare bot cookie and the Carrd editor cookie qualify as strictly necessary under Article 5(3) of the ePrivacy Directive, so they do not require prior consent. Any embedded analytics or advertising widget, however, triggers Article 5(3) consent plus a valid Article 6(1)(a) GDPR legal basis. The site owner is the controller for the visitor data, while Carrd LLC and Cloudflare act as processors. ## **International data transfers** Carrd LLC is based in the United States and Cloudflare also operates from the United States with global edge delivery. EU visitors are typically routed to an EU Cloudflare PoP, but log data and account information are processed in the US. Transfers rely on the EU US Data Privacy Framework where the recipient is certified, supplemented by Standard Contractual Clauses. ## **Practical compliance steps** Publish a privacy notice that lists Carrd and Cloudflare as processors and discloses the United States transfer. If you embed analytics, ads, social or font widgets, add a consent banner that loads them only after opt in. Use a self hosted Google Fonts file or a privacy friendly alternative to avoid IP leakage. Keep contact form data minimal and document your retention periods. Compliance ## Carrd and the GDPR - Legal basis Legitimate interest (Art 6(1)(f) GDPR) for the strictly necessary Cloudflare bot management cookie and the Carrd editor session cookie. Consent (Art 6(1)(a) GDPR and Art 5(3) ePrivacy) is required for any optional analytics, marketing or fingerprinting widgets the site owner embeds. - Risk level low - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, UK GDPR, CCPA/CPRA, Swiss FADP ### Impact assessment (DPIA) A full DPIA is not required for a typical Carrd site that serves static content without analytics. Publishers should still run a short Article 35 screening when they embed advertising pixels, behavioural analytics, fingerprinting widgets or process special category data through forms. Document the Cloudflare and Carrd processors, the transfer mechanism to the United States, and any third party scripts injected into the page. ### Sample text for your banner > We use a strictly necessary Cloudflare cookie to keep this site secure and a Carrd session cookie when the site owner edits the page. These do not require your consent. If we embed analytics, advertising or social widgets, those will only load after you accept the relevant categories below. You can change your choice at any time. Cookies and trackers ## What Carrd sets and contacts - Tracking method First party session cookies set by the Carrd platform plus Cloudflare bot management. Published Carrd sites are static HTML pages served via Cloudflare; tracking only occurs when the site owner enables optional integrations such as Google Analytics, Google Fonts, Stripe, MailChimp or external scripts. - Server location United States (Carrd LLC infrastructure) with global edge delivery through Cloudflare. Visitor traffic is routed through the nearest Cloudflare PoP. - Data transferred outside the EU Data is processed in the United States by Carrd LLC and by Cloudflare Inc. Transfers from the EEA rely on the EU US Data Privacy Framework where the recipient is certified, complemented by Standard Contractual Clauses where applicable. ### Cookies set (2) | Name | Type | Duration | Purpose | | -------------- | ------------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | \_\_cf\_bm | strictly\_necessary | 30 minutes | Cloudflare bot management cookie that protects the Carrd hosted page from automated abusive traffic. Considered strictly necessary under Article 5(3) ePrivacy and exempt from consent. | | carrd\_session | strictly\_necessary | Session | Authentication cookie set by the Carrd platform when the site owner is logged into the editor. Used only for editor authentication, not for visitor tracking. | ### Third-party domains contacted (2) - `carrd.co` - `cloudflare.com` Questions ## Frequently asked questions about Carrd Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Carrd set? By default Carrd serves your published page through Cloudflare which sets the strictly necessary \_\_cf\_bm bot management cookie. The Carrd platform sets a session authentication cookie only when the site owner is logged into the editor. No marketing cookies are set unless you embed third party widgets. ### Do I need consent to use Carrd? You do not need consent for the Cloudflare bot management cookie or the Carrd editor cookie because both are strictly necessary. If you embed Google Analytics, Meta Pixel, MailChimp tracking, YouTube or custom marketing scripts you must collect prior opt in consent before they load. ### What legal basis applies? Article 6(1)(f) GDPR legitimate interest covers the strictly necessary platform cookies. Optional widgets you embed require Article 6(1)(a) GDPR consent in combination with Article 5(3) of the ePrivacy Directive. Form submissions usually rely on Article 6(1)(b) contract performance or Article 6(1)(a) consent. ### Is data transferred to the United States? Yes. Carrd LLC and Cloudflare both operate from the United States. Cloudflare serves the page through EU edge nodes but logs are processed in the US. Transfers rely on the EU US Data Privacy Framework where the recipient is certified and on Standard Contractual Clauses otherwise. ### Is a DPIA needed? For a basic static Carrd site without analytics, a DPIA is not required. A short Article 35 screening is recommended if you add behavioural analytics, advertising pixels, fingerprinting widgets or collect special category data through embedded forms. ### How do I implement Carrd compliantly? Disclose Carrd and Cloudflare as processors, document the US transfer, restrict embedded scripts to those you really need, gate optional widgets behind a consent banner, and self host fonts where possible to avoid IP leakage. ### What are the alternatives? Privacy friendly alternatives include EU hosted page builders such as Webflow with EU workspaces, Framer with EU hosting, Cloudflare Pages on its own with no editor cookies, or static site generators such as Hugo or Astro deployed on Netlify or Vercel EU regions. ### How do I update my cookie policy? List the \_\_cf\_bm Cloudflare cookie and the Carrd editor session cookie as strictly necessary. Add a section for any optional embeds such as Google Analytics or Stripe. Refresh the policy whenever you add or remove a script and record the change in your records of processing. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Hashnode](https://www.flowconsent.com/en/services/cms/hashnode) [Hashnode is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Hashnode supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Hashnode ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/hashnode) [CMS](https://www.flowconsent.com/en/services/cms/hashnode) · ### [Foswiki](https://www.flowconsent.com/en/services/cms/foswiki) [Foswiki is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Foswiki integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Foswiki helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/foswiki) [CMS](https://www.flowconsent.com/en/services/cms/foswiki) · ### [Scissor Themes Writee](https://www.flowconsent.com/en/services/cms/scissor-themes-writee) [Scissor Themes Writee is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Scissor Themes Writee integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Scissor Themes Writee helps organizations maintain robust websites that meet user.](https://www.flowconsent.com/en/services/cms/scissor-themes-writee) [CMS](https://www.flowconsent.com/en/services/cms/scissor-themes-writee) · ### [Silex](https://www.flowconsent.com/en/services/cms/silex) [Silex is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Silex offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Silex empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/silex) [CMS](https://www.flowconsent.com/en/services/cms/silex) · ### [Tunosite](https://www.flowconsent.com/en/services/cms/tunosite) [Tunosite is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Tunosite offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Tunosite empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/tunosite) [CMS](https://www.flowconsent.com/en/services/cms/tunosite) · ### [Advanced Custom Fields](https://www.flowconsent.com/en/services/cms/advanced-custom-fields) [Advanced Custom Fields is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Advanced Custom Fields offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Advanced Custom Fields empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/advanced-custom-fields) [CMS](https://www.flowconsent.com/en/services/cms/advanced-custom-fields) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)