> Nootiz visual feedback widget: cookies, consent, EU hosting in Austria and how to deploy it on staging or production sites under GDPR. > > Canonical: https://www.flowconsent.com/en/services/customer-support/nootiz Customer support # Nootiz Preferences · [Official website](https://www.nootiz.com) Nootiz is an Austrian visual feedback and annotation tool that embeds a lightweight widget on websites so clients, designers and developers can leave pinned comments directly on the page. It is commonly used on staging sites and during production reviews. The widget sets functional cookies for the reviewer's session, comments and project state. Servers are located in Austria, which keeps processing within the EEA and lowers the compliance burden compared to non European tools. [Block Nootiz until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=customer_support) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Customer support](https://www.flowconsent.com/en/services/customer-support) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 3 - Servers European Union (Austria). Servers and operations are located in the EU, which keeps the processing within the EEA without need for additional transfer mechanisms. Overview ## What does Nootiz do? ## **What Nootiz is and how it works** Nootiz is an Austrian visual feedback and annotation tool designed for web teams. A small JavaScript widget is embedded on a staging or production website; authorised users such as clients, project managers, designers and developers can click anywhere on the page and leave a pinned comment that captures the element, the browser context and an optional screenshot. Threads, assignees and statuses are managed in the Nootiz dashboard, which becomes the source of truth for review rounds. The widget is intentionally lightweight and runs alongside the existing site without rewriting markup. ## **Data and cookies** Nootiz sets functional first-party cookies for the reviewer's authentication session, the active project, the open or minimised state of the widget and a CSRF token. It processes the comment content, the URL on which it was left, browser metadata (user agent, viewport, optional screenshot) and the identity of the reviewer who posted the annotation. No tracking or marketing cookies are set by default. The personal data involved is mostly that of the project team rather than the general public, which keeps the exposure narrow. ## **GDPR and ePrivacy implications** Because Nootiz is targeted at reviewers, not anonymous visitors, the functional cookies it sets can rely on the strictly necessary exemption of Article 5(3) ePrivacy when the user has actively logged into the tool. The associated GDPR processing rests on legitimate interest under Article 6(1)(f) (running and documenting a website project) or on contract performance where Nootiz is part of an agency contract. If the widget is exposed to end users who are not part of the project, consent under Article 5(3) ePrivacy becomes required because the cookies are no longer strictly necessary for a service that user requested. ## **Data transfers and EU hosting** Nootiz hosts its infrastructure in Austria and operates within the European Union. There are no third country transfers in the default configuration, which removes the Schrems II problematic associated with US based collaboration tools. The data processing agreement should still be reviewed for sub-processors (email delivery, error monitoring, file storage) but these are typically also EU based or DPF certified. EU hosting is one of the strongest compliance arguments for choosing Nootiz over equivalent US tools. ## **Consent, DPIA and screenshots** A full Article 35 DPIA is generally not necessary if Nootiz is used on a staging environment with a limited reviewer team. The picture changes when the widget captures screenshots of pages that contain real personal data, for instance dashboards showing customer records: those screenshots are themselves personal data and must be retained no longer than necessary, with documented access controls. In that case a short DPIA focusing on screenshots and access controls is appropriate, and consent banners may not be needed if the widget is restricted to staff with adequate notice. ## **Practical compliance steps** Load the Nootiz widget only on staging or behind an authentication gate; remove it from public production unless your business case justifies leaving it in place; document the data processing agreement with Nootiz GmbH and list it in your record of processing activities; mention Nootiz in the internal privacy notice provided to reviewers and clients; set sensible retention periods for closed annotations and screenshots; and review the sub-processor list yearly. These steps keep the compliance overhead minimal for a low risk tool. Compliance ## Nootiz and the GDPR Nootiz is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Strictly necessary cookies for the annotation tool itself (Article 5(3) ePrivacy exemption) rely on legitimate interest under Article 6(1)(f) GDPR while the widget is used by authorised reviewers. Analytics or behavioural features added on top of Nootiz require consent under Article 5(3) ePrivacy and Article 6(1)(a) GDPR. - Risk level low - Applicable regulations GDPR (EU 2016/679), Austrian Data Protection Act (DSG), ePrivacy Directive 2002/58/EC, TKG (Austrian Telecommunications Act) cookie provisions, Austrian Data Protection Authority guidance. ### Impact assessment (DPIA) A formal DPIA is rarely required for Nootiz because the tool is used by a closed group of authorised reviewers (clients, designers, developers), not by anonymous end users, and the processing is limited to annotation content, project metadata and reviewer identity. A short risk assessment is enough in most cases. If Nootiz is left active on production with public visibility, or if it captures screenshots of pages that contain personal data of real end users, a DPIA becomes appropriate and should focus on access controls, retention of annotation screenshots, and the lawful basis for capturing those screenshots. ### Sample text for your banner > This site uses Nootiz, an Austrian visual feedback tool, to let our team and clients leave annotations during the review phase. Nootiz sets functional cookies for the reviewer session and to link comments to the right project. Data is hosted in Austria, within the European Union. The widget is loaded only for users with reviewer access and is removed on the public production version of this site. Cookies and trackers ## What Nootiz sets and contacts - Tracking method Embedded JavaScript widget loaded from nootiz.com that lets project members leave visual annotations on a staging or production website. Sets first-party functional cookies to maintain the reviewer's session, link annotations to projects and remember UI state. - Server location European Union (Austria). Servers and operations are located in the EU, which keeps the processing within the EEA without need for additional transfer mechanisms. ### Cookies set (4) | Name | Type | Duration | Purpose | | --------------- | ---------- | -------- | --------------------------------------------------------------------------------------------------- | | nootiz\_session | functional | Session | Maintains the authenticated session of the reviewer in the Nootiz widget. | | nootiz\_project | functional | 30 days | Stores the identifier of the active project so that comments are attached to the correct workspace. | | nootiz\_state | functional | 30 days | Remembers the open or minimised state and position of the widget across page loads. | | nootiz\_csrf | functional | Session | Provides CSRF protection for actions submitted through the widget such as new comments or replies. | ### Third-party domains contacted (3) - `nootiz.com` - `app.nootiz.com` - `cdn.nootiz.com` Questions ## Frequently asked questions about Nootiz Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Nootiz set on a page? Nootiz sets a small set of first-party functional cookies: a session cookie for the reviewer's authentication, a project cookie that links comments to the right workspace, a state cookie that remembers the open or minimised state of the widget and its position, and a CSRF token cookie that protects form submissions. No analytics or marketing cookies are placed by default. ### Is consent required to load the Nootiz widget? When Nootiz is restricted to authenticated reviewers (via an environment variable, IP whitelist or login check), its cookies are strictly necessary for the requested service and fall under the Article 5(3) ePrivacy exemption: no consent banner is required. If the widget is exposed to general visitors, consent becomes necessary because those visitors did not request the annotation tool. ### What is the legal basis for using Nootiz? The most appropriate legal basis is legitimate interest under Article 6(1)(f) GDPR (running and documenting a website project) or contract performance under Article 6(1)(b) where Nootiz is part of an agency or client engagement. Functional cookies rely on the strictly necessary exemption of Article 5(3) ePrivacy. Where Nootiz is used to capture screenshots containing data of real end users, those end users may need separate consideration. ### Are personal data transferred outside the EEA when I use Nootiz? No, not in the default configuration. Nootiz hosts servers and operates from Austria, within the European Union, so the personal data of reviewers and the content of annotations remain in the EEA. Sub-processors such as email delivery or error monitoring should still be reviewed in the data processing agreement, but the baseline transfer profile is comfortable from a Schrems II standpoint. ### Do I need a DPIA before using Nootiz? A formal DPIA under Article 35 GDPR is rarely needed because Nootiz is used by a closed group of reviewers on a project, processing is limited and EU hosting removes transfer risk. A short documented risk assessment is normally enough. A DPIA becomes appropriate when Nootiz captures screenshots of pages containing real end user data or when it is left active on a public production site. ### How do I deploy Nootiz in a privacy-friendly way? Load the widget only on staging environments or behind authentication; do not ship the script to anonymous public visitors; provide the project team with a short internal notice describing the tool, the data it processes and the retention period; sign the data processing agreement provided by Nootiz GmbH; list it in your record of processing activities; and clean up closed projects and their screenshots periodically. ### What are alternatives to Nootiz for visual feedback? Comparable visual feedback tools include BugHerd (Australia, EU hosting available), Pastel (US, DPF certified), Markup.io (US), Marker.io (Belgium, EU based) and Userback (Australia). For European teams, EU based or DPF certified vendors are easier to document; tools hosted only in the US require a transfer impact assessment. Self-hosted alternatives such as Sentry feedback widgets or Penpot review modes can also fit. ### How should I update my cookie policy for Nootiz? If Nootiz is restricted to internal reviewers, no entry in the public cookie policy is strictly required, but the internal privacy notice should describe the tool. If the widget is exposed to general visitors, add a dedicated section in the public cookie policy listing the four functional cookies, their purposes, their durations, the controller (Nootiz GmbH) and the country (Austria). Review the entry whenever Nootiz changes sub-processors. Same category ## More services: Customer support [See the whole category](https://www.flowconsent.com/en/services/customer-support) ### [Proto AICX](https://www.flowconsent.com/en/services/customer-support/proto-aicx) [Proto AICX is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Proto AICX enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Proto AICX empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/customer-support/proto-aicx) [Marketing](https://www.flowconsent.com/en/services/customer-support/proto-aicx) · ### [GLPI](https://www.flowconsent.com/en/services/customer-support/glpi) [GLPI is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GLPI supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GLPI ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/customer-support/glpi) [Marketing](https://www.flowconsent.com/en/services/customer-support/glpi) · ### [vcita](https://www.flowconsent.com/en/services/customer-support/vcita) [vcita is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. vcita enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, vcita empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/customer-support/vcita) [Marketing](https://www.flowconsent.com/en/services/customer-support/vcita) · ### [Gleap](https://www.flowconsent.com/en/services/customer-support/gleap) [Gleap is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Gleap integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Gleap helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/customer-support/gleap) [Preferences](https://www.flowconsent.com/en/services/customer-support/gleap) · ### [Olark](https://www.flowconsent.com/en/services/customer-support/olark) [Olark is a user preference and personalization service that helps websites deliver customized experiences based on individual visitor settings and choices. It manages preferences for content display, communication channels, and interaction styles. Olark integrates with website platforms to remember and apply user choices consistently across sessions. With privacy-compliant preference storage, Olark enhances satisfaction by ensuring tailored browsing experiences for every visitor.](https://www.flowconsent.com/en/services/customer-support/olark) [Preferences](https://www.flowconsent.com/en/services/customer-support/olark) · ### [Muchat](https://www.flowconsent.com/en/services/customer-support/muchat) [Muchat is a live chat and customer messaging platform that enables businesses to engage with website visitors in real time. It provides instant messaging, chatbot automation, and team collaboration tools to deliver fast, personalized customer support. Muchat supports multi-channel communication, conversation routing, and canned responses to improve response times. With built-in analytics and CRM integration, Muchat helps convert visitors into customers.](https://www.flowconsent.com/en/services/customer-support/muchat) [Preferences](https://www.flowconsent.com/en/services/customer-support/muchat) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)