Cookies & consent

What Nalloo stores

Nalloo sets a single first-party cookie, NUI, for analytics — to measure how the site is used. It stores a random identifier only: no name, email or personal profile.

Because it’s an analytics cookie (not “strictly necessary”), EU ePrivacy rules mean you should disclose it and obtain consent before it’s set — the same as any analytics cookie.

Two things to do

• • Add Nalloo to your cookie policy — paste the declaration below into your cookie table.
• • Load Nalloo only after consent — fire the snippet when the visitor accepts analytics cookies, not before.

Cookie declaration

Add these details to your cookie policy:

• • Name — NUI
• • Provider — Nalloo (Ecofin Cloud S.L.)
• • Purpose — Analytics — measures site usage. No personal data.
• • Duration — 12 months
• • Category — Analytics / Statistics

Or copy this ready-made text:

NUI — Nalloo (Ecofin Cloud S.L.). First-party analytics cookie.
Measures site usage. Stores a random ID only — no personal data.
Duration: 12 months. Category: Analytics / Statistics.

Load Nalloo only after consent

Pick the option that matches your setup. In every case, Nalloo (and the NUI cookie) should run only once the visitor has accepted analytics cookies. Replace YOUR_SITE_KEY with your key.

Generic (any consent banner)

Call loadNalloo() from your banner’s “accept” callback.

<script>
  function loadNalloo(){
    if (window.__nalloo) return; window.__nalloo = true;
    var s = document.createElement('script');
    s.async = true; s.defer = true;
    s.src = 'https://nalloo.com/nalloo.min.js';
    s.setAttribute('data-key', 'YOUR_SITE_KEY');
    document.head.appendChild(s);
  }
  // Run loadNalloo() when the visitor accepts analytics cookies.
</script>

Cookiebot

Mark the script as statistics; Cookiebot keeps it blocked until consent.

<script async defer
  src="https://nalloo.com/nalloo.min.js"
  data-key="YOUR_SITE_KEY"
  data-cookieconsent="statistics"
  type="text/plain"></script>

OneTrust

Tag it with the Performance category (C0002); OneTrust unblocks it on consent.

<script async defer
  src="https://nalloo.com/nalloo.min.js"
  data-key="YOUR_SITE_KEY"
  class="optanon-category-C0002"
  type="text/plain"></script>

Google Tag Manager (Consent Mode v2)

If you run Google Tag / GTM, this is the cleanest route — GTM holds Nalloo back until consent, with no code on the page:

• • Tags → New → Custom HTML — paste the generic snippet above.
• • Triggering — All Pages (or Consent Initialization).
• • Consent Settings — “Require additional consent for tag to fire” → add analytics_storage.

GTM then fires Nalloo only once your consent banner grants analytics through Consent Mode v2.

FAQ

Questions, answered.