Putting Cloudflare in front of a site changes the data path. It does not outsource your privacy responsibilities.
Cloudflare can provide DNS, proxying, security, performance, analytics, and other services. The personal data involved depends on which products you enable, what you log, and what your origin application collects.
Table of contents
- Draw the request path
- Separate roles and datasets
- Configure for data minimisation
- Write an accurate notice
- How this fits the rest of the stack
- FAQ
Draw the request path
For a proxied site, a visitor generally connects to Cloudflare before traffic reaches the origin. That layer may process IP addresses, headers, cookies, requested URLs, security signals, and request timing to deliver configured services. DNS-only records create a different path.
Document browser, edge, origin, third-party analytics, payment, support, and backup flows. Privacy reviews become concrete once each recipient and purpose is visible.
Separate roles and datasets
Cloudflare’s public policy distinguishes information about its own customers and website visitors from customer content and logs it processes to provide services. Your organisation may remain the controller for application users while providers act under contractual roles.
Product, jurisdiction, and contract details matter. Review current official terms and your legal obligations rather than turning a marketing sentence into a universal conclusion.
Configure for data minimisation
- Enable only the logs and analytics required for a defined purpose.
- Set retention periods and restrict staff access.
- Avoid placing secrets or sensitive identifiers in URLs.
- Review cookies, bot controls, workers, and third-party integrations.
- Protect the origin so traffic cannot casually bypass the edge.
- Maintain a deletion and access-request process.
Write an accurate notice
Tell users what categories of data are processed, why, by whom, for how long, and what choices or rights apply. Name providers when required, link to relevant policies, and keep the notice aligned with the configuration actually running.
Revisit the map when enabling a new product. Privacy drift often comes from a helpful toggle that quietly adds a new dataset or recipient.
How this fits the rest of the stack
Privacy is a maintained system of configuration, contracts, retention, access, and honest disclosure. When planning the origin behind an edge provider, compare its footprint with the RunxBuild calculator and deploy from the RunxBuild dashboard.
Useful related references:
- WHOIS Privacy Protection: What It Hides and What It Cannot
- How to Get a New Temporary IPv6 Address (and Why Privacy Extensions Exist)
- Cloudflare Logpush: What It Ships, What It Costs, and What It Misses
- Services on RunxBuild
FAQ
Does Cloudflare see website traffic?
For proxied services, it processes request data needed to deliver the configured service. Exact data and retention depend on products and settings.
Does using Cloudflare make a site privacy compliant?
No. Site owners still need a lawful purpose, accurate disclosures, appropriate contracts, minimisation, security, and user-rights processes.
Is Cloudflare the controller or processor?
The role can differ by dataset and service. Review the current policy, agreement, and your specific use.
Should I mention Cloudflare in my privacy notice?
Often yes when disclosure is required or useful, but the precise wording should reflect your jurisdiction, products, and data flow.