Nodety Privacy Policy

Below we will inform you in detail about the type, scope and purpose of the personal data we collect, use and process, and explain the rights to which you as the data subject are entitled.

We may update this Privacy Policy from time to time. For material changes that significantly affect how we collect, use, or share your personal data, we will provide notice by email and within the Application at least thirty (30) days before the changes take effect. Minor clarifications or corrections may take effect immediately upon posting. The current version can be accessed, saved and printed out at any time at nodety.com/legal/privacy.

With regard to the terms used (e.g. personal data, controller), we refer to the definitions of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and other applicable data protection legislation. This Privacy Policy supplements the Terms of Service at nodety.com/terms, which contain additional provisions regarding data use (including the Interaction Data and User Content provisions).

Controller

The controller within the meaning of the UK GDPR, EU GDPR, and other applicable data protection laws is:

Nodety Limited, 2nd Floor, Midas House, 62 Goldsworth Road, Woking, Surrey GU21 6LQ, United Kingdom

Email: info@nodety.com Website: www.nodety.com

General information on data processing

Scope of processing

We only collect and use personal data to the extent that this is necessary to provide a functional Application and our content and services, you have given your consent, or the processing of the data is permitted by law.

Legal basis for processing personal data

We process personal data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): Where we have obtained your consent for the processing of personal data.
• Contract performance (Art. 6(1)(b) GDPR): Where processing is necessary to fulfil a contract to which you are a party, or to carry out pre-contractual measures.
• Legal obligation (Art. 6(1)(c) GDPR): Where processing is necessary to comply with a legal obligation to which Nodety is subject.
• Legitimate interests (Art. 6(1)(f) GDPR): Where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests, fundamental rights, or freedoms.

Legitimate interests

Where processing is based on Art. 6(1)(f) GDPR, our legitimate interest is, unless otherwise stated, the performance of our business activities and the provision, improvement, and security of our Services.

Data erasure and storage duration

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies or you revoke your consent. Storage may continue where required by applicable law (including EU and UK regulations, tax law, or commercial law). The following retention periods apply:

• Account and registration data: Retained for the duration of the Account, then deleted within ninety (90) days of Account deletion or termination, except as required by law.
• Billing and payment data: Retained for the duration of the Account plus applicable statutory retention periods (typically six (6) to ten (10) years depending on jurisdiction) as required by tax and commercial law.
• Server log files: Stored for a maximum of seven (7) days.
• Support correspondence: Retained for the duration of the Account plus twelve (12) months, or longer where an unresolved dispute exists.
• Interaction Data (Free and Edu Plan Users): Retained indefinitely in anonymised form for product improvement, as described in the Interaction Data section below and in the Terms of Service.
• Analytics and usage data: Retained in anonymised or pseudonymised form for as long as necessary for product improvement purposes.

When the applicable retention period expires, personal data will be deleted in accordance with statutory provisions, unless there is a need for further storage for the conclusion or fulfilment of a contract.

Recipients of data

The primary recipient of data collected via our Application is Nodety as the controller. In addition, processors (web hosts, IT service providers, analytics providers, etc.) may have access to personal data collected via our Application. Compliance with data protection requirements is ensured through data processing agreements with our processors. A current list of sub-processors is available at nodety.com/legal/sub-processors.

Nodety may also share data with its Affiliates (entities that directly or indirectly control, are controlled by, or are under common control with Nodety Limited) for the purposes described in this Privacy Policy. Current Affiliates include Nodety GmbH, Germany (development and technology). Data shared with Affiliates remains subject to the same protections, restrictions, and User preferences that apply under this Privacy Policy.

Data is only transferred to countries outside the UK and EU/EEA to the extent indicated below.

Data transfer to third countries

We only transfer data to a third country (i.e., a country outside the UK and the EU/EEA) or have data processed in a third country where: (a) the third country has been recognised as having an adequate level of data protection; (b) we have concluded EU Standard Contractual Clauses, a UK International Data Transfer Agreement (IDTA), or an Addendum to the EU SCCs for UK transfers; or (c) other legally recognised safeguards are in place, including certification under the EU–US Data Privacy Framework and its UK Extension.

Data Processing Agreement

Where Nodety processes personal data on behalf of a user acting as a data controller, the Data Processing Agreement at nodety.com/legal/dpa applies in addition to this Privacy Policy. The DPA sets out the obligations of each party regarding the processing of personal data within the Services.

Automated decision-making

We do not carry out any automated decision-making or profiling within the meaning of Art. 22 GDPR.

Data security

We secure our Application and systems through comprehensive technical and organisational measures against loss, destruction, access, modification, or distribution of your data by unauthorised persons. These measures are subject to constant review and improvement to ensure they remain appropriate and state-of-the-art.

Cookies and tracking technologies

Cookies and similar technologies

We use cookies and similar tracking technologies to track activity on our Services and to hold certain information. Cookies are small data files which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies such as beacons, tags, and scripts are also used to collect and track information and to improve and analyse our Service.

Cookie categories and purposes

We classify cookies into the following categories. You can manage your preferences for non-essential cookies via the consent banner (powered by Cookiebot) displayed on your first visit.

Strictly necessary cookies — required for the Application to function. These cannot be disabled.

Functional cookies — enable enhanced functionality and personalisation.

Analytics cookies — help us understand how visitors use the Application. Set only with your consent or where we rely on legitimate interest as described below.

We do not use marketing or advertising cookies.

Consent management (Cookiebot)

We use Cookiebot to manage user consent for cookies and tracking technologies. When you first visit our site, Cookiebot displays a cookie banner that allows you to accept or reject different categories of cookies. Your preferences are stored and respected according to your choices. Cookiebot ensures our compliance with GDPR requirements for prior consent and transparency.

Google Analytics

Our website uses Google Analytics 4, a web analytics service offered by Google Ireland Limited ("Google"). Google Analytics 4 does not store full IP addresses. Google uses the data collected to track and report website traffic. You can opt out by installing the Google Analytics opt-out browser add-on. Where data is transferred outside the EU/EEA and UK, Google relies on the EU–US Data Privacy Framework (including the UK Extension), the UK International Data Transfer Agreement, and Standard Contractual Clauses as appropriate. For more information: https://policies.google.com/privacy

Google Tag Manager

Google Tag Manager is a tag management system that allows us to update tags and code snippets on our website. Google Tag Manager itself does not collect any personally identifiable information. However, the tool triggers other tags that may collect data. If deactivation has been made at the domain or cookie level, it will remain in effect for all tracking tags implemented with Google Tag Manager. For more information: https://www.google.com/analytics/tag-manager/use-policy/

Your choices regarding cookies

You may disable the use of cookies in your browser and delete cookies associated with this website at any time. If you do not accept cookies, you may not be able to use some portions of our Services.

Data processing when using our services

Hosting, infrastructure, and engine processing

We host our Application on servers from Google Cloud EMEA Limited ("Google Cloud").

Google Cloud provides both the hosting infrastructure for the Application and the compute infrastructure on which all engine processing is performed. When you interact with a Project — including adjusting parameters, connecting or modifying nodes, rendering, and other operations — your Project data is transmitted to Google Cloud virtual machines for processing and results are returned to your browser in real time. This means that your Project data is actively processed on Google Cloud infrastructure during each session, not merely stored. Where an Enterprise User operates under a non-default Deployment Model, some or all of the infrastructure described above may differ as specified in the Enterprise Addendum and the applicable Quotation.

When using our Services, your (anonymised) IP address and the duration of your visit are transmitted to Google Cloud. Google Cloud also automatically saves access data in server log files, including:

• Date and time of retrieval
• Amount of data transferred and, if applicable, name of the requested file
• Browser used and its version
• Operating system used
• IP address
• Requested URL including subpages
• Referrer URL
• Requesting provider

The temporary storage of the IP address is necessary to enable delivery of the Application to your device. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Log data is stored for a maximum of 7 days. The legal basis for engine processing of Project data is Art. 6(1)(b) GDPR (contract performance), as processing is necessary to provide the Services.

Further information: https://cloud.google.com/terms/cloud-privacy-notice

Registration and account data

You have the option to register in our Application. When you create an account, you are required to provide certain mandatory information:

• Your email address — We use the data you provide to authenticate you when you log in, to verify your authorisation, to enforce the Terms of Service, and to contact you to send technical or legal notices, updates, security notifications, or other messages relating to account administration. For Free and Education Plan Users, we also use your email address to send product updates, feature announcements, and promotional communications; you may unsubscribe from promotional emails at any time using the unsubscribe link in each message, without affecting your Account or access to the Services. We also store your IP address and the date and time of registration to prevent misuse and to investigate potential security incidents. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in account administration and, for promotional communications to Free and Education Plan Users, in marketing our services to active users of the platform).

When you subscribe to a paid plan, we additionally collect and process:

• Your name — for billing purposes
• Your billing address — for billing and tax compliance

The legal basis for billing data is Art. 6(1)(b) GDPR (contract performance).

Device and usage data

If you use our Application, we also collect and process:

• Device data (e.g., operating system) — to provide our Services
• Time zone and geolocation data — to display the applicable licence terms and pricing for your region

The legal basis is Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in providing correctly localised Services).

Data retention after account deletion

After account deletion or termination of the contract, we retain personal data only as required by statutory retention periods or to fulfil legal or accounting obligations. Design projects, templates, and user-generated content stored in the Application will be permanently deleted and cannot be restored. Users may export their Project files before deletion; exported files do not include User-uploaded files (which the User should retain independently), third-party content, or rendered outputs (which may be generated via export nodes prior to export). It is the User's responsibility to export any required data before requesting account deletion. Data that has been anonymised and incorporated into aggregated statistics prior to account deletion is not subject to deletion, as it no longer constitutes personal data within the meaning of GDPR Recital 26. Certain financial records (invoices, transaction history) may be retained after account deletion as required by applicable tax and accounting laws, in accordance with GDPR Art. 17(3)(b). Full details are in the Account Deletion provisions of the Terms of Service and the Post-Termination Retrieval provisions.

Authentication (Google Cloud Identity)

Login to our Application is via an authentication token. After your initial registration, you will receive an email containing a link. When you click on the link, a token is generated and stored on your device. The token is assigned to your user account, which automatically logs you in and gives you access to our Application. The token and the authentication are provided by Google Cloud Identity.

Google Cloud Identity is a service provided by Google.

The token has a limited term and must be regenerated after expiry. For more information: https://policies.google.com/privacy

Authentication (Sign in with Apple)

Users may authenticate using Sign in with Apple, provided by Apple Distribution International Limited ("Apple"). When you sign in with Apple, Apple transmits your email address (or a private relay address) and an authentication token to Nodety. Apple may process additional data in accordance with its own privacy policy. Where data is transferred outside the EU/EEA and UK, Apple relies on Standard Contractual Clauses and other approved transfer mechanisms as appropriate. The legal basis is Art. 6(1)(b) GDPR (contract performance).

Further information: https://www.apple.com/legal/privacy/

Authentication (Microsoft)

Users may authenticate using Microsoft Identity Platform, provided by Microsoft Ireland Operations Limited ("Microsoft"). When you sign in with Microsoft, Microsoft transmits your email address and an authentication token to Nodety. Microsoft may process additional data in accordance with its own privacy policy. Where data is transferred outside the EU/EEA and UK, Microsoft relies on the EU–US Data Privacy Framework (including the UK Extension), the UK International Data Transfer Agreement, and Standard Contractual Clauses as appropriate. The legal basis is Art. 6(1)(b) GDPR (contract performance).

Further information: https://privacy.microsoft.com/

Firebase

We use the Google Firebase platform for our Application. Firebase may transmit data to the USA. Where data is transferred outside the EU/EEA and UK, Google relies on the EU–US Data Privacy Framework (including the UK Extension), the UK International Data Transfer Agreement, and Standard Contractual Clauses as appropriate. Firebase Analytics uses methods that enable an analysis of your use of the Application, in particular which features you access, when you open the Application for the first time, and related usage events.

Firebase and the personal data processed by means of Firebase may be used together with other Google services, such as Google Analytics. In this case, device-related information may also be processed.

The legal basis is Art. 6(1)(a) GDPR (consent). You can give your consent via our Application and revoke it in the settings at any time with effect for the future.

You can adjust marketing settings provided by Google: https://adssettings.google.com/

Further information: https://policies.google.com/privacy

Sentry (error monitoring)

We use Sentry, an error management tool from Sentry Inc. Sentry helps us improve the technical stability of our Application by monitoring system stability and identifying code errors. We collect and store pseudonymised usage data and internal logs for the purpose of identifying and correcting errors. The legal basis is Art. 6(1)(f) GDPR.

Further information: https://sentry.io/privacy/

BetterStack (system monitoring)

We use BetterStack (including Better Uptime and Better Logs) to monitor system availability and performance. This may involve processing metadata such as IP addresses, request URLs, and error traces for operational diagnostics. The legal basis is Art. 6(1)(f) GDPR.

Further information: https://betterstack.com/legal/privacy-policy

PostHog (product analytics)

We use PostHog, a product analytics platform hosted in the EU, to understand how users interact with Nodety, improve usability, and guide feature development. This includes tracking events such as clicks, navigation, and feature usage. The legal basis for analytics event tracking is Art. 6(1)(f) GDPR (legitimate interest in improving the Services).

We may use session recordings with automatic blurring of user content to analyse usage flows and improve the user experience. Session recordings are collected only with your consent. The legal basis is Art. 6(1)(a) GDPR (consent). You can give or withdraw your consent in the Application settings at any time.

Further information: https://posthog.com/privacy

Personalised tips and offers

With our Application we may show you helpful tips, information, and offers based on your usage behaviour. If you have agreed to the collection of your movement and usage data within our Application, we derive personalised tips, information, and offers from this data.

The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent in the settings at any time. The data will not be passed on to third parties.

Interaction Data (Free and Education Plan Users)

As a condition of receiving access at no charge, Nodety collects data arising from Free Plan and Edu Plan Users' interactions with the Application ("Interaction Data"). Interaction Data includes workflow patterns, node configurations, feature usage patterns, navigation paths, error reports, diagnostic information, and anonymised project structure data. Interaction Data does not include content uploaded by the User (such as images, logos, or fonts).

Nodety uses Interaction Data to improve the Application's features, functionality, and performance; analyse usage patterns to inform product development; generate anonymised and aggregated statistics; and conduct internal research and development. Nodety applies reasonable anonymisation measures before using Interaction Data for product improvement, such that the data cannot reasonably be linked to an identified or identifiable individual.

Interaction Data is retained indefinitely in anonymised form, including after termination of the Free Plan or Edu Plan. Users who do not wish to permit this data use must subscribe to a paid Plan. Paid Plan Users are not subject to Interaction Data collection under this section. Enterprise Plan Users are explicitly excluded from all Interaction Data collection.

The legal basis is Art. 6(1)(b) GDPR (contract performance), as the data use is a material condition of the Free Plan and Edu Plan agreements set out in the Terms of Service, and additionally Art. 6(1)(f) GDPR (legitimate interest). Nodety has a legitimate interest in improving its products using anonymised usage data from no-charge Plans; the impact on users is minimal given the anonymisation measures applied, and users who do not wish to permit this data use have a genuine alternative (subscribing to a paid Plan). Full details are in the Edu Plan Data Use provisions of the Terms of Service at nodety.com/terms.

Email and contact

If you contact us by email or via a contact form, the personal data you provide will be saved. We only use the personal data you provide to process your specific request. The data will be deleted as soon as the conversation has ended and the facts have been finally clarified.

The legal basis is Art. 6(1)(f) GDPR. Where contact is aimed at concluding a contract, the additional legal basis is Art. 6(1)(b) GDPR.

Customer.io: We use Customer.io (Peaberry Software, Inc.) to manage customer messaging, support communications, automated transactional notifications, and promotional email campaigns. When you interact with our support channels or receive automated or promotional messages, Customer.io may process your email address, messages, and related metadata. Further information: https://customer.io/legal/privacy-policy

Postmark: We use Postmark (ActiveCampaign, LLC) to send transactional emails such as account notifications and system messages. Your email address and related metadata may be processed solely for email delivery. Further information: https://postmarkapp.com/privacy-policy

Payment service provider

We use Stripe Payments Europe Ltd ("Payment Service Provider") to process payments.

When you make a payment, you transmit your data to the Payment Service Provider via the input form, such as name, address, email address, IP address, and bank details as necessary for payment processing. The legal basis is Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in offering effective and secure payment options).

We do not have access to the data entered; it is processed and stored exclusively by the Payment Service Provider. We only receive information about whether the payment was successful. The Payment Service Provider may transfer your data to credit agencies for identity and credit checks and for fraud prevention.

Further information: https://stripe.com/privacy-center/legal

Google Fonts

Our Application uses Google Fonts to display text, provided by Google. When you use text-related functionality, the Application loads the required font. If you prevent access to Google servers, text will be displayed in the system default font. The legal basis is Art. 6(1)(f) GDPR.

Further information: https://policies.google.com/privacy

Data storage and caching

Storage on our servers

When you use the Nodety Application, your Projects are stored on our secured servers. This allows us to provide features such as backup, access from multiple devices, and sharing capabilities. Where a non-default Deployment Model applies, Projects at rest may be stored on the Enterprise User's Client Infrastructure rather than on Nodety's servers; data handling in that case is governed by the Enterprise Addendum at nodety.com/legal/enterprise.

Local caching on your device

For improved performance and faster access times, Nodety may cache a copy or portions of your Projects on your device's local storage, such as browser local storage, IndexedDB, or using the File System API.

Security of cached data

Although cached data is stored locally on your device, we implement security measures to protect it. If you are using a shared or public computer, we recommend logging out after each session.

Changes to storage practices

We may update our data storage and caching practices to improve user experience or for operational reasons. Significant changes that affect how your Projects are stored will be communicated to you in advance.

Social media

We maintain presences in various social networks. If you visit such a presence, personal data may be transmitted to the provider of the social network. The provider may process your data for market research and advertising purposes.

If you are logged in with your personal user account while visiting such a network, the network can assign the visit to your account. To prevent this, log out of your account and delete cookies before visiting our social media presence.

The legal basis is Art. 6(1)(a) GDPR (where you have given consent to the social network provider) and Art. 6(1)(f) GDPR (our legitimate interest in communicating with you and informing you about our services).

Instagram

Operated by Meta Platforms Ireland Limited.

Privacy Policy: https://instagram.com/about/legal/privacy/

TikTok

Operated by TikTok Technology Limited.

Privacy Policy: https://www.tiktok.com/legal/privacy-policy-eea

YouTube

Operated by Google.

Privacy Policy: https://policies.google.com/privacy

Opt-Out: https://adssettings.google.com/authenticated

Data subject rights

If your personal data is processed, you have the following rights under the UK GDPR, EU GDPR, and other applicable data protection legislation:

Right of access (Article 15 GDPR)

You have the right to request confirmation as to whether we are processing data relating to you, and to receive information about the personal data stored about you and a copy of this data.

Right to rectification (Article 16 GDPR)

You have the right to request the immediate correction and/or completion of incorrect or incomplete personal data concerning you.

Right to restriction of processing (Article 18 GDPR)

You have the right to demand that we restrict processing if one of the legal requirements is met.

Right to erasure (Article 17 GDPR)

You have the right to demand that your personal data be deleted immediately if one of the legal reasons applies and if the processing is not necessary.

Right to notification (Article 19 GDPR)

If you have asserted the right to rectification, deletion, or restriction of processing, we are obliged to inform all recipients to whom your personal data has been disclosed of this, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.

Right to data portability (Article 20 GDPR)

You have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit this data to another controller without hindrance from us.

Right to object (Article 21 GDPR)

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on these provisions.

In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Right to withdraw consent

You have the right to withdraw your consent to the processing of personal data at any time. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the United Kingdom (with the Information Commissioner's Office) or, for EU/EEA residents, in the member state of your place of residence, your place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates applicable data protection law.

How to exercise your rights

To exercise any of the rights described above, please contact us at info@nodety.com. We will respond to your request within one (1) month, or within the extended timeframe permitted by applicable law where the request is complex or we have received a high volume of requests. We may ask you to verify your identity before processing your request.

Last updated: 12 October 2026