Privacy Policy
1.Who we are and what this policy covers
Node AI Limited (NZ company number 8781328) is a New Zealand company operating Node at https://nodehq.ai.
This privacy policy explains how we handle personal information about website visitors, prospective customers, account holders, users and people whose information appears in customer content.
We decide how personal information is used to manage our website, accounts and business relationships. Under the GDPR, we act as the controller for these activities.
Where an organisation connects its systems and instructs us to process its business content, we generally act as its processor. That organisation determines the purposes of processing, permissions and applicable privacy notices. For individual accounts, our role depends on the processing involved; we remain responsible for processing whose purposes we determine.
2.Information we collect and why
| Information | How we receive it | Why we use it |
|---|---|---|
| Identity, contact and account information | Sign-up, sign-in, account administration and communications with you or your organisation | Provide accounts, authenticate users and manage customer relationships |
| Billing and transaction information | You, your organisation and payment services | Administer subscriptions, payments and financial records |
| Support enquiries and correspondence | Messages, support requests and feedback | Answer questions, resolve problems and improve the service |
| Customer business content | Connected email, documents, files, tickets, chats and other authorised sources | Provide the service’s AI features and perform work you request |
| Questions, answers, conversations and work records | Your interactions and work performed through the service | Understand workflows, carry out tasks and record their results |
| Information derived from connected sources | Facts extracted from connected sources and service activity | Connect people, teams, tools and workflows, including source, time and confidence information |
| Usage, technical and security information | Use of our website and service, analytics and operational logs | Operate, troubleshoot, secure and improve the service |
Customer content may include information about people who do not have a Node account. Its contents depend on what customers connect or provide and may include sensitive personal information. Customers must have authority to provide this information and must not connect unnecessary sensitive information.
Information needed to establish an account or perform a requested task is necessary for that functionality. You can choose not to provide it or connect a source, but features relying on it may not work.
Analytics
We use analytics to understand how our website and service are used. We do not use advertising cookies. Any analytics provider we use is listed in our subprocessor list.
3.Legal grounds and AI processing
Where we act as controller and the GDPR applies, we rely on the following lawful bases:
| Basis | When it applies |
|---|---|
| Contract | Processing necessary to provide a service under a contract with you or take steps at your request before entering that contract |
| Legitimate interests | Necessary business communications, account administration, security, troubleshooting and service improvement, where our interests are not overridden by your rights and interests |
| Legal obligation | Records, disclosures or other processing required by applicable law |
| Consent | Optional processing that requires your permission; you may withdraw consent without affecting earlier lawful processing |
Processor activities follow the customer’s documented instructions. Special-category information requires an applicable additional legal condition, not merely an ordinary lawful basis.
Our AI features use AI services to interpret information and perform tasks. Relevant content is included in requests according to the task and authorised access. Our AI providers are approved vendors that do not train on customer data. They do not retain it, except that some providers may keep prompts for a limited period for safety and abuse monitoring. Where each processes data is listed in our subprocessor list.
Each piece of information keeps the access permissions of its source, and our AI features act only with the access of the person using them. If you connect an external AI assistant, it can read only what your access allows, and that assistant provider’s privacy terms also apply.
AI-derived facts and outputs can be inaccurate. You can ask us to correct or delete them.
4.Sharing and international processing
We share personal information only as necessary for the relevant purpose:
| Recipient | Purpose |
|---|---|
| Hosting, security and operational providers | Hosting, storage, sign-in, network protection, integrations, email delivery and service operation |
| AI providers and routing services | Processing requests needed for AI functionality |
| Business service providers | Customer relationships, support, collaboration and billing |
| Your organisation and authorised users | Account administration, collaboration and access permitted by customer settings |
| Authorities or other legally entitled recipients | Complying with law, responding to lawful requests or establishing, exercising or defending legal claims |
The providers we use, what each does and where each processes data are listed in our subprocessor list at https://trust.nodehq.ai. Payment information is shared with the payment provider used for your transaction. Providers receive only information needed for their agreed purposes and are subject to appropriate privacy and security terms.
Where customer content is hosted is listed in our subprocessor list. Some providers, including AI and integration services, process information in other countries, including the United States.
When we disclose personal information outside New Zealand, we do so only where the recipient is subject to comparable privacy safeguards or contractual protections, as required by the New Zealand Privacy Act 2020. Where GDPR transfer rules apply, we rely on a lawful transfer mechanism, such as an adequacy decision or standard contractual clauses. You may request information about the safeguards relevant to your information.
5.Retention and protection
Customer content is deleted on the timeline set in the customer’s contract after it ends, unless a lawful retention requirement applies. Residual copies in backups expire within 7 days. They remain protected and are not returned to ordinary use without reapplying required deletions.
Account, billing, correspondence and other business records are kept only for as long as needed for their purpose or applicable legal requirements.
We use proportionate technical and organisational safeguards, including restricted access, authentication, protected remote access and secure credential handling. No internet service can guarantee absolute security. Where a personal information breach requires notification, we notify affected customers, individuals or authorities within applicable legal and contractual deadlines.
6.Your rights and how to contact us
Depending on applicable law and our role, you may request access, correction, deletion, restriction or portability of your personal information, or object to processing. You may also withdraw consent where processing relies on it.
Our Privacy Officer can be contacted at privacy@nodehq.ai with any privacy request or concern, whether or not you have an account.
We may request proportionate information to verify your identity or authority. We respond to requests within 20 working days of receipt. Where a lawful extension is necessary, we will tell you the reason within that time. If we refuse a request or retain information, we will explain the reason and your complaint options.
For information controlled by your organisation, contact its administrator or privacy contact. If you contact us instead, we will route the request to the responsible customer and assist it as required, rather than independently changing customer-controlled information.
You may complain to the New Zealand Office of the Privacy Commissioner or, where GDPR applies, the relevant European supervisory authority.
7.Changes to this policy
We keep this policy accurate when processing, providers, locations or rights arrangements change. Material changes are communicated to affected users before they take effect where required by law. A policy update alone does not authorise a new use requiring consent or another legal basis.