Privacy Policy

Nodal Systems, S.L., NIF B27665249, is the data controller for personal data that Nodal determines how and why to use, such as website enquiries, account administration, business communications, support and security information.

Registered office: Calle Roquetes 6, Escalera 1, Piso 1, Puerta 2, 08960 Sant Just Desvern, Barcelona, Spain.

Privacy contact: [email protected].

For website visitors, prospective customers, customer contacts and Nodal account users, Nodal generally acts as a controller for the account, relationship, security and support data described in this Policy.

Where a business customer uploads personal data within project content and instructs Nodal to process that data on its behalf, the customer is generally the controller and Nodal acts as processor. That processing is governed by the applicable customer agreement and, where required, a Data Processing Agreement.

Business and contact data

Name, work email, company, role, contact details and the content of communications when you request information, a demo, support or otherwise communicate with us.

Account and platform data

Name, email address, authentication identifiers, organisation or project membership, user role, account settings, preferences and activity needed to provide and administer the Nodal platform.

Customer content

Briefs, project files, specifications, images, prompts, comments, decisions, outputs and other materials submitted to Nodal. Customer content may contain personal data if a customer chooses to include it.

Support and technical data

Support messages, account or project identifiers, technical diagnostics and attachments such as screenshots when voluntarily supplied for troubleshooting.

Security and usage data

Technical request information and security metadata that may include timestamps, browser or device information, network information such as IP address, and logs required to operate, protect and troubleshoot the service.

Commercial records

Customer, order, invoicing and transaction-reference information where applicable. Payment-card details, where used, are handled by the relevant payment provider rather than stored by Nodal as full card data.

We process personal data only where we have a lawful basis and for defined purposes, including:

• responding to enquiries and taking steps requested before entering into a contract;
• creating and administering accounts and providing the Nodal service;
• delivering support and communicating about projects, accounts or service changes;
• protecting accounts, infrastructure and the service against abuse, error and security incidents;
• managing customer relationships, contracts, invoicing and legal records;
• improving the reliability and usability of the service using appropriate operational information; and
• sending marketing communications only where permitted by applicable law and respecting applicable opt-out rights.

Depending on the context, Nodal relies on one or more of the following legal bases under the GDPR:

• Contract or pre-contractual steps, where processing is needed to provide the service or respond to a request to enter into a business relationship.
• Legitimate interests, for proportionate purposes such as service security, fraud prevention, support, service administration and managing B2B relationships, where those interests are not overridden by individual rights.
• Legal obligations, where information must be retained or disclosed to comply with applicable law.
• Consent, where applicable law requires it, for example for optional non-essential tracking technologies or certain marketing activities.

Nodal uses AI-enabled functionality to support physical-product development tasks such as structuring information, research, concept development and analysis. AI-generated or AI-assisted outputs can be incomplete or inaccurate and are intended to be reviewed by people before being used for consequential product decisions.

Nodal does not use customer content to train Nodal-owned foundation models for unrelated purposes unless the customer has expressly agreed otherwise in writing. Certain requested AI functions may require customer content to be processed by third-party technology providers acting under the arrangements applicable to the service.

Nodal does not use personal data to make solely automated decisions that produce legal or similarly significant effects about individuals.

We may disclose personal data only where necessary to operate the business or service, including to authorised Nodal personnel and providers supporting cloud hosting, infrastructure, authentication, databases, storage, communications, AI processing, support and billing.

We may also disclose information to professional advisers or public authorities where legally required. We do not sell personal data.

Where Nodal acts as processor for customer content, the use of subprocessors is governed by the applicable customer agreement or Data Processing Agreement.

Some technology providers may process data from locations outside the European Economic Area. Where a restricted international transfer occurs, Nodal uses the transfer mechanism required by applicable data-protection law, such as an adequacy decision or appropriate contractual safeguards. Information about relevant safeguards can be requested at [email protected].

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, taking into account the duration of the customer or user relationship, operational and security needs, contractual commitments, dispute-resolution needs and statutory retention periods.

Customer content is retained according to the applicable account and customer agreement. Requests to delete an account or customer data are handled subject to legal obligations, security requirements and any agreed return or deletion process.

Subject to the conditions in applicable law, you may have rights to access, rectify or erase your personal data, restrict or object to processing, and receive data in a portable format. Where processing is based on consent, you may withdraw that consent without affecting earlier lawful processing.

To exercise a right, contact [email protected]. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) or another competent supervisory authority.

If Nodal is processing personal data solely on behalf of a customer, we may refer a request to that customer because it is the controller responsible for responding.

Nodal applies technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security, and controls are reviewed as the product and infrastructure evolve.

Nodal is a business product intended for professional users and is not directed at children. If we learn that personal data has been provided by a child in circumstances where it should not have been collected, we will take appropriate steps to address it.

We may update this Privacy Policy when our service, legal obligations or data practices change. The current version will be published on this page with its latest update date. Material changes will be communicated through an appropriate channel where required.