1. Who we are
Nodejam AB is a Swedish limited company, org. no. 559562-5749, Propellervägen 6A, 183 62 Täby, Sweden.
For accounts, our website, business contacts, billing, security and support, we are the data controller. Where an organization uses Nodejam for its people, we handle its AI requests, company pack files and the files its people send each other on its behalf as a processor. A Data Processing Addendum is available to business customers on request.
2. Scope
This Policy covers people who use the Nodejam app, administer an organization in Nodejam, visit nodejam.com, or contact us. Tools you connect and other third-party services have their own privacy notices.
3. What stays on your computer
The app keeps your files, chats, agent history and the sign-in tokens of tools you connect on your computer. We do not store them in our cloud unless you send a file to a colleague in Nodejam, and we do not store your connector credentials. You delete them on your computer. Otherwise hand-offs go through your organization's own mail, for example as an Outlook draft.
4. What our cloud holds
"Receives" below means a provider processes the data to deliver part of the Service for us. It never means we sell the data or share it for anyone else's purposes.
| Category | What it includes | Who receives it |
|---|---|---|
| Account and sign-in | Your email address and name, sign-in codes sent by email, and sign-in and session records. | Our hosting, database and email providers, and Google or Microsoft only if you choose to sign in with them. |
| Organizations and teams | Organization, team, role and invitations, the work-flow lines an admin draws between people, the monthly AI limit set for each team, which connectors your organization offers and whether you have connected each one (yes or no, never the account or its content). You and your admins get an email when a limit reaches 75% and 90%. | Our hosting, database and email providers. |
| Usage counts | For each AI request: who made it, the model, its size, its cost and the time. Not the content of the request. Admins in your organization can see this per team, person and model. For people in an organization, the app also reports when a task finishes and whether it succeeded, never file content, chat text or file names. | Our hosting and database providers. |
| AI requests | Where Nodejam supplies the AI, the prompt and the parts of your files the agent needs pass through our relay to the AI provider that answers the request (see section 7). We do not keep the content of requests. | Our hosting provider and the AI provider. |
| Company pack files | Templates, logos, guidelines and other files or text an organization's admin adds for its people. | Our hosting and file-storage providers. |
| Files sent between colleagues | Where your organization uses sending in Nodejam: the files, their names, the brief, review notes and who sent and reviewed them. | Our hosting and file-storage providers. |
| Admin activity | Changes admins and our staff make to an organization, with who made them and when, including members who were removed. | Our hosting and database providers. |
| Billing | If you pay for a plan: billing contact, plan and payment records. Card details are handled by Stripe, not by us. | Stripe. |
| App updates | When the app checks for updates: IP address and app version. | Our hosting provider. |
| Website | Technical data such as IP address and browser details. | Our hosting provider. |
| Communications and business data | Support, privacy, security, pilot and contract correspondence, business contact details, agreements and invoices. | Email and business-administration providers, and professional advisers under confidentiality. |
| Security logs | Sign-in and relay events, with identifiers and times, kept to prevent abuse and investigate incidents. Not the content of requests. | Our hosting provider. |
What you need to provide
An account needs your email address. Without it we cannot sign you in or secure the account. Everything else is optional or comes from your use of the Service.
5. Where we get it
We get personal data from:
- You, when you sign in, use the Service or contact us.
- Your organization's admins, when they invite you or set up teams.
- The app and your browser, as described above.
- Google or Microsoft, if you sign in with them.
- Stripe, for billing.
- Public sources, for business contacts.
6. Why we use data, and our legal basis
Under the GDPR we need a lawful basis for each purpose. The right basis can depend on your role and situation.
| Purpose | Lawful basis |
|---|---|
| Provide the Service: sign-in, organizations, AI requests, limits and updates | Performing our agreement with you, or our legitimate interest in delivering your organization's agreement. |
| Count usage, enforce limits and send limit emails | Performing the agreement, and our legitimate interest in keeping use within agreed limits. |
| Bill for paid plans | Performing the agreement, and our legal obligations for bookkeeping. |
| Protect the Service and investigate incidents | Our legitimate interest in security, plus legal obligations where they apply. |
| Run the website and handle pilot conversations | Steps at your request before a contract, and our legitimate interest in a reliable site and in answering enquiries. |
| Manage contracts and business relationships | Performing a contract, our legitimate interests, and legal obligations. |
| Send you service and business messages | Our legitimate interest, or consent where the law requires it. |
7. AI requests and connected tools
Where Nodejam supplies the AI, each request passes through our relay to the AI provider that answers it. The request carries what is needed for the result: your prompt, the parts of your files the agent reads, and the conversation so far. It also carries an account identifier, not your name or email, so the provider can detect abuse. Our relay records the usage counts in section 4, not the content. The AI provider handles requests under its own terms.
We use content only to provide the Service to you. Connected tools such as mail, calendar and file storage talk to their provider from your computer, and the agent asks you before it sends anything on your behalf.
10. International transfers
Some providers, including the AI provider, process personal data outside the EU/EEA. Contact us for information about a transfer and how it is safeguarded.
11. How long we keep data
We keep personal data only as long as needed for the purpose we collected it for, your organization's agreement, security, or a legal obligation such as bookkeeping, and then delete or anonymize it.
Data on your computer is yours to delete. To delete your account and the data our cloud holds about you, email hello@nodejam.com. An organization's admins can remove members and company pack files.
12. Security and automated decisions
We use technical and organizational measures suited to what we hold, including sign-in controls and limited access for our staff. This describes our approach. It is not a certification or audit report.
We do not make solely automated decisions with legal or similarly significant effects on you.
13. Children
Nodejam is a work tool and is not directed to children. If you believe a child has given us personal data, email hello@nodejam.com and we will delete it.
14. Your rights
Under the GDPR you may have the right to:
- Access your personal data.
- Correct data that is wrong or incomplete.
- Ask us to delete or restrict it.
- Object to processing based on our legitimate interests, and at any time to direct marketing.
- Get a portable copy of certain data.
- Withdraw consent where we rely on it.
- Complain to a data-protection authority.
How to exercise them
Email hello@nodejam.com. If the data belongs to an organization's account, we may involve its admins. We will verify your identity and respond as the law requires.
15. Supervisory authority
EU/EEA
We are established in Sweden, and our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY). You can also complain to the authority where you live or work.
United Kingdom
Where the UK GDPR applies, people in the UK can complain to the Information Commissioner's Office (ICO).
16. Changes and contact
This Policy shows its effective date at the top of the page, and we will tell you about material changes. For privacy questions or to exercise your rights, email hello@nodejam.com.