Privacy Policy

This policy explains how AnkleBreaker Consulting (SAS, RCS Versailles 912 705 860, 34 rue du Président Wilson, 78230 Le Pecq, France) processes personal data in connection with Nodary, in accordance with Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act.

For your account and billing data, AnkleBreaker is the data controller. For the content you place inside a workspace (documents, diagrams, files, comments and the personal data they may contain), AnkleBreaker acts as a data processor on behalf of the workspace owner, who is the controller of that content. The processor relationship is governed by our Data Processing Addendum.

We process the following categories of personal data:

• Account data: name, email, password hash, avatar, optional profile fields, two-factor settings, preferences.
• Workspace data: workspace and team membership, roles, invitations. A workspace’s owners and admins see when each member was last active in it, to the day, never the time of day.
• Content: the documents, diagrams, files and comments you create or upload (processed on the controller’s behalf).
• Billing data: plan, seat count, subscription status, and payment metadata. Card details are handled directly by Stripe; we never store full card numbers.
• AI usage: the prompts you send to the assistant, minimal response metadata, and usage counters, retained for security, abuse-prevention, billing and workspace administration.
• Technical data: sign-in events, session and device information, IP address, and security logs.
• Usage analytics: if you accept analytics in our cookie banner, we record each page you open on nodary.ai, pages inside the app included (the address without its query string), with the referring site and campaign tags, the time spent on the page, your approximate country and region, your device, browser, operating system and screen width, and a random visitor identifier that counts unique and returning visitors. When you are signed in, each record also carries your account and the workspace you are in, so these analytics are not anonymous. We do not store your raw IP address or your browser’s full identification string in them, use no third-party trackers, and record nothing while your browser sends Do Not Track. You can decline or withdraw consent at any time. See our Cookie Policy.

We do not sell personal data, and we do not use Your Content to train foundation models or for advertising.

We send two kinds of email, and a newsletter to those who ask for it.

• Service emails concern your account and your contract, for example: verification, password reset, notifications you chose (mentions, comments), the start and end of a trial, help with what you just opened, a workspace that is locked after its trial, payments, a reminder, for a workspace you pay for, when nobody has used it for two weeks, and one question after a cancellation. They contain no discount, with one exception: three days before a trial ends, the email to the workspace owner adds an offer if the owner may receive offers and news.
• Offers and news are emails that encourage you to buy or upgrade, or to come back after you stopped paying for Nodary, or to a free account you stopped using, our product news, and every discount. Work addresses receive them once we have told you about them, at sign-up or in a notice in the app, unless you object, for example with the box at sign-up. Personal addresses (such as Gmail or Outlook) receive them only if you said yes: by ticking the box at sign-up, by accepting the notice in the app, or by turning them on in your profile. An automatic offer or news email always comes at least 48 hours after the previous one, on a weekday morning in your time zone. We stop sending offers and news to an account that has not been used for three years.
• The newsletter goes only to addresses that subscribed on our site and confirmed it from the email we sent (consent, Art. 6(1)(a)), with or without a Nodary account. Every issue has its own unsubscribe link, separate from the setting in your profile.

To choose what we write about and when, we use how your workspace is used: whether a trial started or ended, whether a plan limit was reached, how you pay (monthly or yearly, a payment left unfinished, a cancellation), how many documents and links the workspace holds, whether teammates were invited, whether an agent is connected and how often it is used, how much the AI assistant was used, and when you or your team last used Nodary. We do not track whether you open our emails. We record whether you click a button in them, and when, to know which emails are useful.

Choosing offers and news from this usage is profiling for direct marketing. You can object to it, and to these emails, at any time and without giving a reason. Every offer or news email has a one-click unsubscribe: the unsubscribe button your email app shows, when it shows one, and the link at the bottom of the email, which opens a page with a single button. The setting Offers and news from Nodary in your profile turns them off or on again. Unsubscribing never stops service emails.

All our emails are sent by Amazon SES from the European Union (Paris). Offers, news, the newsletter and the emails that guide you through Nodary are signed by François, founder of Nodary, and sent from hello@nodary.ai; emails such as verification, password reset, invitations and notifications come from noreply@nodary.ai. Replies to either reach our support team at support@nodary.ai. When an address bounces permanently or reports an email from hello@nodary.ai as spam, it goes on a suppression list and we stop writing to it from that address; a spam report also turns off offers and news for that account.

When you use the AI assistant, the relevant prompt and context are sent to our model provider (Amazon Web Services, via Amazon Bedrock) to generate a response, and are processed under a data-processing agreement that prohibits using your data to train their models. We retain prompts and minimal metadata to operate, secure and bill the feature, and to let workspace owners administer AI usage within their team.

Files you attach to a question for the AI assistant (PDFs and pictures) are sent to our model provider with that question and kept in our storage so the conversation can refer to them again, then deleted automatically within 30 days of being attached, or at once when the workspace they were attached in is deleted. Copies in our backups may remain for up to 30 more days, as for the rest of your data.

We share data only with vetted service providers acting on our instructions under a data-processing agreement:

We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of users; and, in the event of a merger or acquisition, to the successor entity under equivalent protections.

Nodary’s application, its database and the files you upload are hosted by Amazon Web Services in the United States (region us-east-1), and AI requests are processed in the United States too; only email is sent from the European Union. Transfers outside the European Economic Area are protected by appropriate safeguards under the GDPR, in particular the European Commission’s Standard Contractual Clauses and additional technical measures such as encryption in transit and at rest.

• Account & content: for as long as your account is active. After deletion, we remove or anonymise it, subject to backup cycles (typically up to 30 days).
• Billing records: retained for the period required by French accounting and tax law (generally 10 years).
• Security & AI logs: retained for a limited period proportionate to security and abuse-prevention needs.
• Email records: which emails we sent you or decided not to send you, when, and whether a button was clicked, kept for 3 years, including after an account is deleted, and then deleted. An address on our suppression list is kept for as long as we need it to stop writing to it. A newsletter address is kept while you are subscribed, and after you unsubscribe only to honour it. A newsletter sign-up that is never confirmed is deleted after 30 days.
• Deleted accounts: identification and connection data required by French law are kept apart for one year after an account is deleted, used only to answer lawful requests, then deleted.
• Abuse prevention: after an account is deleted, a one-way fingerprint of its email address and whether a free trial, the free AI allowance or a coupon was used, kept for 3 years so that they are not given again, and then deleted.

We apply technical and organisational measures including encryption in transit and at rest, hashed passwords, scoped access controls, session and token revocation, rate limiting, and audit logging. More detail is on our Security page. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

Subject to applicable law, you have the right to access, rectify, erase and port your personal data, to restrict or object to processing, and to withdraw consent at any time without affecting prior processing.

To exercise these rights, write to support@nodary.ai. If your data is held within a workspace you do not own, we will forward your request to the workspace owner (the controller). You also have the right to lodge a complaint with the French data protection authority, the CNIL.

Nodary sets the cookies it needs for sign-in, security and your workspace, a cookie that remembers the language you choose, and analytics cookies only if you accept them. It sets no advertising or third-party tracking cookies. See our Cookie Policy for details.

Nodary is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the Service evolves. Material changes will be notified by email or in-app, and the “last updated” date above will change. Continuing to use the Service after the effective date constitutes acceptance of the updated policy.