Privacy policy

Scope and responsibilities

This policy covers the nodulz website, user accounts, licence portal, subscriptions, support and services hosted by Seapalm. Seapalm SAS determines the purposes and means of its service management processing and acts as its controller.

An organisation processing data through its workflows determines the purposes, data subjects and lawful bases. Seapalm acts as a processor only when it hosts or processes that data on the organisation’s behalf, under its instructions and the applicable agreement. The “GDPR data processing” page explains this relationship.

For self-hosting, the customer administers its instance, data and security. Using a licence or the portal does not mean that workflow contents are automatically sent to Seapalm. Information voluntarily sent to support and configured external services constitute separate flows.

Account and sign-in data

When you register or manage a profile, we process your name, email address, language, verification information and, if provided, profile photo. Authentication uses a hashed password or an available sign-in provider that you choose.

Sessions contain technical identifiers, sign-in and expiry dates, an IP address and browser information. A third-party sign-in may provide a provider identifier, email address, name, photo and tokens required for that connection. The fields received depend on the provider and authorised permissions.

Licences, subscriptions and payments

We process licences, their owner, plan and entitlements, instance activation identifiers, validation dates, subscriptions, payment references and necessary billing information.

When payments are available, Stripe processes payment details on its interfaces. The nodulz portal retains customer, transaction and subscription references; it is not intended to store your full card number or security code.

Support and communications

Support requests may contain a subject, messages, attachments, diagnostics and account data needed for follow-up. Verification, password reset and ticket update emails are service communications.

Do not send passwords, API keys or unnecessary production data. Anonymise examples and logs before attaching them. Commercial enquiries are processed when you actually contact us; an unsubmitted form alone is not a received enquiry.

Workflow data

Depending on your choices, a nodulz instance may process workflow definitions, node settings, connection secrets, events and webhooks, input and output data, files, errors and execution histories.

This data may concern employees, customers, prospects, suppliers or other people. It may come from you, a form, a database, an API or a connected service. The workflow controller must inform people, including where data is obtained indirectly.

Health data, biometric data, opinions and other special categories require a condition authorising their processing under Article 9, in addition to an ordinary lawful basis. Data relating to offences is also subject to specific conditions. Check that hosting and connectors are suitable before using them for such data.

Purposes and lawful bases

Each purpose requires its own lawful basis. Using the service does not constitute blanket consent for every processing operation. Workflow controllers are responsible for this assessment for their workflows.

• Account creation and operation, provision of licences, service delivery and contractual support: performance of a contract or requested pre-contractual measures where Article 6(1)(b) applies.
• Administration of professional access, security, abuse prevention, diagnostics and defence of rights: legitimate interests in operating a reliable service and protecting people and systems, balanced against their rights and expectations.
• Billing and retention of accounting records: applicable legal obligations.
• Optional operations requiring authorisation, including non-essential trackers if introduced: prior, specific and withdrawable consent. Necessary service communications do not depend on advertising consent.

Required and optional information

Necessary identification, authentication and billing information is required to provide the relevant functions. Without it, registration, sign-in or an order may be impossible. Profile photos and information unnecessary for your request are optional.

You choose what data enters workflows. Limit it to what the purpose requires, with proportionate connector permissions and retention periods.

Recipients and providers

Authorised Seapalm personnel can access data according to their duties. Data may also be disclosed to an authority where required by law or justified for the defence of a right. Seapalm does not sell users’ personal data.

• Seapalm: operation and hosting on its own European infrastructure, account management, licences and support.
• Stripe: payment and billing when you purchase a paid plan. Its GDPR role depends on the operations; it may also act as an independent controller for some obligations.
• Google, Microsoft or GitHub: only when the provider is available and you choose that sign-in. The provider also processes data under its own policy.
• Transactional email delivery: recipient address, language, message and required action information are sent through the configured delivery system, including Notifuse. The delivery provider and processing location must be specified in the list applicable to the supplied service.
• Services connected to your workflows and MCP tools: recipients are those you select and authorise. They are not all Seapalm processors; their role depends on your contract and use.

Hosting and international transfers

Seapalm-hosted services run on its infrastructure in Europe. “Europe” does not necessarily mean the European Economic Area: countries and any access from third countries are specified for the relevant service on request or in contractual annexes.

Payment services, sign-in providers, connectors or AI models may process data outside the EEA. Before a transfer for which Seapalm is responsible, applicable safeguards must be established: an effective adequacy decision or, otherwise, standard contractual clauses and suitable supplementary measures. Any certification is considered only where it actually covers the recipient and transfer.

You may request details about countries, recipients and safeguards, and a copy of safeguards that can be disclosed. For services you connect yourself, review their processing locations and terms before sending data.

Retention periods

The retention policy for Seapalm-operated services provides the following periods. A legal retention duty or dispute may justify separately archiving only necessary information with restricted access.

• Account, profile and routine management data: throughout the service relationship, then deletion or anonymisation within 30 days of closure, except where legally necessary.
• Technical logs and execution data retained for routine operation of hosted services: up to 30 days from recording; a shorter period may be configured.
• Backups of Seapalm-operated services: a 30-day retention cycle. Deleted data may remain until that cycle expires and is not returned to routine use.
• Hosted workflow data: returned or deleted under customer instructions; following the end of the service, deleted within 30 days, including through expiry of the backup cycle.
• Support correspondence and attachments: during handling of the request, then 30 days after closure, except information required for a legal obligation or dispute.
• Accounting records and supporting documents: 10 years from the end of the relevant financial year. This exception does not justify retaining an entire profile or workflow.
• Sessions, verification and password reset links: until expiry or revocation; they are no longer usable afterwards. For self-hosting, purge and backup rules are defined and applied by the instance operator.

Security and confidentiality

The portal uses hashed passwords, protected production session cookies and access checks based on roles and resources. Deployment security also depends on protecting administrative access, secrets, communications and backups.

No system eliminates every risk. Customers must limit user permissions, protect keys, check scripts and extensions, maintain their instance and avoid exposing data in logs. Hosted service security arrangements must be documented in its data processing agreement.

Incidents and personal data breaches

Following a breach, Seapalm assesses its scope, consequences and remedial measures. When acting as a processor, it informs the controller without undue delay and provides available information relevant to the controller’s notification.

When acting as a controller, Seapalm notifies the competent authority within the statutory period where the conditions apply, normally within 72 hours of becoming aware. People are informed without undue delay where the risk is high, subject to statutory exceptions.

Automation, AI and MCP

Workflows may trigger actions, execute code and send data to AI services. MCP access may disclose information to an assistant and its provider according to granted permissions. Check instructions, recipients and those providers’ retention or training rules.

Automatically running a workflow is not in itself a decision covered by Article 22. If your use produces legal or similarly significant effects on a person through a solely automated decision, you must establish the conditions authorising it and appropriate safeguards, including human intervention where required. Providing the tool does not itself authorise that use.

Your rights and how to exercise them

Under the conditions of the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. The “Your GDPR rights” page explains each right, its limits and the request procedure.

For account or portal data, contact Seapalm. For data processed in an organisation’s workflow, contact that organisation first; Seapalm assists it when acting as its processor. You may complain to the CNIL or the competent supervisory authority without first obtaining a response from Seapalm.

Cookies, children and updates

The “Cookies” page describes technical portal trackers. nodulz is an automation tool and is not designed as a service directed at children. Organisations processing children’s data in workflows must apply the safeguards and rules relevant to that use.

The revision date appears at the top of this page. Significant processing changes require appropriate information; where new processing requires consent, publishing a policy does not replace obtaining it.