Privacy Policy

1. Information we collect

• Name and work email address
• Slack user ID and workspace (team) ID, and basic Slack profile information
• Employee interests and activity preferences
• Responses to interest and feedback surveys
• Colleagues you choose as people you'd like to be grouped with in meetups (optional), and the fact that a colleague chose you (we don't reveal who)
• Event and meetup participation data (RSVPs, attendance, scheduling preferences)
• Technical and log data needed to operate the service securely (e.g. timestamps, request metadata)
• If your organisation connects the optional Google Calendar integration, the Google account and event data described in section 6

2. How we use information, and our legal bases

On behalf of your organisation, as its processor, we use employee data only to:

• Run surveys, cluster employees by interest, recommend relevant events, and schedule and coordinate meetups and events
• Put you in meetup groups with colleagues you chose. We are still rolling this out: until our grouping uses your choices, we only store them. The question is optional. We will use your choices only to form groups: we never show them to your organisation, its admins or HR, or to the colleagues you chose, except where the law requires it, and we don't send them to our AI service provider (optional: you can skip the question, ask us to clear your choices, and object if a colleague chose you)
• If your organisation connects Google Calendar, send meetup invitations and updates through your organisation's own Google account (see section 6)

Your organisation, as the controller, decides the legal basis for this processing. Employers usually rely on their legitimate interests in organising team and social events for their staff.

As the controller, we also use personal data to:

• Manage customer accounts, admins, and billing (legitimate interests in managing our contract with your organisation)
• Improve matching and the service, using aggregated or de-identified data wherever we can (legitimate interests)
• Provide support and respond to requests (legitimate interests)
• Keep the service secure and prevent abuse (legitimate interests and legal obligation)
• Keep a record of an admin's consent when they connect Google Calendar (legitimate interests in being able to show what was agreed)

3. Data storage and security

Nodly is operated from the European Union and processes all personal data in accordance with the EU General Data Protection Regulation (GDPR).

Encryption. Data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest on our hosting infrastructure and backups.

Retention and deletion. We retain personal data only as long as necessary to provide the service. If your workspace uninstalls Nodly or discontinues use, all associated personal data is deleted from our production systems and backups within 14 business days, except where we are required to retain it to comply with a legal obligation.

Colleagues you chose. These are deleted when you or they leave Nodly, or when your workspace uninstalls Nodly. They are never returned or exported to your organisation, except where the law requires it.

4. Sub-processors

We share personal data with a small number of trusted service providers strictly to operate the service, each bound by contractual data-protection obligations:

• Cloud hosting provider — hosting and database infrastructure
• Slack Technologies — the platform Nodly runs on
• Google LLC (Gemini API) — AI service used to cluster employees by interest and generate event suggestions
• Email delivery provider — transactional and support email

We do not use your personal data, or any data obtained from Slack, to train large language models or other artificial-intelligence models.

5. How we share data

We do not sell or rent your personal data, and we do not share it with third parties for advertising. We share data only with the sub-processors listed above, with your organisation as part of providing the service, with services your organisation chooses to connect (such as Google Calendar, see section 6), or where required to comply with the law or to protect our rights. Services your organisation connects are not Nodly sub-processors: they process data under your organisation's own agreement with them. The colleagues you choose to be grouped with are never shared with your organisation, except where the law requires it.

6. Google Calendar integration

The Google Calendar integration is optional and is off unless your organisation turns it on. An admin of your organisation connects one Google Workspace account that your organisation owns: ideally a shared account such as events@yourcompany.com, or the admin's own work account. Personal Gmail accounts cannot be connected. Nodly then creates, updates, and cancels Google Calendar events, with Google Meet links, for confirmed meetups on that account's primary calendar. Google emails the invitations and updates to participants from that account. The connected account belongs to your organisation: Google processes these events and invitations under your organisation's own agreement with Google, not as Nodly's sub-processor, and your organisation can disconnect Nodly at any time.

Data we receive from Google. The connected account's email address, display name, Google account identifier, and Google Workspace domain; the OAuth access and refresh tokens that let Nodly act on that account; and data about the events Nodly created, such as the event ID, attendee responses, and the Google Meet link.

Data we send to Google. Each meetup's title, description, start and end time, and timezone, and the work email addresses of its participants, taken from their Slack profiles, so that Google can email them the invitation and any updates. Participants we have no work email address for are not invited. Once invited, a participant stays on the invitation until they leave the meetup.

Scopes we request.

• openid, email, and profile — to identify the connected account and show admins which account and name employees will see
• https://www.googleapis.com/auth/calendar.events.owned — to create, update, and cancel meetup events on the connected account's calendar. Nodly only changes events it created.

How we protect and delete it. OAuth tokens are encrypted at rest. When your organisation disconnects Google Calendar, or uninstalls Nodly from Slack, Nodly cancels the future events it created, revokes its token with Google, and deletes the stored tokens, the connected account's email address, name, Google account identifier and domain, and the attendee email addresses, attendee responses, and Google Meet links it holds. Nodly keeps only a record of the admin's consent (who gave it, when, and which consent text they saw) and the IDs of the events it created, with no personal data from Google, until your workspace uninstalls Nodly; they are then deleted as described in section 3. Events that have already taken place stay in your organisation's Google account, which your organisation controls.

We use data received from Google only to provide this integration. We do not sell it, use it for advertising, or use it to train artificial-intelligence models. We do not share it with any other third party, except our cloud hosting provider, which stores it for us. Nodly staff do not read it unless your organisation asks us to for support, it is needed for security, or the law requires it.

Nodly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Your data rights

Subject to applicable law, you have the right to access, correct, delete, export (data portability), and restrict or object to the processing of your personal data, and to withdraw consent where processing is based on consent. Where we process your data on behalf of your organisation, your organisation is responsible for answering your request; we will pass it on and help it respond. To exercise any of these rights, contact your organisation or us at privacy@nodly.app. You also have the right to lodge a complaint with your local data protection supervisory authority.

To clear the colleagues you chose, or to object if a colleague chose you, write to the same address. When you object, we delete that choice without telling the colleague who made it.

8. Security

We protect data with encryption in transit (TLS 1.2+) and at rest, least-privilege Slack OAuth scopes, restricted access to production systems, and secure secret storage. No system is perfectly secure, but we work to protect your data and to limit what we collect to what the service needs.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify customer workspaces.

10. Contact

Questions about this policy or your data? Contact us at privacy@nodly.app.