Privacy Policy

1. Information we collect

• Name and work email address
• Slack user ID and workspace (team) ID, and basic Slack profile information
• Employee interests and activity preferences
• Responses to interest and feedback surveys
• Event and meetup participation data (RSVPs, attendance, scheduling preferences)
• Technical and log data needed to operate the service securely (e.g. timestamps, request metadata)

2. How we use information, and our legal bases

We use personal data to:

• Operate the service — run surveys, cluster employees by interest, and coordinate meetups and events (legal basis: performance of a contract with your organisation, and our legitimate interests in providing the service)
• Recommend relevant events and improve matching and engagement (legitimate interests)
• Provide support and respond to requests (legitimate interests)
• Keep the service secure and prevent abuse (legitimate interests and legal obligation)

3. Data storage and security

Nodly is operated from the European Union and processes all personal data in accordance with the EU General Data Protection Regulation (GDPR).

Encryption. Data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest on our hosting infrastructure and backups.

Retention and deletion. We retain personal data only as long as necessary to provide the service. If your workspace uninstalls Nodly or discontinues use, all associated personal data is deleted from our production systems and backups within 14 business days, except where we are required to retain it to comply with a legal obligation.

4. Sub-processors

We share personal data with a small number of trusted service providers strictly to operate the service, each bound by contractual data-protection obligations:

• Cloud hosting provider — hosting and database infrastructure
• Slack Technologies — the platform Nodly runs on
• AI service provider — used to cluster employees by interest and generate event suggestions
• Email delivery provider — transactional and support email

We do not use your personal data, or any data obtained from Slack, to train large language models or other artificial-intelligence models.

5. How we share data

We do not sell or rent your personal data, and we do not share it with third parties for advertising. We share data only with the sub-processors listed above, with your organisation as part of providing the service, or where required to comply with the law or to protect our rights.

6. Your data rights

Subject to applicable law, you have the right to access, correct, delete, export (data portability), and restrict or object to the processing of your personal data, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at privacy@nodly.app. You also have the right to lodge a complaint with your local data protection supervisory authority.

7. Security

We protect data with encryption in transit (TLS 1.2+) and at rest, least-privilege Slack OAuth scopes, restricted access to production systems, and secure secret storage. No system is perfectly secure, but we work to protect your data and to limit what we collect to what the service needs.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify customer workspaces.

9. Contact

Questions about this policy or your data? Contact us at privacy@nodly.app.