Legal
Privacy Policy
Last updated:
This policy explains which personal data Nodes-IP collects when you visit the website or use the service, why, how long it is kept, and the rights you have over it.
1. Who is responsible
The controller of the personal data described in this policy is Nodes-IP, Roerstraat 25, 7523TK Enschede, Netherlands, Chamber of Commerce (KvK) number 42039112, VAT number NL005448587B73. Questions and requests go to info@nodes-ip.com.
2. Content in your matters
Matter content covers invention disclosures, claims, drafts, figures, uploaded files, parties and AI assistant conversations. The customer that holds the account is the controller of that content, and Nodes-IP processes it only on the customer’s instructions, under the Data Processing Agreement. If your firm or employer holds the account, send requests about matter content to them.
3. Data collected and why
Each category lists the data, its purpose, the legal basis under Article 6(1) GDPR and how long it is kept.
Account
- Data
- Name, email address, profile picture, the Google or Microsoft account you sign in with, one-time sign-in codes, your settings, and when you last signed in and were active.
- Purpose
- Creating your account, signing you in and applying your settings.
- Legal basis
- Performance of the contract with you (Article 6(1)(b)).
- Kept
- Until you delete your account. Sign-in codes expire after 10 minutes.
Subscription and invoices
- Data
- Your plan and its status. For paid plans, the billing name and address and the amounts invoiced.
- Purpose
- Providing the plan you chose and keeping the accounts.
- Legal basis
- Performance of the contract (Article 6(1)(b)) and the legal obligation to keep invoices (Article 6(1)(c)).
- Kept
- Plan details until you delete your account. Invoices for seven years, as Dutch tax law requires.
AI usage
- Data
- Which AI features you used, when, in which matter, and the tokens and cost of each request.
- Purpose
- Applying your daily AI allowance and showing you your usage.
- Legal basis
- Performance of the contract (Article 6(1)(b)).
- Kept
- Until you delete your account.
Access log
- Data
- Each sign-in and each read or change of matter content, with who, when, which matter, the outcome, IP address and browser. Never the content itself.
- Purpose
- Detecting misuse, and showing customers who accessed their matters.
- Legal basis
- Legitimate interests in securing the service and accounting for access to confidential matters (Article 6(1)(f)).
- Kept
- As long as legal obligations require, including after your account is deleted, so that a deletion can be re-applied if a backup is ever restored.
Logs and error reports
- Data
- Request identifiers, the pages requested and error details. When a rate limit is reached, the IP address. Never matter content.
- Purpose
- Keeping the service running and secure.
- Legal basis
- Legitimate interests in a working, secure service (Article 6(1)(f)).
- Kept
- 30 days.
Contact and demo requests
- Data
- Your name, email address and message.
- Purpose
- Answering your question or arranging the demo you asked for.
- Legal basis
- Steps you request before a contract (Article 6(1)(b)), or legitimate interests in answering you (Article 6(1)(f)).
- Kept
- Until the conversation has ended.
4. Who receives your data
Nodes-IP does not sell personal data or use it for advertising. It shares data with the providers that run the service (hosting, file storage, AI models, email delivery and sign-in), each listed with its purpose and location at /legal/sub-processors, and with authorities where the law requires it. AI providers receive only what a request needs, under terms that exclude training their models on it. If you sign in with Google or Microsoft, that provider also handles the sign-in under its own privacy policy.
The service and its databases run in the EU. Some providers operate in the United States. Transfers to them rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses. A copy of the safeguards is available on request.
5. Deleting your data
Deleting a matter or your account removes its data from live systems immediately and from every backup and log within 30 days. The access log and invoices are kept for the periods in section 3.
6. Your rights
You can access, correct, delete or receive a copy of your personal data, restrict how it is processed, and object to processing based on legitimate interests. Settings, under Data and privacy, lets you export everything on your account as one file, and delete the account, yourself. For any other request, email info@nodes-ip.com. Nodes-IP answers within one month.
If you believe your data is handled unlawfully, you can complain to the data protection authority where you live or work. The European Data Protection Board keeps the list of authorities.
Account data is needed to provide the service, so an account cannot be created without it. Nodes-IP makes no decisions about you based solely on automated processing.
8. Changes to this policy
The date at the top shows the latest revision. Material changes are announced to account holders by email.