Last updated: 9 November 2026
This policy covers the website nodebrush.com and the Nodebrush app at app.nodebrush.com.
Data Controller
Nodebrush AB is the data controller for personal data collected through this website and through the app. Our address and organization number are on the legal page. When the app hosts a client's website, the client is the data controller for that website's visitors, and we process their data on the client's behalf. For questions about your personal data, or to exercise any of the rights described below, contact support@nodebrush.com.
Hosting and Processors
Our servers, databases and backups are in the EU, and that is where our services store personal data. We share personal data only with providers that process it on our behalf. They provide hosting, email delivery, backups, electronic signing of agreements, our bookkeeping and the other services we use to run our business. The processors that handle data for our clients are listed on our sub-processors page.
AI Tools
The AI tools we use in our work come from Anthropic. We send Anthropic only what a task needs. Anthropic uses it for that task alone, never trains AI models on it and does not store it. None of our services or their data are hosted at Anthropic.
Anthropic is in the US, so the transfer is made under the EU Standard Contractual Clauses (GDPR Article 46(2)(c)), which are part of Anthropic's Data Processing Addendum.
Security Log
Requests to this website and to the other websites we host are logged with the IP address they come from, and the log is kept for at most eight days, to detect and stop attacks and misuse. The legal basis is our legitimate interest in keeping our services secure.
Website
Analytics
We run our own analytics to understand how this website is used and to improve it. It does not store your IP address and does not identify individual visitors.
The legal basis is our legitimate interest in understanding and improving our website. Analytics data is kept for 25 months.
Contact Form
When you send a message through the contact form, we use what you enter, and any files you attach, to answer your inquiry. To keep spam out, we also check technical details of the connection when the form is sent. The legal basis for both is our legitimate interest in answering inquiries and keeping spam out. Providing the information is voluntary, but we cannot answer without it.
The message is delivered to us by email and stored in our website database, where it is deleted after 25 months, or sooner if you ask us to. The connection details are kept with it and deleted with it. The email stays in our mailbox with the rest of our correspondence with you, and is deleted if you ask us to.
If you contacted us on behalf of a company and we later want to write to it, we first look for earlier contact in our messages and note only the date of the latest on our record of that company. The record is deleted 30 days after it was made if we do not write, and 12 months after the last email or reply if we do. The legal basis is our legitimate interest in not writing to a company we have already been in touch with as if it were a stranger, and in deciding how, or whether, to write to it.
Clients
When your organization is our client, we use the names and contact details of the people we deal with there to provide our services, to send quotes, agreements and invoices, and to keep our accounts. When an agreement is accepted in the app, we also keep who accepted it, when and from which IP address, as proof of the agreement. The legal basis is the agreement with your organization and our legitimate interest in managing it, and for accounting records our legal obligation under the Swedish Bookkeeping Act. Accounting records are kept for as long as that Act requires, agreements and their proof for as long as a claim under them can be made, and other data while the agreement lasts.
When we write to a company that is not yet our client, what we keep about the people there is described on the NodebrushBot page.
App
Accounts
To give you access to the app we store your account details, such as your name and email address, and the details you choose to add to your profile. We also process how you use the app, to provide it. For each sign-in we record who signed in, when and from which IP address, to keep the app secure.
The legal basis is the agreement with you or your organization and our legitimate interest in providing the app under it. For sign-in records, the legal basis is our legitimate interest in keeping the app secure. Account details are kept while that agreement lasts and deleted after it ends. Records of how the app is used are kept for at most 25 months, and sign-in records for at most 12 months.
Google and Microsoft
Some functions of the app read from and write to an account at Google or Microsoft, once someone with access to that account has connected it. These accounts belong to you or your organization, so Google and Microsoft are not our processors.
- Google figures. With the read access you give, the app reads figures about your website and your business from Google, such as search, visitor, advertising and Business Profile figures, and stores them to show in your reports.
- Mailbox. When you connect a mailbox at Google or Microsoft, the app sends an email from it only when you choose to send it. It reads new messages to find the answers to emails sent from the app, and stores only those answers. Before an email goes to a company, the app also looks in the mailbox for earlier mail with that company. It reads only the sender, the recipients and the date, and stores only the date of the latest such mail and whether it came in or went out. Every other message is left as it is, and nothing from it is stored.
- Calendar. When you connect a calendar at Google or Microsoft for bookings, the app reads only when it is busy, and adds each booking to it with the name, the number of people, the guest's note and the answers to any booking questions.
Data from these accounts is used only to provide these functions to you and to prepare and explain your reports. It is shown only to the users of your project. We read it only when you ask us to, or when it is needed for security or required by law. It is sent to the AI tools we use only when you ask us for help that needs it, such as explaining a report or answering an email. It is never sold, never used for advertising and never used to train AI models. Nodebrush's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The legal basis is the agreement with you or your organization, and the data is kept while that agreement lasts and deleted after it ends. You can withdraw access at any time by revoking it in your Google or Microsoft account or by disconnecting the account in the app, and reading stops at once.
Backups
Deleted data can remain in our encrypted backups until they expire, at most three years later, and is not used in that time.
Your Rights
Under the GDPR you have the right to access your personal data and to have it rectified or erased, to restrict its processing and to data portability.
We make no decisions about you based solely on automated processing.
To exercise your rights, contact support@nodebrush.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), or with the data protection authority in the country where you live or work.
Right to Object
You have the right to object at any time to processing based on our legitimate interest, by writing to support@nodebrush.com.
