Privacy notice

The controller of your personal data is Taras Shemetovskyi. For anything about your data, write to hello@nodeplan.pro.

Visiting the site (statistics — only with your consent)

Without your consent we don't turn on analytics or set analytics cookies. If you agree in the banner, Google Analytics 4 (via Google Tag Manager) collects:

• which pages were opened, where you came from (the previous page's address, UTM tags in the link) and when;
• browser, operating system and device type, screen size and language;
• approximate location (country, region, city), which Google derives from the IP address; Google Analytics 4 does not store IP addresses;
• actions on the page, such as button clicks or sending the form — without anything you type into the fields;
• a random browser identifier in a cookie, to tell repeat visits apart.

We don't link statistics to accounts or access requests, turn on no advertising features and don't profile. The app (after sign-in) collects no statistics.

The “Request access” form

• your name;
• email address;
• company — if you provide it;
• a message about what you want to build — if you write one;
• the interface language the form was sent in, and the time you gave consent.

The app (once you have access)

• your account email and name;
• a password hash (argon2id) — we never store the password itself;
• a session cookie that keeps you signed in;
• the content of your projects — such as graph items, descriptions, comments and change history.

• Answering your access request and sending an invitation — based on your consent (Art. 6(1)(a) GDPR) and to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR). This includes the notification e-mail about a new request that the server sends to us (see §5).
• Visit statistics of the site (Google Analytics) — based on your consent (Art. 6(1)(a) GDPR and the rules on access to terminal equipment: in Poland, Prawo komunikacji elektronicznej). You can withdraw it any time: “Cookie settings” in the site footer; this does not affect processing before the withdrawal.
• Running your account and providing the app you use — Art. 6(1)(b) GDPR.

• Access requests — until access is granted, and no longer than 12 months. Declined requests are deleted within 90 days.
• Google Analytics statistics — 14 months; the _ga cookies — up to 2 years or until you withdraw consent.
• Account data and project content — for as long as you use your account. You can delete your account at any time in its settings.

• The hosting provider of the server NodePlan runs on — it processes data on our behalf.
• Google Ireland Limited (Dublin, Ireland) — provider of Google Analytics and Google Tag Manager, only if you agreed to statistics; it processes data on our behalf. Data may be transferred to Google LLC in the USA — under the EU-U.S. Data Privacy Framework (Google LLC is certified) and standard contractual clauses.
• Resend (Plus Five Five, Inc., San Francisco, USA) — the e-mail service through which the NodePlan server sends us a notification about a new access request (name, email, company, message, language). Resend processes this data on our behalf in the USA; the transfer relies on the European Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework.
• AI model providers — OpenRouter and Groq (both USA) — only when you run an AI feature yourself, and only to the extent that feature needs (such as the project content sent with the request). Requests are sent by the NodePlan server under its own account — your account details are not passed to the provider. OpenRouter forwards the request to the provider of the selected model. The data is processed outside the European Economic Area; some model providers may store requests and use them to improve their models.

Without your consent we set no analytics or marketing cookies and don't load Google Tag Manager. If you agree to statistics, Google Analytics sets the _ga and _ga_<id> cookies (up to 2 years). Your banner choice, interface language and theme are remembered in your browser's storage (localStorage). After you sign in we set one strictly necessary session cookie. You can change or withdraw your consent any time: “Cookie settings” in the site footer.

You have the right to:

• access your data;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• object to processing;
• withdraw your consent at any time — this does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, write to hello@nodeplan.pro.

You can also lodge a complaint with the Polish supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Providing data is voluntary, but without your name, email and consent we can't answer your access request. We make no decisions based solely on automated processing and do no profiling.

If we change this notice, we'll update the version date at the top of this page.