Privacy policy
What Nodox collects when you run briefs, who processes it, how long it is kept, and what you can ask us to delete.
Introduction
Nodox.ai ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and services at nodox.ai.
Who controls your data and why
Nodox, operated by DigiTool Tech, is the data controller for everything described in this policy. For any question about your data, write to hi@nodox.ai.
Lawful bases
We process your data on three bases under the GDPR:
- Contract: running your account, grading your attempts, taking payment, and the service emails that go with them
- Legitimate interest: keeping the service secure, rate limiting, preventing fraud and abuse, and measuring product usage
- Consent: cookies, the analytics identifier that depends on them, and marketing email. You can withdraw consent at any time without losing access to the service.
Where your data is held
The platform runs in the European Union: the database and authentication on Supabase in eu-central-1, the app and its API routes on Vercel in fra1, and product analytics on PostHog EU. Payments, transactional email and AI review are handled by the providers listed under data sharing, some of which process data outside the EU under the transfer safeguards in their own data processing terms.
Information we collect
Account information
When you create an account, we collect your email address and display name. If you subscribe to Pro, we also process payment information through our payment processor (Stripe).
Usage data
We collect information about how you use our platform, including:
- Challenge attempts and completion status
- Quiz scores and progress
- Learning track progress
- Session duration and page views
- Feature usage patterns
Technical data
We automatically collect certain technical information:
- Browser type and version
- Device type (desktop, mobile, tablet)
- Operating system
- IP address (for security and rate limiting)
- Referral source and UTM parameters
How we use your information
We use collected information to:
- Provide and maintain our services
- Track your learning progress and achievements
- Process payments and manage subscriptions
- Send important service notifications
- Improve our platform and develop new features
- Detect and prevent fraud or abuse
- Comply with legal obligations
Data sharing
We do not sell your personal information. We may share data with:
- Service providers: Supabase (database and authentication, EU hosted), Vercel (hosting, EU region), PostHog (product analytics, EU hosted), Stripe (payments), Resend (transactional email)
- Anthropic: when you ask Nox to debug or audit a workflow, the workflow JSON you submit and the brief it belongs to are sent to Anthropic's API for the review. Under Anthropic's API terms that content is not used to train their models. We store the workflow JSON with the review for as long as your account exists.
- Our own automation: the newsletter form in the footer and in-app feedback post to an n8n instance we run at n8n.digitooltech.com, which stores the email address and message you send
- Legal requirements: When required by law or to protect our rights
- Business transfers: In connection with a merger, acquisition, or sale of assets
Data security
We implement appropriate security measures to protect your data, including:
- Encryption in transit (HTTPS/TLS)
- Secure database with row-level security policies
- Regular security audits and updates
- Limited access to personal data
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your account and personal data erased
- Receive your data in a portable, machine-readable format
- Object to processing we base on legitimate interest
- Withdraw consent for cookies and marketing email at any time
- Complain to your national data protection supervisory authority
There is no self-serve button for deletion or export. Email hi@nodox.ai from the address on your account, say which you want, and we complete it within 30 days.
Withdrawing cookie consent needs no email: use the cookie preferences link in the footer of any page.
Data retention
We keep your account, attempts, runs and progress for as long as the account exists, because that work record is the service.
That includes the request and response bodies of your workflow's calls to the mock APIs, the workflow exports you upload to Nox, and the sandbox credentials issued for a run. None of it is deleted on a schedule while the account exists.
When you ask us to delete your account, the account and everything keyed to it is erased: attempts, runs, mock-API call logs, Nox reviews, progress, XP, certificates and your work record.
Two things outlive that. Payment records stay with Stripe and with us for as long as tax and accounting law requires them. Product analytics events are retained by PostHog under its own retention schedule, and are no longer linked to you once your account is gone.
Children's privacy
Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.
Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website or sending you an email.
Contact us
If you have questions about this Privacy Policy or our data practices, contact us at hi@nodox.ai