Nodespell Privacy Notice

Effective date: 3 August 2026

Last updated: 3 August 2026

1. Who we are

Nodespell is operated by Niutron Creative Limited, a company registered in England and Wales under company number 13610851, with its registered office at 27 Hindsleys Place, Forest Hill, London, England, SE23 2NF.

Niutron Creative Limited is the controller of the personal information described in this Privacy Notice when it decides why and how that information is used. In some business or organisation Workspaces, we may instead process Content on a customer’s instructions. Any such processor relationship should be covered by the relevant business agreement and data processing addendum.

Questions or requests may be sent to info@nodespell.com.

2. Scope

This Privacy Notice explains how we collect, use, disclose, retain, and protect personal information when you:

• visit a Nodespell website;
• create or use a Nodespell account;
• build, run, store, share, or publish creative workflows;
• provide prompts, source media, or other Content;
• generate or edit images, video, audio, text, or other material;
• join or administer a Workspace;
• buy a plan or credits;
• contact support or report Content; or
• otherwise interact with the Nodespell Service.

It should be read with the Nodespell Terms and Conditions, the Cookie and Tracking Notice, and any just-in-time notice shown for a particular feature.

This Notice does not govern an independent third-party service you choose to use outside Nodespell.

Nodespell may be accessed internationally except where access is legally prohibited or the Service is operationally unsupported. Making the Service accessible from a country does not mean that we maintain an establishment there or actively target every jurisdiction.

Terminology

Capitalised terms including Content, Input, Prompt, Output, Generation Bundle, Training Assets, Custom Training, Custom Model, Workspace, and Eligible Free Generation have the meanings given in the Terms.

“Personal information” in this Notice includes “personal data” where that term is used by applicable data-protection law. It does not include information that has been irreversibly anonymised so that no person is identifiable.

3. Personal information we collect

The information we collect depends on how you use Nodespell.

3.1 Account, identity, and profile information

This may include:

• name and email address;
• account and internal user identifiers;
• password authentication data or information returned by a sign-in provider;
• email-verification, session, and multi-factor-authentication state;
• avatar, display name, creator-profile slug, biography, general location, social links, and profile privacy settings;
• account tags, preferences, feature access, and plan; and
• 18+ eligibility confirmation recorded at account creation.

We do not need or receive your plaintext password where authentication is handled using secure password-verification methods or an external sign-in provider.

3.2 Workspace and collaboration information

This may include:

• personal, Team, Studio, or organisation Workspace identifiers;
• membership, invitation, role, and permission information;
• Workspace ownership and administration records;
• collaborator activity, comments, operations, and change history; and
• project-sharing and publication settings.

3.3 Content and generation information

This may include:

• project and workflow graphs;
• node types, settings, connections, and execution data;
• Prompts and instructions;
• source images, video, audio, voice, text, files, and other Inputs;
• generated or edited Outputs;
• Training Assets, training captions or labels, Custom Models such as private LoRAs, and their access or sharing settings if Custom Training is introduced;
• task history, results, errors, timing, and model settings;
• saved assets, folders, tags, snapshots, and versions;
• Generation Bundle relationships and provenance records;
• publication, showcase, and public-profile Content; and
• metadata such as file type, size, timestamps, resolution, duration, and upload or generation identifiers.

Content may contain personal information about you or another person. Depending on what you provide, it could include a face, voice, location, opinion, or sensitive information. You must have an appropriate right and lawful basis before providing another person’s information.

3.4 Billing and transaction information

This may include:

• Stripe customer and subscription identifiers;
• plan, billing interval, seat quantity, and subscription status;
• purchase, invoice, refund, dispute, and chargeback records;
• credit grants, balances, consumption, and adjustments;
• billing country, tax status, and transaction currency; and
• limited payment-method information returned by Stripe, such as card brand and last four digits, where displayed.

Stripe processes full payment-card details. Nodespell does not receive your full card number.

3.5 Communications and reports

This may include:

• support messages, feedback, and survey responses;
• service, security, billing, and policy communications;
• marketing preferences;
• Content reports, complaints, appeals, and takedown requests;
• information showing your rights or authority to make a request; and
• records of our investigation and response.

3.6 Device, usage, and technical information

This may include:

• IP address and approximate location derived from it;
• browser, device, operating system, language, and time zone;
• session, request, network, and security information;
• pages, product surfaces, and features used;
• structured facts about product actions, such as the kind of action, where or how it was performed, whether it succeeded, timing, counts, and bounded status or reason categories;
• internal or pseudonymous account, Workspace, project, task, workflow, model-category, and event identifiers needed to relate those facts to the Service;
• referral source, campaign parameters, and landing-page attribution;
• cookie, local-storage, telemetry-consent, and similar identifiers; and
• application release and environment information.

These are categories rather than a fixed event list. We may refine the particular events and fields as the Service changes, while keeping them proportionate to the stated purposes and updating this Notice before any materially different processing begins.

Structured product-interaction facts are Usage Data, not the creative Content itself. For example, Nodespell may record that a prompt parameter was changed through a particular editor surface without recording the prompt text or the edit. Ordinary product telemetry is not designed to collect Prompts, Inputs, Outputs, typed text or edit history, keystrokes, clipboard contents, message bodies, filenames or media, credentials, payment details, or full URLs containing query data.

Some user-requested features also keep information on your device, such as interface preferences, recent items, local editor or agent history, unsent creation drafts, checkout continuity, and referral or content-attribution data. A local copy is controlled through your browser as well as the relevant in-product controls.

3.7 Safety, security, and compliance information

This may include:

• authentication, access, audit, and security events;
• suspected fraud, abuse, or policy violations;
• Content and context relevant to a support request, report, rights claim, or incident;
• moderation or enforcement decisions;
• narrowly scoped evidence and legal-hold records where authorised; and
• correspondence with rights-holders, advisers, regulators, courts, or law enforcement.

4. Where information comes from

We collect personal information:

• directly from you when you register, upload Content, run a workflow, buy a plan, change settings, communicate, or make a report;
• from collaborators, Workspace Administrators, or organisations that invite you or manage a Workspace;
• automatically from your device and your use of the Service;
• from payment, sign-in, email, infrastructure, monitoring, AI, and other service providers;
• from another user who includes information about you in Content or a report;
• from public sources where reasonably necessary to investigate a rights or safety issue; and
• from advisers, regulators, courts, law enforcement, or counterparties where permitted by law.

If you do not provide information required for an account, generation, purchase, or security check, we may be unable to provide that part of the Service.

5. How and why we use personal information

The table below describes our purposes and UK lawful bases. The correct basis depends on the context. We document the basis before processing and do not rely on consent where you have no genuine choice.

Where we rely on legitimate interests, we assess whether the use is necessary and proportionate and whether your rights override our interests. You may request information about that assessment or object as explained below.

Sensitive and criminal-offence information

Nodespell does not require you to submit special-category or criminal-offence information for ordinary use. However, Content, a likeness or voice, or a safety report may incidentally reveal such information.

For ordinary user-directed creation, we process Content to provide the feature you request. We do not use faces, voices, or other Content to identify you biometrically or infer sensitive characteristics about you for advertising, eligibility, or profiling.

If a feature intentionally requires special-category information from you and no other condition applies, we will obtain a separate explicit confirmation that identifies the information and purpose. If information concerns another person, your contractual rights warranty is not itself our legal basis. We must identify our own applicable condition before intentionally using that information for a separate purpose.

We will not select a free promotional example containing intimate, child-related, identifying biometric, confidential, or similarly high-risk personal information unless a heightened review identifies a documented lawful basis and any explicit consent or other authorisation required from each affected person. We may process information necessary for legal claims, vital interests, or a substantial-public-interest purpose only where the applicable legal condition and safeguards are documented.

6. AI models and third-party processing

When you run an AI node or feature, we may send the Input, Prompt, parameters, and other data needed for the run to the provider route used to fulfil it. A route may involve a fallback provider if an earlier provider cannot complete the run. The provider returns the Output or status information to Nodespell.

Different models may involve different:

• providers and processing locations;
• input and output types;
• retention periods;
• safety filters;
• provider uses of request data;
• commercial-use rights; and
• model-specific restrictions.

We will maintain a public provider and subprocessor list identifying, as applicable, the provider, service purpose, information processed, role, principal processing location, and relevant retention or model-specific difference. The list will be updated before a new provider processes personal information.

For a material new subprocessor of private business Workspace Content, business customers who subscribe to change notices will normally receive at least 15 days’ advance notice. An urgent security, legal, or service-continuity change may use a shorter period, with notice as soon as reasonably practicable. Any enterprise objection or termination right is governed by the applicable data processing addendum.

Model training and improvement

Nodespell does not use Inputs, Prompts, or Outputs to train or fine-tune its own generative AI models merely because a person uses the Service, shares Content, or grants the Free Generation Licence. The Free Generation Licence permits only the selected example and promotional uses stated in the Terms; it does not permit AI training or fine-tuning.

We may use feedback, product events, performance information, errors, and aggregated or de-identified usage information to operate, secure, analyse, and improve the Service. This is different from training or fine-tuning a generative AI model on your Content.

An AI provider may have different data-use terms for a particular model or route. A provider that processes Content only to supply the requested service normally acts as our processor or subprocessor. If a provider is permitted to use Content for its own model training or another independent purpose, its role, purpose, terms, retention, and relevant privacy information must be identified before the affected model is used.

Where that information says that a provider may train on or otherwise use submitted Content for its own models or products, you may choose whether to use that model or route. We will prefer a no-training route where one is reasonably available, but we do not promise that every model has the same provider terms.

If Nodespell later proposes to use user Content to train or fine-tune a generative AI model, we will update the Terms and this Privacy Notice before that processing begins. We will explain the affected Content, provider or model, purpose, lawful basis, retention, and available choices, and obtain a new agreement or consent where required. We will not treat prior silence or a general service licence as permission for a materially different training use.

User-requested Custom Training (if offered)

If Nodespell introduces Custom Training, we will process Training Assets, training captions or labels, settings, task records, and the resulting private LoRA or other Custom Model because you or your Workspace customer asked us to provide that feature. This is separate from Nodespell training its own generally available AI models.

Custom Models will be private by default and available for use only to their creator, authorised members of the Workspace in which they are stored, and people with whom an authorised user deliberately shares them. Nodespell personnel and service providers may access or process the information only as reasonably necessary to provide, secure, support, or comply with law in relation to the feature.

Before Custom Training begins, we will identify the training provider, purpose, relevant processing location, retention, base-model or provider restrictions, and available sharing controls. The Custom Training provider must not use Training Assets or Custom Models to train its own generally available models.

Training Assets and Custom Models will follow the applicable Workspace deletion and retention rules, subject to backups, legal obligations, and narrowly authorised safety or legal holds described in this Notice.

7. When we disclose information

We may disclose personal information to:

• AI model and inference providers that process the data required for your selected generation;
• cloud hosting, database, object-storage, content-delivery, and infrastructure providers;
• authentication, email, and communication providers;
• Stripe and related payment, tax, fraud, and billing providers;
• support, error-monitoring, logging, security, and incident-response providers;
• analytics and session-replay providers used for the relevant server-side or consent-controlled browser processing described in section 11;
• Workspace members and Administrators according to roles and settings;
• people you choose to share with, or the public when you publish Content;
• the public and distribution channels for a selected Generation Bundle under the Free Generation Licence;
• professional advisers, auditors, insurers, and financing sources under appropriate duties;
• regulators, courts, law enforcement, emergency services, and rights-holders where disclosure is required or permitted and proportionate; and
• a buyer, investor, successor, or restructuring party in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and data-protection measures.

We do not sell personal information or use it for cross-context behavioural advertising. If that business model changes, we will update this Notice before the new processing begins and provide any consent, opt-out, or browser-signal treatment required by law.

8. Workspaces and public Content

Your personal Workspace is separate from Team, Studio, and organisation Workspaces. Joining an organisation-managed Workspace, or using a work email address, does not by itself let that organisation see your personal Workspace or transfer your personal account to it.

Workspace members can see personal information and Content made available to them through their role, the Content’s visibility, and the Workspace settings. Workspace owners or Administrators may control membership, permissions, billing, settings, and shared Workspace Content and activity. Some Content may remain private to its creator where the product provides a private visibility setting.

If you leave or are removed from a Team, Studio, or organisation Workspace, your future access ends. Content and associated creator or uploader attribution that you placed in that Workspace remain with the Workspace unless an authorised person deletes or transfers them using the available controls. Your personal Workspace is unaffected. Copies already downloaded or exported by others may remain outside our control.

For organisation-managed Workspaces, the organisation may be a separate controller of your personal information and Nodespell may process Workspace information on its instructions. Ask its Administrator about the organisation’s own privacy practices and requests concerning organisation-controlled information. We may direct such a request to the organisation or assist it as its processor.

Content becomes accessible to others when you share it, add collaborators, use a public link, publish to a public profile or gallery, or make an Eligible Free Generation that Nodespell later selects.

Public Content may be indexed, copied, downloaded, screen-captured, reposted, or retained by people and services outside our control. Removing the Nodespell copy may not remove third-party copies or search caches.

9. Eligible Free Generations

Content created in a free context is not automatically public and is not published in bulk. A generation is eligible only when the Service clearly identifies it as an Eligible Free Generation and records your acceptance of the Free Generation Licence.

Immediately before or beside every eligible Generate, Run, rerun, or variation action, we will state that:

• the creation is not private;
• publication is not automatic and most creations are not selected;
• Nodespell may select and publish the complete Input, Prompt/instructions, and Output together as a model example or in Nodespell promotional, marketing, or sales materials; and
• a paid/private plan is available.

We record the accepted terms version, time, user, Workspace and plan context, the applicable generation, and the associated bundle. Paid, Team, Studio, organisation-owned, collaborator-owned, and otherwise designated private generations are excluded. We do not make older generations retroactively eligible.

We may first select an eligible bundle only during the 12 months after generation. Selection may be followed by immediate publication once the internal rights and safety review is approved. There is no voluntary preference opt-out or pre-publication waiting period.

Upgrading later does not retract the licence or an existing example. Each materially new later use requires a fresh internal review of rights, safety, attribution, context, confidentiality, likeness/privacy, and endorsement risk.

Copyright, privacy, likeness/voice, non-consensual intimate imagery, unlawful-content, data-protection, and other legally required complaint, objection, or takedown rights remain available.

If you delete your account before an eligible bundle is selected, we will not newly select it after account closure. A bundle already selected or published may remain available and may be reused for the in-scope Nodespell purposes in the Terms without a fixed expiry. We will remove or anonymise public account attribution where reasonably practicable unless attribution remains necessary, legally required, or separately agreed. A limited internal licence, provenance, review, publication, reuse, and complaint record may be kept while the example remains in use and for six years after its final retirement or removal.

10. Safety, reports, and review of Content

We may access and review Content where reasonably necessary to:

• provide support you request;
• investigate a Content report, rights claim, payment dispute, security event, or suspected breach;
• prevent fraud, abuse, or harm;
• enforce the Terms;
• respond to an incident; or
• comply with law and valid legal process.

Review may involve an authorised member of staff. Access must be purpose-limited, role-restricted, and logged where appropriate.

The contractual content rules do not mean that we examine every Input, Prompt, or Output. At present, review is generally reactive — for example, after a report, support request, security event, or credible suspicion of a serious breach.

We do not currently use general automated content-safety scanning, sensitive-content detection, or automatic safety-evidence holds.

If we plan to introduce materially new automated safety screening, risk scoring, sensitive-content detection, or preservation, we will before activation:

• update this Notice with the data, purpose, lawful basis, recipients, transfers, retention, and rights involved;
• bring the change to affected users’ attention using an appropriate in-product or email notice;
• complete a data-protection impact assessment where required;
• define access controls, audit logging, human oversight, complaint and appeal routes, and retention;
• assess any significant automated decision-making; and
• obtain consent or renewed agreement where law or the nature of the change requires it.

We may preserve narrowly scoped information for an authorised complaint, investigation, legal claim, or legal obligation. We do not keep Content indefinitely merely because it could theoretically become useful.

11. Product analytics, cookies, and similar technologies

Nodespell uses or may use cookies, local storage, session storage, IndexedDB, SDKs, pixels, or similar technologies in the following categories:

• Strictly necessary: sign-in, session security, fraud prevention, checkout continuity, and a choice or feature you request;
• Functional: interface preferences, local drafts, local history, recent items, and other settings that make the requested feature work as you chose;
• Analytics: audience measurement, product interactions, aggregated heatmaps, performance, workflow or Content engagement, and improvement; and
• Attribution or marketing: referral, campaign, conversion, or promotional effectiveness.

We explain each technology, provider, purpose, first- or third-party status, and duration in our current Cookie and Tracking Notice.

Nodespell separates three kinds of collection:

1. Required service records. Authentication, security, fraud prevention, billing, credits, workflow execution, availability, error, and reliability records are processed as needed to provide and protect the Service. They do not stop when browser analytics is rejected.
2. Server-side product Usage Data. We may by default record narrow, structured facts about how authenticated product functions are used. These may include a feature, surface or method category, a committed action and its outcome, timing, counts, and internal or pseudonymous identifiers. We use this information under legitimate interests to diagnose problems, understand friction, and improve the Service. It does not include the Prompt, Input, Output, or other creative Content merely because the action concerns Content. You may object as explained in section 15.
3. Browser analytics, attribution, heatmaps, and Session Replay. Persistent anonymous browser identity, browser-side product events, aggregated heatmaps of clicks, pointer movement, and scrolling, linking pre-account browsing to a later account, campaign or conversion attribution, and Session Replay are controlled by the browser analytics choice where consent is required. These technologies do not start before a clear affirmative choice, rejection is as easy as acceptance, and the choice can later be changed.

Rejecting browser analytics stops the relevant browser SDK events, heatmaps, persistent anonymous analytics identifiers, anonymous-to-account analytics linking, attribution, and Session Replay. It does not stop required service records or server-side Usage Data processed under legitimate interests. A browser preference is also not the same as a legal objection to legitimate-interests processing; a person may make that objection by contacting info@nodespell.com.

We may use the UK statistical-purpose or appearance exception without consent only where its exact requirements are met. This means, among other things, that statistical processing produces aggregate results rather than tracking people, individual-level data is not retained after aggregation, a third party acts only for that purpose, clear information is provided, and a simple free objection is available.

Strictly necessary storage does not require consent, but it is still disclosed. A functional preference may rely on a legal exception only where it is limited to the requested appearance or functionality and a simple objection is available where required.

IP addresses may be processed in ordinary network, security, fraud-prevention, and diagnostic logs. If you accept browser analytics, the analytics provider may also process the connection IP to derive an approximate country or region. Nodespell does not intentionally add a raw IP address as a custom analytics event property or use IP addresses to reconstruct browser activity after browser analytics has been rejected.

Session Replay can reconstruct navigation, clicks, scrolling, and the displayed interface. It is therefore consent-controlled even where ordinary server-side Usage Data is not. Ordinary fixed interface labels and non-sensitive literal numeric node or model settings may be visible so that we can understand navigation and product friction. Where the separately gated graph-canvas setting is enabled, Replay may also show graph layout, displayed node names, borders, connections, sockets, and state indicators. Content-bearing node bodies, visualizers, previews, waveforms, Prompts, Inputs, Outputs, and other media pixels are painted black in the browser before a frame is encoded; unreviewed canvases and frames without valid masking geometry are skipped. We configure targeted exclusions for other form values, account-specific text, passwords, payment data, and other Content or sensitive fields not needed for product analysis. We do not use ordinary telemetry or Replay to capture keystrokes, clipboard contents, or hidden credentials.

Our core Notice describes providers by meaningful category so it remains accurate if a processor changes. Nodespell’s browser-consent component is self-hosted and does not send consent data to its software author. The maintained cookie and provider list will name the analytics and Session Replay provider actually in use — including PostHog Cloud EU if that is the launch configuration — and state its purpose, role, principal processing region, and retention. Relevant settings or just-in-time choices may also name the active provider.

Event-level server-side Usage Data and consent-controlled browser analytics are retained for no more than 12 months. Session Replay recordings are retained for no more than 90 days. Aggregated or irreversibly anonymised statistics may be kept longer.

12. International transfers

Nodespell is based in the United Kingdom. Some providers may process personal information in other countries.

Where UK transfer rules apply, we use an approved transfer mechanism or another lawful route, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses; or
• a lawful exception for a specific and necessary transfer.

Where required, we complete a transfer-risk assessment and apply supplementary safeguards. We do not treat use of the Service as blanket consent to international transfers.

You may contact info@nodespell.com for more information about an applicable transfer safeguard.

13. How long we keep information

We keep personal information only for as long as reasonably necessary for the stated purpose, including providing the Service, meeting legal obligations, resolving disputes, enforcing agreements, and protecting rights and security.

Our normal retention framework is:

If one record belongs to several categories, the longest justified period may apply. A legal or safety hold may pause ordinary deletion only for information reasonably relevant to a live complaint, investigation, legal duty, or claim. Access is limited to authorised people, the hold lasts only for as long as reasonably justified, and the normal deletion schedule resumes when its purpose ends.

We may keep information that has been irreversibly anonymised because it is no longer personal information.

14. Account deletion

You may request deletion through the available account settings or by emailing info@nodespell.com. Before proceeding, we will give you a clear final confirmation, remind you to export anything you want to keep, and may take reasonable steps to confirm that you control the account. We do not ordinarily require identity documents.

After we confirm the request, we will promptly stop account access and future subscription renewal and begin processing the deletion. Account deletion does not create an ordinary refund for an unused paid period, although mandatory consumer rights continue to apply.

We then delete or anonymise personal information and Content from active systems, except for limited information we must or are permitted to retain for:

• tax, accounting, payment, fraud, or chargeback records;
• a legal obligation or valid legal process;
• an authorised, narrowly scoped legal or safety hold;
• establishing, exercising, or defending a legal claim;
• enforcing rights and preventing repeat abuse;
• Workspace Content controlled by another customer; or
• public Content, third-party copies, and selected examples to the extent the final policy lawfully permits.

Our target is to complete active-system deletion or anonymisation within 30 days after the confirmed request. Manual processing may be used.

Information in ordinary rolling backups is not available for routine use and is deleted as those backups expire under our normal schedule. Provider-held copies follow the applicable provider- and model-specific period.

Content controlled by another customer’s Team, Studio, or organisation Workspace remains with that customer. Your access ends, and creator or uploader attribution is removed or replaced with a neutral label where reasonably practicable, while minimum audit and provenance records may remain. A sole owner must transfer a shared Workspace or arrange for its closure before final account deletion.

An unselected Eligible Free Generation cannot be newly selected after account closure. An already-selected or published example may remain as explained in section 9, subject to applicable rights and takedowns.

15. Your privacy rights

Depending on the law that applies, you may have the right to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how information is used;
• receive information you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• withdraw consent at any time, without affecting earlier lawful processing;
• ask for safeguards relating to an international transfer;
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect, subject to applicable exceptions; and
• complain to a data-protection regulator.

These rights are not absolute. For example, we may need to retain limited information to comply with law, protect another person’s rights, or establish or defend a claim.

To make a request, email info@nodespell.com. Describe the account and request clearly. We may ask for proportionate information to verify your identity or authority. We will respond within the period required by applicable law.

If you object to server-side product-improvement Usage Data processed under legitimate interests, tell us that in your request. This is separate from rejecting or withdrawing browser analytics consent. We will stop or restrict the objected-to processing unless we have compelling legitimate grounds to continue or need the information to establish, exercise, or defend legal claims.

For a UK request, we will respond without undue delay and normally within one month after receiving the request or any reasonably necessary verification information. Where law permits an extension because a request is complex or numerous, we may extend by up to two further months and will explain that within the first month. We do not ordinarily charge a fee. A fee or refusal is limited to circumstances allowed by law, such as a manifestly unfounded or excessive request.

Where possible, we verify through the signed-in account or a fresh authentication challenge. We request identity documents only when a less intrusive method is not reasonably sufficient. An authorised agent must provide proportionate evidence of authority.

If your request concerns information controlled by an organisation Workspace, we may direct you to that organisation or assist it as its processor.

If we deny a request or you disagree with our response, you may ask us to review it and may complain to the regulator identified in section 21.

Objections concerning selected free examples

The Free Generation Licence does not include a voluntary preference opt-out after acceptance. That contractual position does not remove a privacy right that applicable law gives you or another person.

We will assess rights-based objections and complaints individually, including where a bundle contains another person’s likeness, voice, private information, or protected Content. We may restrict, remove, de-index, anonymise, or alter attribution where legally required or appropriate to protect rights.

16. Automated decisions

Nodespell does not currently make solely automated decisions about a person that produce a legal or similarly significant effect.

AI generation itself is automated, but it creates or edits Content at your request; it is not intended to decide a person’s employment, credit, housing, insurance, legal status, healthcare, or another high-impact entitlement.

We will update this Notice and provide required safeguards before introducing significant automated decision-making or profiling.

17. Marketing communications

We may send essential service, security, billing, and policy messages because they are necessary to operate your account; you cannot opt out of those while the account is active.

We send promotional email only where permitted by law. You may unsubscribe using the link in the message or by contacting info@nodespell.com. Opting out of marketing does not stop essential service messages.

We do not use sensitive Content to personalise advertising.

18. Security

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. Measures may include:

• password hashing, session protections, multi-factor authentication, and permission controls;
• restricted administrative access;
• secure transmission;
• environment and credential separation;
• logging, monitoring, and incident response;
• provider security review;
• backups and recovery controls; and
• staff confidentiality and access procedures.

No online service is completely secure. You are responsible for protecting your credentials and for choosing a plan and workflow appropriate to the sensitivity of your Content.

Current account controls include password hashing, secure session settings, encrypted multi-factor-authentication secrets, and role and Workspace permission checks.

We investigate and document suspected personal-data breaches. Where UK law requires notification, we notify the Information Commissioner without undue delay and, where feasible, within 72 hours after becoming aware of a reportable breach. If a breach is likely to create a high risk to affected people, we notify them without undue delay unless an applicable exception permits otherwise.

19. Children

Nodespell is for people aged 18 and over. When you create an account, selecting Create account or an equivalent account-creation action confirms that you meet this requirement, agree to the Terms, and acknowledge this Notice. Acknowledging the Notice is not consent to every type of processing described in it; we request a separate choice where consent is required. Ordinary signup does not require a date of birth, identity document, selfie, or third-party age-verification service.

If you believe a child has provided personal information contrary to the eligibility rule, contact info@nodespell.com so we can investigate and take appropriate action.

20. Changes to this Notice

We review this Notice when our product, providers, processing, or law changes.

We will post the updated Notice and revise its effective date. If a change is material — especially a new use of Content, a new automated safety process, a new training use, or a material disclosure to another party — we will bring it to affected users’ attention before the new processing begins and obtain consent or renewed agreement where required.

If a corporate transaction changes the controller of your personal information or materially changes how it is handled, we will update this Notice and give any notice required by law.

We will not rely on a Privacy Notice update to make old Content retroactively eligible for the Free Generation Licence.

21. Complaints and contact

Please contact us first so we can try to resolve a privacy concern:

Niutron Creative Limited Company number 13610851 27 Hindsleys Place Forest Hill London England SE23 2NF Email: info@nodespell.com

You may also complain to the UK Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

If you live outside the United Kingdom, you may also have the right to complain to the data-protection authority where you live or work.