Privacy Policy

1. Who we are

Nodal (“Nodal”, “we”, “us”) is an open-source email outreach tool. The source code is publicly available, so anyone can inspect exactly how data is processed, and organizations may self-host their own instance. This policy covers the hosted instance you are using. For self-hosted deployments, the operator of that deployment is the data controller.

Contact for privacy matters: developers.skymium@gmail.com.

2. Data we collect

• Account data — your email address, name, workspace membership and role, created when you sign up or are invited.
• Workspace content — leads, contact details, notes, email templates, campaigns, sequences, schedules, and suppression lists that you or your teammates enter or import.
• Sending configuration — sender identities, provider settings (Resend, SMTP, Gmail), sending limits and health status.
• Activity and delivery data — sent/delivered/opened/clicked/replied/ bounced/unsubscribed events for emails you send, plus an audit log of actions taken in your workspace.
• Technical data — authentication sessions, and error/diagnostic logs needed to keep the service running securely.

We do not sell personal data, and we do not use your workspace content or Google user data for advertising or to build advertising profiles.

3. Google account access (Gmail)

Connecting a Gmail account is entirely optional. If you choose to connect one, you are taken to Google’s own consent screen, where you see and approve every scope before anything is granted. You can decline, and you can revoke access at any time.

Scopes we may request, and exactly why:

• gmail.send — to send the campaign, follow-up, test, and one-off emails that you compose and explicitly schedule or trigger inside Nodal.
• gmail.compose — to create and update drafts in your mailbox when you ask Nodal to prepare a message for your review before sending.
• gmail.readonly — to read message metadata and bodies solely to detect replies and bounces to your outreach, so a sequence stops automatically when a recipient responds and so replies appear in the lead’s timeline.
• userinfo.email and userinfo.profile — to identify which mailbox you connected and display it as a sender.

What we never do:

• We never request or use permanent-deletion scopes. Nodal cannot delete your emails, labels, drafts, or mailbox contents.
• We never send, draft, or modify anything that you did not compose, schedule, or trigger. Every send is a user-initiated action.
• We never transfer Google user data to third parties except as necessary to provide the feature you asked for, for security, or to comply with law.
• We never use Google user data to train generalized or foundation AI/ML models, and we never sell it.
• We never show ads based on Google user data.

Limited Use disclosure

Nodal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features that the data was granted for, is accessed only by authorized personnel when strictly necessary for security, abuse handling, or to resolve a support issue you raised, and is not used for any other purpose.

Storage and revocation

• OAuth credentials are exchanged and stored server-side only. Your Gmail connection key is encrypted at rest with AES-256-GCM and is never exposed to the browser.
• Message content retrieved for reply detection is minimized: we store only what is needed to show that a reply occurred (sender, subject, timestamp, and reply text attached to the lead), not a copy of your mailbox.
• You can disconnect Gmail at any time from Senders → Disconnect, which revokes the token and deletes the stored credential, or at myaccount.google.com/permissions. Related Google data is deleted within 30 days of disconnection or account deletion.

4. AI features

Lead enrichment, personalization, reply classification, and spam-risk checks send only the specific text you submit for that task to our AI provider. Prompts and outputs are not used to train third-party models, and AI features never run over your Gmail mailbox beyond the reply-detection purpose described above.

5. Assistant / MCP access

You may connect an AI assistant (for example ChatGPT or Claude) to your workspace over MCP. That connection uses OAuth: the assistant signs in as you, sees a consent screen, and can only do what your role already allows. Every action is subject to the same access rules and appears in your audit log. You can revoke the connection at any time.

6. Service providers

We rely on a small set of processors to run the service:

• Supabase — managed Postgres database, authentication, and storage.
• Cloudflare — application hosting and edge delivery.
• Google (Gmail API) — only if you connect a Gmail sender.
• Resend and/or your own SMTP provider — only for the sending accounts you configure.
• AI provider — for the optional AI features described above.

7. Security

Security controls currently enabled on this instance:

• Encryption in transit — all traffic is served over HTTPS/TLS, and all provider API calls use TLS.
• Encryption at rest — the managed Postgres database and its backups are encrypted at rest by Supabase.
• Row Level Security — every application table enforces Postgres RLS, so a query can only return rows belonging to a workspace you are a member of. Access is enforced in the database, not just in the UI.
• Role-based access — owner, admin, campaign manager, and viewer roles are stored in a dedicated roles table and checked server-side.
• Credential isolation — sending credentials and Gmail connection keys are stored in service-role-only tables, encrypted, and never returned to the browser.
• Managed authentication — sessions, password hashing, and token rotation are handled by Supabase Auth; leaked-password checking is available.
• Signed webhooks and scoped endpoints — inbound provider webhooks are verified, and scheduled jobs require a shared secret.
• Auditability — sensitive actions are recorded in a per-workspace audit log, and the code itself is open source and reviewable.

No system is perfectly secure. These statements describe controls in place; they are not a warranty, certification, or audit result.

8. Retention and deletion

• Workspace content is kept while your workspace is active.
• Deleting a lead, campaign, sender, or workspace removes the associated records; backups age out on the provider’s normal rotation.
• On account deletion or Gmail disconnection, associated Google credentials and derived Google data are deleted within 30 days.
• Suppression and unsubscribe records may be retained to honor opt-outs.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Most data is exportable directly from the app (CSV export). For anything else, email developers.skymium@gmail.com and we will respond within 30 days.

10. Recipients of your outreach

When you email a lead through Nodal, you are the sender and the controller of that contact’s data; we process it on your behalf. Every campaign email includes an unsubscribe link, and unsubscribes are enforced globally through your suppression list. If you are a recipient and want your data removed, use the unsubscribe link in the message or contact the sender directly; you may also write to us and we will forward the request.

11. Children

Nodal is a business tool and is not directed to anyone under 16.

12. Changes

We will update this page when our practices change and revise the “last updated” date. Material changes affecting Google user data will be announced in-app before they take effect.