Privacy
Nodrik is operated by Thoughtgears Ltd, a company registered in the United Kingdom. This policy explains what we process and why. Last updated 15 September 2026.
Who we are
Thoughtgears Ltd — contactprivacy@nodrik.dev. For customer telemetry we act as a data processor; you remain the controller of anything inside your Google Cloud projects.
What we process
| Data | Why | Retention |
|---|---|---|
| Account details (name, work email, company) | To create your tenant, contact you, and bill you | While you are a customer. Deleted with your tenant — your name, work email, monitored project ids, Google organisation and connected Slack and GitHub accounts are removed from our records. Stripe keeps its own invoices, the card it charged and the terms accepted at checkout, as merchant of record, for as long as its retention and our accounting obligations require |
| Telemetry excerpts read during an investigation | To determine the cause of an alert | Not stored — read transiently at investigation time |
| Investigation reports and transcripts | So you can re-read an answer, and so we can improve accuracy | While you are a customer; deleted with your tenant, along with your notifications, mutes and grant history |
| A one-way hash of your monitored project ids, your Google organisation id, and a Stripe fingerprint of the card used for a trial | So a free trial is one per estate rather than one per email address. We store only the hashes, never the project ids, the organisation id or any card detail | Kept after your tenant is deleted — otherwise deleting a tenant would reset the trial. Ask us and we will release it |
| Early-access requests (email, optional context) | To contact you about access | Until you ask us to delete it, or 12 months of no contact |
Transcripts are redacted before storage: email addresses and IP addresses found in log excerpts are replaced. We do not deliberately collect personal data from your telemetry, but logs are your data and may contain it — which is why redaction runs by default and why we store excerpts rather than streams.
How we protect it
Everything below is a property of how Nodrik is built, not a policy we intend to follow.
- Redacted before it is stored, and before the model sees it. Every result Nodrik fetches, and every alert it receives, passes through a redactor first. It removes private keys, API keys, OAuth and bearer tokens, payment card numbers (validated by checksum, so ordinary long identifiers survive), email addresses and IP addresses. This runs on the way in — not on the way out — so redacted content never reaches our database or Google's model at all.
- Encrypted in transit and at rest. Every connection to Google Cloud, Slack, GitHub and to any endpoint you connect yourself is TLS. Stored data is encrypted at rest by Google Cloud.
- Credentials are held apart from data. Any credential you give Nodrik for your own tools lives in Google Secret Manager, in its own per-workspace secret, never in the database alongside investigations, and it is never written to a log line, a report or a Slack message.
- One identity per workspace. Each customer gets a dedicated service account that can read only the projects you granted it. Nothing is shared between customers, and the grant is IAM that you hold and can revoke without asking us.
- Read-only access to your Google Cloud. The roles you grant are four Google-managed viewer roles, every call under them a list call, and — only if you opt in per service — one custom role whose permissions are all get or list. Every read Nodrik performs is attributable in your own Cloud Audit Logs, so you can check this rather than take our word for it.
- Access is decided on our servers. Console access requires a verified Google or GitHub sign-in, and what each person may do is decided server-side by their role in your workspace, never by the browser.
- We keep the report, not your telemetry. Logs and metrics are read at the moment they are needed and are not stored; what persists is the investigation and the redacted evidence quoted in it. Deleting your workspace deletes all of it — see below.
Where it is stored
On Google Cloud. Where each part of the product holds your data is not one region, so it is stated service by service in the data processing agreement, clause 7, which is the version you are entitled to rely on. Model inference runs on Google's Vertex AI within Google's infrastructure; prompts are not used to train Google's models.
Who we share it with
- Google Cloud — hosting, storage, model inference.
- Slack — to deliver the report into your workspace.
- GitHub — commit and diff reads, only if you install our app.
- Resend — to send you email from accounts@nodrik.dev.
- Stripe — payment processing, once billing is live.
- Cloudflare — hosting for this site and the console, and the bot check on the signup form.
We do not sell data, and we do not run advertising or third-party tracking on this site.
Cookies and analytics
Neither surface sets a cookie, and they measure different things — this policy covers both, so it is worth separating them.
This site (nodrik.dev) runs Cloudflare Web Analytics. It is cookieless by design: no identifier is set, nothing follows you to another site, and no profile is built. It records page views, the page that referred you, your browser and country, and how quickly pages loaded. We use it to know whether anyone visited and whether the site is slow.
The console (console.nodrik.dev), where you actually use Nodrik, runs no analytics at all — no page-view tracking, no product analytics, no session recording. Signing in stores a session in your browser so you are not asked to sign in again on every page. That is the only thing we keep there, and it is not shared with anyone.
One exception worth naming, because it is a third party and not analytics: the form that creates a new workspace runs Cloudflare Turnstile, a bot check. It sees your IP address and browser in order to decide you are a person, sets no cookie for advertising, and builds no profile. It runs on that one form and nowhere else in the console.
Nothing on either surface is sold, shared, or handed to an advertising network.
Your rights
Under UK GDPR you may request access to, correction of, or deletion of your personal data, and you may object to processing or request portability. Emailprivacy@nodrik.dev and we will respond within 30 days. You may also complain to the Information Commissioner's Office (ico.org.uk).
Deleting your data
Ask us, or press Leave Nodrik in the console, and we delete your tenant: its reports and transcripts, its credentials, its notifications, mutes and grant history, and the tenant record itself — the workspace name, your monitored project ids, your Google organisation, your Slack and GitHub connections, your contact address, and the Stripe customer and subscription ids we hold. Leaving also cancels your subscription.
Two things survive on purpose: the estate hashes described above, and a closed marker holding your workspace id — a one-way hash of your Google account id — and the fact that the workspace is closed, which is what stops the id ever being reused. Revoking the IAM roles you granted — the four, and any optional configuration role — stops all access immediately, whether or not you have told us first.
Changes
If this policy changes materially we will email customers rather than quietly editing the page.