GDPR Rights and Procedures

TIMPIA S.R.L. (details on the company page) is the controller of the personal data below. Questions go to hello@noda.energy.

• Your account: name, work email, company name, and a password stored as a hash, or your Google sign-in identifier. We use it to create and run your account (contract, Art. 6(1)(b)).
• Your work in Noda: the prompts you write, the files you upload, and the projects, maps, reports and chats Noda produces. We use it to do the work you ask for (contract).
• Guest use: before you have an account, the prompt and any file you send from noda.energy or the app. To limit free prompts we keep keyed hashes of a device signal, of a browser cookie set on app.noda.energy and of your network address, and never the raw values (legitimate interest in preventing abuse, Art. 6(1)(f)). Guest data that no account claims is deleted after 30 days.
• Billing: your plan, invoices and payment status. The payment provider processes card details; we never see the card number (contract, and legal obligation for invoices, Art. 6(1)(c)).
• Service emails about your account, security and billing (contract).
• Technical logs and error reports that keep the service secure and working (legitimate interest).

The noda.energy website sets no cookies and runs no analytics. The app uses cookies that keep you signed in, a cookie that limits free guest prompts, and product analytics for signed-in accounts that help us improve Noda.

Providers that host and run the service process this data for us: hosting and content delivery, the AI model providers that turn your prompts and files into answers, email, payments and error monitoring. We keep account and project data while your account is open and delete it within 30 days of a deletion request, except the billing records Section 6 describes. You can complain to ANSPDCP (Section 9).

The GDPR gives you specific rights over the personal data we hold about you. You may request:

• Access — a copy of the personal data we hold about you (Art. 15)
• Rectification — correction of inaccurate or incomplete data (Art. 16)
• Erasure — deletion where the legal conditions are met (Art. 17)
• Restriction — temporary limitation of processing (Art. 18)
• Portability — machine-readable export of data you provided (Art. 20)
• Objection — to processing based on legitimate interests (Art. 21)
• Withdrawal of consent — for any processing that relied on consent (Art. 7(3))
• Complaint — to ANSPDCP or your local supervisory authority (Art. 77)

Send your request to hello@noda.energy. Tell us which right you want to exercise and any details that help us locate the record (account email, subscription ID, approximate dates).

You can update your own profile fields in the workspace. Export and account deletion are handled by our team on request. Write to hello@noda.energy and we will complete both within the period Article 12(3) allows.

To protect your data we verify the requester is the data subject. For active accounts we send a verification email to the address on file. For closed accounts we may ask for additional confirmation (two of: the work email previously used, a recent invoice number, or the identifier of a run on the account). We ask for an identity document only where nothing else can settle it, we accept it with everything except your name and photograph redacted, and we delete it as soon as the request closes. Excess data sent for verification is discarded after the request closes.

We respond within one month of receiving your request, as Article 12(3) GDPR requires, free of charge for normal requests. The month runs from when the request arrives, not from when we finish identifying you. We may extend by a further two months for complex or numerous requests; we will tell you within one month of receiving the request that we are extending, and why. Manifestly unfounded or excessive requests may carry a reasonable fee or be refused, and we will tell you why.

Some data is held under legal obligations and cannot be deleted on request. In particular, invoices, billing records, and VAT data are retained for 5 years, calculated from 1 July of the year following the financial year in which they were drawn up, under Article 25 of Romanian Law 82/1991 as amended by Law 36/2023. Where we cannot fulfil an erasure request we explain why and we erase the rest of your record — account fields, audit logs, report inputs — on request.

We follow Articles 33 and 34 GDPR. If we detect a personal data breach that is likely to result in a risk to your rights and freedoms, we notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we notify you directly without undue delay. Where we act as processor for a business customer, we notify that customer within 24 hours of becoming aware, which is shorter than the law requires of us and is the commitment our customers actually need.

Our current sub-processor list is available on request at hello@noda.energy. Our providers process personal data on our instructions under data processing terms. Where personal data leaves the EEA, we rely on the safeguards the GDPR provides, such as standard contractual clauses. To receive our own data processing agreement as customer, write to hello@noda.energy and we will send it and sign it. We give at least 15 days' notice before adding a new sub-processor to the list.

The Romanian Data Protection Authority is:

• Name: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
• Email: anspdcp@dataprotection.ro
• Phone: +40 318 059 211
• Web: dataprotection.ro