Local by design.
Transparent by default.

1. Scope and privacy roles

This policy applies to the NodeLume Chrome extension, the website at nodelume.ai, contact and support communications, and subscription-related information that NodeLume receives.

NodeLume is the controller of personal information it receives and determines how to use, including account and sign-in information, installation records and account associations, campaign attribution and conversion events, contact inquiries, and subscription fulfillment records. Paddle acts as Merchant of Record and authorized reseller for subscriptions and purchases made through Paddle checkout and processes payment-method and transaction information under its own privacy notice.

Included free usage is available without an account, sign-in, or subscription. Account, Google sign-in, and payment information are processed only when you choose account-based features such as a paid Core plan or connected-installation management.

This policy does not govern the websites or applications you choose to analyze. Those services remain subject to their own privacy policies and controls.

2. Our local processing model

NodeLume is designed to inspect and organize browser-visible application activity on your device. Application analysis data is not uploaded to NodeLume for analytics, advertising, profiling, artificial intelligence training, or synchronization.

Because captures remain in extension storage, NodeLume cannot view, retrieve, synchronize, sell, or use them. You control when a capture starts, how long it remains stored, and whether it is deleted or exported.

3. Categories of information

Website analytics choices

The Google tag is present only on NodeLume website pages. Before you make a choice, Google Consent Mode keeps analytics storage, advertising storage, and advertising user-data permission denied. Google may receive limited cookieless signals about consent state and the website request while storage is denied. If you select “Allow analytics,” Google Analytics may use first-party identifiers such as the _ga cookie to measure website sessions and campaign conversions. Advertising personalization remains disabled.

Your choice is stored locally in this browser under nodelume.analyticsConsent.v1 so it can be applied on later NodeLume website pages. It is not added to your NodeLume account or sent to the NodeLume API. After an allowed and verified purchase conversion, the browser also stores a one-way checkout marker for up to 90 days solely to avoid sending the same conversion more than once. The checkout-session identifier itself is not stored in that marker or sent to Google Analytics. You can reopen “Privacy choices” at the bottom-right of any page to allow or revoke analytics. Clearing site storage also clears these saved preferences and markers.

This website analytics system has no access to NodeLume extension captures. It never sends an analyzed application's page structure, recordings, requests, responses, headers, bodies, screenshots, local history, or exported troubleshooting files to Google Analytics. First-party campaign identifiers are retained and linked to checkout only when website analytics and campaign measurement are allowed.

4. Purposes and legal bases

• Authenticate you and maintain your account: performance of a contract or steps requested before entering one.
• Register and manage installations: performance of a contract and NodeLume's legitimate interest in licensing, account security, and abuse prevention.
• Provide the extension and subscriptions: performance of a contract or steps requested before entering one.
• Respond to inquiries and support: steps requested by you and NodeLume's legitimate interest in communicating with prospective and current users.
• Process Paddle webhooks, transactions, and billing: performance of a contract, steps requested before entering one, legitimate interests in accurate fulfillment and fraud prevention, and legal obligations.
• Measure use of the NodeLume website: consent for optional Google Analytics measurement and campaign reporting.
• Attribute website campaigns and measure conversions: consent where required and NodeLume's legitimate interest where applicable law permits this processing without consent.
• Protect the service and enforce agreements: legitimate interests in security, abuse prevention, troubleshooting, and legal claims.
• Meet tax, accounting, consumer, and privacy duties: compliance with legal obligations.
• Optional marketing: only with consent where required. The current contact form does not enroll you in marketing communications.

NodeLume does not use captured application data for targeted advertising, data brokerage, cross-context behavioral advertising, creditworthiness decisions, or training generalized artificial intelligence models.

5. Browser permissions and local controls

You can decline optional permissions, stop a recording, delete individual recordings or local history, revoke permissions in Chrome, or remove the extension. Removing the extension ordinarily deletes its local extension data, subject to Chrome's behavior and any exports you created.

6. Service providers and disclosures

Google Analytics on the website

NodeLume uses Google Analytics 4 on pages at chrome.nodelume.ai to understand website visits and campaign performance. Google may process the website analytics information described above under the Google Privacy Policy and the applicable Google measurement terms. NodeLume keeps advertising personalization disabled. This provider does not receive the content captured locally by the NodeLume extension.

Google sign-in

If you choose Google sign-in, Google authenticates you and provides NodeLume with the profile information described above. Google processes the sign-in interaction under the Google Privacy Policy. NodeLume uses the information it receives to create or access your account and associate your installations and subscription with you.

Payments and subscriptions

NodeLume uses Paddle as Merchant of Record and authorized reseller for subscriptions and paid purchases. Paddle collects and processes information needed for checkout and order fulfillment, which may include your name, contact details, billing address or location, payment and purchase details, tax information, device or network information, and fraud-prevention signals. Paddle uses this information to validate payment methods, process the immediate subscription charge and later renewals, calculate and remit applicable taxes, issue invoices and receipts, manage subscriptions, prevent fraud, handle refunds and chargebacks, and provide transaction support.

Paddle may share with NodeLume the buyer contact details, plan, customer and transaction identifiers, subscription status, billing dates, purchase history, and limited billing information needed to provide access, maintain the subscription, prevent abuse, and respond to product or billing support. NodeLume does not receive complete payment-card details, the full card number, or the card security code. Paddle processes transaction data in accordance with the Paddle Privacy Notice and handles the purchase as an independent Merchant of Record.

Paddle sends webhook events to the NodeLume backend so NodeLume can verify and apply subscription and transaction changes. NodeLume may store the complete raw webhook payload as well as transaction and conversion records derived from it for verification, idempotency, reconciliation, entitlement fulfillment, fraud prevention, troubleshooting, disputes, and audit purposes.

Contact form and email

NodeLume uses a form-delivery service to send the information you submit to hello@nodelume.ai. Email providers process direct messages so NodeLume can respond.

Hosting and security

NodeLume uses hosting and security providers that may process network information needed to deliver and protect the website. This infrastructure does not receive local extension captures.

Legal disclosures and business changes

We may preserve or disclose information we actually control when reasonably necessary to comply with law, prevent fraud, enforce agreements, protect rights and safety, or complete a merger, financing, acquisition, or sale of assets subject to appropriate safeguards and notice where required. This does not create access to local analysis data that NodeLume never receives.

NodeLume does not sell or rent personal information.

7. Retention

• Local captures: remain in the Chrome profile until you delete them, clear extension storage, or remove the extension.
• Google profile and account information: kept while your NodeLume account remains active. If you request account deletion, the profile, name, email, photo, and sign-in association are removed from active systems after the request is verified, except for information that must be retained for security, fraud prevention, legal claims, or legal obligations. Residual copies may remain temporarily in restricted backups until they are overwritten under the backup cycle.
• Installations and user associations: kept while an installation remains connected to your account and as needed to administer licensed access. When you revoke an installation or delete your account, NodeLume deletes or disassociates the active installation record, subject to limited security, fraud, dispute, and backup records.
• Campaign attribution: gclid, gbraid, wbraid, UTM parameters, and landing-page records are kept only as long as reasonably necessary to attribute campaigns, measure conversions, prevent duplicate reporting, and resolve measurement errors, after which they are deleted or anonymized.
• Website analytics: Google Analytics data is retained according to the retention settings configured for the NodeLume Analytics property and then deleted or aggregated. The consent preference remains in the browser until you change it or clear site storage.
• Contact and support: kept for the duration of the inquiry and a reasonable follow-up period, then deleted or anonymized unless needed for a continuing relationship or legal claim.
• Raw Paddle webhook payloads: kept only as long as reasonably necessary to verify event authenticity and processing, prevent duplicate fulfillment, troubleshoot integration failures, reconcile account access and transactions, prevent fraud, resolve disputes, and support audits. NodeLume then deletes the raw payload or reduces it to the transaction and subscription fields still required for the purposes below.
• Subscription, transaction, and conversion records: kept while needed to provide and reconcile access, measure completed conversions, and meet tax, accounting, consumer-protection, fraud, dispute, audit, and other legal requirements. When those purposes expire, the records are deleted or anonymized.
• Security and request logs: retained according to provider settings and only as long as reasonably necessary for delivery, security, and troubleshooting.
• Privacy requests: kept as necessary to verify and demonstrate compliance.

Retention periods may vary by record because subscription history, tax evidence, chargebacks, fraud investigations, and legal claims have different limitation and recordkeeping periods. NodeLume reviews retained backend data and applies the shortest period compatible with the purposes above and applicable law. You may request deletion by emailing the privacy contact below; NodeLume will delete eligible information and explain any information it must retain.

8. International data transfers

NodeLume operates from Brazil and uses providers that may process information in the United States, Europe, Brazil, or other countries. Where data protection law requires a transfer mechanism, NodeLume relies on an applicable adequacy decision, contractual safeguards such as Standard Contractual Clauses, or another lawful basis.

9. Your regional privacy rights

Rights depend on your location and the law that applies. They generally concern information NodeLume actually controls; because local extension captures are not available to NodeLume, you must manage those captures directly in the extension or Chrome.

Brazil — LGPD

Where the LGPD applies, you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where regulated, information about sharing, review of certain automated decisions, objection, and withdrawal of consent where consent is the basis.

European Economic Area, United Kingdom, and Switzerland

Where applicable, you may request access, correction, erasure, restriction, portability, or objection; withdraw consent; and lodge a complaint with your local supervisory authority. You may also ask about applicable transfer safeguards. NodeLume does not make solely automated decisions that produce legal or similarly significant effects.

United States

Residents of states with applicable consumer privacy laws may have rights to know or access, correct, delete, obtain a portable copy, and appeal a denied request, as well as opt out of sale, targeted advertising, or certain profiling. NodeLume does not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use sensitive information to infer characteristics. We will recognize legally required browser opt-out preference signals; because NodeLume does not engage in sale or targeted-advertising sharing, no separate opt-out is currently necessary.

We will not unlawfully discriminate against you for exercising a privacy right.

How to exercise a right

Email hello@nodelume.ai with the subject “Privacy Request.” Describe your request and the email address, account, installation, or transaction identifier connected to the information. We may verify your identity and authority before acting. Authorized agents may submit requests where permitted by law.

10. Security

NodeLume uses a local-first design, data minimization, transport encryption for website submissions, restricted service-provider access, and reasonable administrative and technical safeguards.

Application captures remain in the browser profile selected by the user. NodeLume has no server-side access to those captures and cannot use them for analytics, advertising, profiling, or artificial intelligence training.

11. Children and automated decisions

NodeLume is a professional software product and is not directed to children under 16. We do not knowingly collect personal information from children through the website. If you believe a child submitted information, contact us so we can assess and delete it where required.

NodeLume's deterministic technical insights do not make decisions about people and are not used for credit, employment, insurance, housing, education, or other legally significant decisions.

12. Chrome Web Store Limited Use disclosure

13. Changes, questions, and complaints

We may update this policy when NodeLume's features, providers, or legal obligations change. Material changes will be presented before or when they take effect as required. The effective date above identifies the current version.

Contact hello@nodelume.ai with privacy questions or requests. Depending on your location, you may also complain to the Brazilian ANPD, an EU or UK supervisory authority, the California Privacy Protection Agency, or another competent regulator.