Privacy notice: Nodle IoT Dashboard

Account and organization

• Your email address, which you sign in with using a one-time code.
• A wallet address: a wallet is created for you the first time you sign in, and the dashboard uses it to register fleets.
• The organizations you belong to and your role in each.
• When you create an organization: your name, the organization’s name, your email and phone number, a description of your activity and your expected network usage.

Fleets, devices and detections

• Fleets: name, identifier and status.
• Beacon devices: name and identifier.
• Detections of your devices by the Nodle network: time, approximate location with its accuracy, and signal strength.
• Webhooks you configure (address, signing secret and selected fields) and their delivery history.

Fleet registration

When you register a fleet, from the dashboard or through the AI connector, the fleet's identifier, the owner and operator addresses and the locations you register are recorded in a public registry, on a public blockchain, that anyone can read and that cannot be erased. A fleet can be released later, but its history stays public.

API keys, billing and support

• API keys you create (name and creation date) and wallet addresses you link with a label.
• Your organization’s plan and subscription status. Payments go through Stripe; Nodle does not receive or store card details.
• The subject and message you send from Support, with your account email.

AI assistant in the dashboard

• Your questions and the conversation context, sent to Google Gemini, which plans how to answer and writes the answer from the organization data it needs.
• Coordinates in an answer may be sent to OpenStreetMap’s Nominatim service to find place names.
• Our server keeps the last 10 exchanges in memory for a short time (see below); your browser keeps the conversation for the session.

AI connector

The connector lets AI applications such as Claude, ChatGPT or Codex work with your organization (how to connect).

• What an AI application can read, only for the organization you connected: your email and roles, the organization’s name, fleets (name, identifier, status, device count), devices (name, fleet, last detection time, last location, signal strength), recent detections of a device (time and location) and webhooks (host, status, recent deliveries). It never receives webhook secrets or full webhook addresses.
• What it can change, only if you allowed it when you connected: fleet and device names, whether a webhook is on, and test events sent to a webhook (admins and editors); and fleet registrations on the Managed Service (admins of Managed Service organizations), for which the identifier, name and locations you ask to register go to Nodle’s registration service.
• What we store about a connection: your email, organization and roles, the permissions you granted, the AI application’s name and identifier, and when the connection was created, last used, expires or was revoked. Access tokens are stored only as hashes. A connection that can register fleets also keeps an encrypted credential for the registration service, cleared when the connection is revoked.
• What the AI application sends us: only the arguments of each request, for example a fleet identifier or a new name. We do not receive your conversation.

Technical data

• Request logs: our hosting provider records your IP address, browser user agent, the address requested and the time.
• AI connector logs: for each connection, permission grant and request, your email, the organization, the AI application, the action and its outcome. Never tokens, secrets, conversation content or IP addresses.
• Rate limiting: IP addresses are hashed before use and kept only as counters.
• Browser security reports about blocked content: the origin and path of the page and of the blocked resource, without query strings.
• Maps: your browser loads map tiles directly from Mapbox or OpenStreetMap, which receive your IP address; Mapbox may also receive usage events from the map.
• Sign-in is handled by Privy, which uses Cloudflare Turnstile to block bots and loads a font from Google Fonts.