Privacy Policy
Nodium carries messages between a business's software and its recipients. This page explains who decides what, what is kept, and whom to contact.
Last updated · September 28, 2026
Contents
1Two rolesLink to “Two roles”
For our customers' accounts, their billing and this site, By-Tech.io (15 rue des Halles, 75001 Paris, France) is the controller: it decides why and how these data are processed.
For the messages exchanged between a customer and its recipients, and for the data of its Apps, By-Tech.io is a processor: the customer decides, and we act only on its instructions. The corresponding commitments are set out in the Terms of Service, section 11.
If you have exchanged messages with a business that uses Nodium, contact that business first: it is responsible for this processing.
2The data processedLink to “The data processed”
Account: email address, name if you provide it, identifier with the identity provider, workspaces, creation and last sign-in dates.
Billing: subscribed plan, the account's legal identity if provided (company name, address, VAT number), payment history. Card data are processed by Stripe; we do not see them.
Channels and keys: WhatsApp Business number and the associated Meta identifiers; access tokens, encrypted; API keys, kept as hashes.
Messages and media: the recipient's WhatsApp number and profile name, message content and attachments, timestamps and delivery statuses.
Apps: user identifier generated by Nodium, encrypted tokens, tool call log (tool called, status, duration, error).
Technical data: log of requests made to the API (method, path, status, duration), server logs, IP address, timestamp.
3Why we process themLink to “Why we process them”
To provide the service: route messages, deliver webhooks, call the customer's API for tool calls, show activity in the console.
To keep the service secure: detect abuse, diagnose incidents, trace access by the Nodium team.
To bill and measure usage, from counters that contain no name, number or text.
To meet our legal obligations, notably accounting ones.
No data is used to train an artificial intelligence model, or for advertising.
4On what legal basisLink to “On what legal basis”
Performance of the contract, to provide the service to our customers.
Legitimate interest, for security and abuse prevention.
Compliance with legal obligations, notably accounting ones.
For recipients' messages, the legal basis is determined by the customer, as controller of that processing.
5Our providersLink to “Our providers”
Each provider is bound by a contract that forbids any use of these data for its own purposes.
Meta Platforms Ireland Limited (Ireland): routing of WhatsApp messages through the Cloud API, and publication of Apps on Muse. Routing is governed by the WhatsApp Business terms the customer accepts when connecting its number.
Supabase, Inc.: database, media storage and authentication, in a data centre located in Ireland.
Vercel Inc.: running the application, in the Paris region.
Stripe: subscription payments.
We sell no data and share none for advertising purposes.
6Transfers outside the European UnionLink to “Transfers outside the European Union”
Data are stored in the European Union (Ireland), and the application runs in Paris. Some providers are established in the United States (Vercel, Stripe). These transfers are governed by the European Commission's standard contractual clauses, supplemented where applicable by the provider's participation in the EU-US Data Privacy Framework.
7How longLink to “How long”
Account: for as long as it exists. When it is closed, the related data are kept for thirty days, then erased.
Messages and media: for as long as the workspace exists, unless a shorter retention period is set for that workspace at the customer's request. The customer can also request the erasure of a person and all their exchanges.
API request log and App tool call log: thirty days, then erased automatically.
App tokens: one hour for an access token, thirty days for a refresh token.
Nodium team access log: kept so that access can be accounted for. It does not contain message content and survives the erasure of a person, without identifying them any longer.
Billing data: the period required by accounting obligations.
8Your rightsLink to “Your rights”
You have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time.
These rights are exercised by writing to contact@nodium.io. We respond within the time limit set by the regulations.
If you are a recipient of a business that uses Nodium, send your request to that business: we can only act on its instructions.
9ContactLink to “Contact”
Your questions about personal data are handled directly by the president of By-Tech.io, at contact@nodium.io. Appointing a data protection officer is not required given our activities.
10ComplaintsLink to “Complaints”
You may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.
12SecurityLink to “Security”
Secrets entrusted to the service are encrypted (AES-256-GCM) and never given back. API keys and access tokens are kept only as hashes.
Each workspace is isolated: a resource from another workspace is reported as not found.
Webhooks sent to the customer are signed, and access by the Nodium team is logged.
No system is infallible. In the event of a data breach, we notify the affected customers and, where the regulations require it, the supervisory authority and the people concerned.
13Changes to this policyLink to “Changes to this policy”
This policy may change. The date of the last update appears at the top of the page. Any substantial change, including a change of provider, is brought to our customers' attention before it applies.