Privacy Policy

Website: iNodes.ai
Data controller: iNodes — SAS with share capital of EUR 5,000 — RCS Paris 106 035 603
Last updated: November 5, 2026
Version: 1.5

Preamble

This Privacy Policy describes how iNodes, a simplified joint-stock company with share capital of EUR 5,000.00, whose registered office is at 173 rue de Courcelles, 75017 Paris, France, registered with the Paris Trade and Companies Register under number 106 035 603 (SIREN 106 035 603) (hereinafter “the Publisher”, “we”, “our”), collects, uses, stores and protects the personal data of users (hereinafter “the User”, “you”) of the iNodes.ai platform (hereinafter “the Platform”).

This policy is established in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and French Law No. 78-17 of 6 January 1978 on data processing, data files and individual liberties (Loi Informatique et Libertés).

Article 1 – Data controller

Data controller: iNodes
Registered office: 173 rue de Courcelles, 75017 Paris, France
Email: [email protected]
SIREN: 106 035 603
Trade register (RCS): Paris 106 035 603

The Data Controller may be contacted at [email protected] for any question related to personal data processing. Where the appointment of a DPO is not legally required, iNodes designates an internal “data protection” contact point reachable at the same address.

B2C regime (personal account). iNodes acts as controller.

B2B regime (Studio / School). When an organisation has concluded a DPA with iNodes, the organisation acts as controller and iNodes as processor for the organisation’s data (members, seats, prompts, execution logs). Details are set out in that DPA. iNodes remains controller for its own data (billing, platform security, contact accounts). In the event of a conflict regarding roles, the DPA prevails.

Article 2 – Data collected

2.1 Data provided directly by the user

2.2 Data collected automatically

• Technical data: IP address, browser type and version, operating system, screen resolution, unique device identifiers.
• The desktop application sends a pseudonymized count of local generations and the host application of cloud generations, as well as download and installation statistics, without prompts, machine names, or workflow content.
• Navigation data: pages visited, date and time of access, session duration, actions performed.
• Transaction data: Token purchase history, Token consumption, subscription details.

2.3 Data not collected

The Publisher does not collect and does not store:

• Payment information (credit card), processed exclusively by the third-party payment provider.
• Files generated by artificial intelligence, which remain hosted by the AI Provider and are transmitted directly to the User. iNodes keeps, for each generation, its metadata (date, model, status, Token consumption) as the usage history, and the links to those files for seven (7) days only (Article 6).

Article 3 – Purposes and legal bases for processing

Article 4 – Data recipients

Personal data may be shared with the following categories of recipients:

4.1 Artificial intelligence providers (DPA relay)

iNodes acts as a technical intermediary. Generation is performed by the AI Providers. iNodes relays those providers’ contractual commitments (DPA and API Services Terms) without standing in for them and without the User becoming a party to those contracts.

fal – Features & Labels, Inc. (FAL.ai)

• Headquarters: San Francisco, California, United States
• Role: iNodes’ processor when the FAL DPA applies (personal data that may be contained in User Content)
• Data transmitted: User Content (prompts, uploaded media, generation parameters)
• Purpose: performance of AI generation operations
• Relayed commitments: non-training and DPA coverage for “Enterprise Ready” models; FAL.ai imposes equivalent obligations on its subprocessors and remains liable to iNodes for their breaches
• Possible chain: FAL.ai may transfer User Content to third-party proxy APIs (OpenAI, Google or others). The User has no direct DPA with those third parties. The subprocessor list is the one published by FAL.ai (DPA Attachment 4).
• Documents: DPA · API Services Terms · FAL privacy policy

iNodes only offers FAL “Enterprise Ready” models covered by these commitments. “Pending Enterprise Ready” models (outside the DPA and non-training commitment) are not made available.

4.2 Payment provider

Stripe Payments Europe, Ltd.

• Data transmitted: payment information
• Purpose: secure transaction processing

4.3 Hosting and infrastructure

• Fly.io (United States) — hosting of the website and the API, servers located in France.
• Supabase — database, authentication and storage, servers located in the European Union.
• Cloudflare, Inc. (United States) — protection and routing of the website traffic.

4.4 Other recipients

• Brevo (France) — service emails: account confirmation, invoices, notifications.
• PostHog (instance hosted in the European Union) — audience measurement and usage statistics (cookies: Article 9).
• Infomaniak (Switzerland) — hosting of our mailboxes, hence of the emails exchanged with you.
• Competent authorities in the event of a legal obligation or court order.

Depending on the processing operations, our service providers may act as processors acting on iNodes’ instructions, or as independent data controllers when they determine their own purposes and means of processing (in particular for their own legal obligations).

Article 5 – Data transfers outside the European Union

User Content (prompts, uploaded media and generation parameters) is transmitted to FAL.ai, whose servers are located in the United States. FAL.ai may also transfer it to its subprocessors or proxy APIs, which may be located in other countries. These transfers are necessary for the performance of the service and are governed by:

• The European Commission’s standard contractual clauses (SCCs), in accordance with Article 46.2.c of the GDPR.
• The EU-US Data Privacy Framework, where applicable.

The User is informed of these transfers prior to use of the service. These transfers are based on the legal bases applicable to the processing and on the safeguards governing international transfers described in this article.

In the event of changes to the safeguards governing transfers, the Publisher undertakes to implement alternative protection measures in compliance with the GDPR.

The applicable transfer mechanism is specified for each provider concerned (adequacy decision in force, in particular the EU-US Data Privacy Framework, or European Commission Standard Contractual Clauses, supplemented where applicable by additional measures). A copy of the relevant safeguards may be requested at [email protected].

Article 6 – Retention period

Where legal, accounting, tax, evidentiary or security obligations so require, certain data may be archived for the period strictly necessary to comply with these obligations, with restricted access.

Article 7 – Data subject rights

In accordance with the GDPR and the Loi Informatique et Libertés, the User has the following rights:

• Right of access (Art. 15 GDPR): obtain confirmation that data concerning them is being processed and receive a copy.
• Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): request deletion of their data in the cases provided for by law.
• Right to restriction of processing (Art. 18 GDPR): request suspension of processing in certain circumstances.
• Right to data portability (Art. 20 GDPR): receive their data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): object to the processing of their data on legitimate grounds, including commercial prospecting.
• Right to withdraw consent at any time, when processing is based on consent.
• Right not to be subject to automated decision-making: request human intervention regarding any decision based solely on automated processing producing legal effects.
• Right to define directives regarding the fate of their data after their death (Loi Informatique et Libertés).

Exercising rights

To exercise these rights, the User may send their request to:

• Email: [email protected]
• Postal address: iNodes – 173 rue de Courcelles, 75017 Paris, France

The Publisher undertakes to respond within one (1) month of receipt of the request. This period may be extended by two (2) months in the event of complexity or a large number of requests.

Complaint

In the event of difficulty, the User may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL):

• Website: https://www.cnil.fr
• Address: 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07

For users located in another EU country, they may contact the data protection authority of their country of residence.

Article 8 – Data security

The Publisher implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in particular:

• Encryption of data in transit (SSL/TLS).
• Password hashing.
• Access control and strengthened authentication.
• Regular backups.
• Security updates.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the data subjects, the Publisher undertakes to notify the CNIL within 72 hours and to inform the data subjects if the risk is high, in accordance with Articles 33 and 34 of the GDPR.

Article 9 – Cookies

9.1 What is a cookie?

A cookie is a small text file placed on the User’s device (computer, smartphone, tablet) when visiting the Platform.

9.2 Types of cookies used

9.3 Cookie management

On their first visit, the User is informed of the placement of cookies via a consent banner. The User may at any time:

• Accept or refuse non-essential cookies via the consent banner or the cookie manager accessible from the Platform.
• Configure their browser to block or delete cookies. Deleting essential cookies may affect the operation of the Platform.

Article 10 – Data processing by AI Providers

10.1 Nature of processing and relay

When the User uses the AI generation features, iNodes transmits to the AI Providers (including FAL.ai), as a technical intermediary:

• The User’s prompts and instructions.
• Any uploaded media and technical parameters for the generation.

iNodes does not perform generation, does not train models on this data and does not retain the generated files on its servers (Article 6 for the metadata and links).

10.2 Relayed FAL.ai commitments

The following commitments bind FAL.ai to iNodes (API customer). iNodes relays them to the User; the User is not a party to the FAL DPA.

In accordance with FAL.ai’s DPA and API Services Terms, for “Enterprise Ready” models made available on the Platform:

• FAL.ai does not use User Content (prompts and results) to train, develop or improve its own models or products.
• FAL.ai processes User Content solely for the purpose of providing the service.
• When User Content contains personal data, the DPA applies: FAL.ai acts as iNodes’ processor.
• FAL.ai imposes on its subprocessors data-protection obligations no less protective than the DPA and remains liable to iNodes for their breaches.
• If the model is accessed via a third-party API (proxy), User Content is transferred to that third party. The User has no direct DPA with that third party.

iNodes does not offer FAL “Pending Enterprise Ready” models, for which FAL.ai’s DPA and non-training commitment do not apply.

10.3 User information

The User is informed that:

• Their User Content may be transmitted to servers located in the United States, and where applicable to FAL.ai subprocessors or proxy APIs.
• They must not include sensitive personal data (health data, political opinions, biometric data, etc.) in their prompts.
• The Publisher does not retain the generated files on its servers.
• The chain (iNodes as controller and intermediary → FAL.ai as processor when the DPA applies → subprocessors / proxy) is described in article 4.1 and in the Terms of Use article 2.4.

Article 11 – Minors

The Platform is not intended for persons under 18 years of age. The Publisher does not knowingly collect personal data from minors. If the Publisher becomes aware that a minor has provided personal data, it will be deleted as soon as possible.

Article 12 – Modification of the policy

The Publisher reserves the right to modify this Privacy Policy. Any substantial modification will be notified to the User by email or by display on the Platform. The “Last updated” date at the top of the document is updated accordingly.

Article 13 – Contact

For any questions regarding this Privacy Policy or to exercise your rights:

iNodes
173 rue de Courcelles
75017 Paris, France
Email: [email protected]

DPO Referent: Benjamin Cavillac
Address: 173 rue de Courcelles, 75017 Paris, France
Email: [email protected]