Noodell privacy notice
For noodell.com and Noodell Flow. Version 1.0, effective 13 October 2026.
This notice explains what personal data Noodell collects, why, what we do with it, how long we keep it and what your rights are.
1. Who we are
Noodell Ltd is a company registered in Scotland with company number SC898178, whose registered office is at 199 Clarkston Road, Glasgow, G44 3BS. We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].
For anything about your personal data, email whatsup@noodell.com or write to us at the address above. We are a small business and have not appointed a data protection officer; the Noodell team answers data protection questions directly.
2. Two different roles
We are the controller for the personal data we use to run our own business: website enquiries, sign-ups, the account details of people who use Flow, billing, support, feedback and our own emails. This notice covers all of that.
We are a processor for what a business puts into Flow: its process maps, the people named in them, recordings, transcripts and jobs. That business is the controller and decides what is collected and why. If your name, voice or work appears in a business's Flow account, that business's own privacy notice applies, and questions are best sent to them first. Section 6 explains what we do with that data on their behalf.
3. What we collect and why
| What | Where it comes from | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Website enquiries: name, email, company, phone if given, your message, and answers you give our costing tools | You, through a form on noodell.com | To reply and to discuss working together | Legitimate interests (answering people who contact us), or steps before a contract at your request | 24 months after our last contact, unless you become a customer |
| Flow sign-ups: work email, company name and phone number | You, through the sign-up form | To set up a Flow account and tell you when it is ready, and to ring you if something about your account needs sorting quickly. Never for sales calls | Steps before a contract, and legitimate interests | Life of the account, or 12 months if no account is set up |
| Account details: name, work email, role (Admin or Member), sign-in records, invitations | You or your Admin | To let you sign in, send sign-in links, run the account and keep it secure | Contract with your organisation, and our legitimate interests in providing a secure service | Life of the account, then up to 12 months (as the terms of service set out) |
| Billing: billing contact, company details, subscription and invoice history | Your Admin, and Stripe | To take payment and keep accounts | Contract, and legal obligation (tax and accounting records) | 6 years from the end of the financial year the record relates to |
| Support and correspondence: emails with us | You | To help you and keep a record of what was agreed | Legitimate interests | 24 months after the conversation ends, or longer if needed for a dispute |
| Feedback: whether you plan to keep using Flow, ratings out of 10 and your comment, with your email and organisation | You, in Flow | To understand what works, improve Flow and decide what to build next. The Noodell team reads every answer | Legitimate interests (improving our product) | 3 years, then deleted or made anonymous |
| Product update emails (only if you opt in) | You | To tell you about new Flow features | Consent, which you can withdraw at any time with the link in every email | Until you unsubscribe |
| Security and service logs: IP address, browser, time and type of request | Your device | To keep the service running and secure and to investigate problems | Legitimate interests | 30 days |
| Records of the Noodell team's visits to a Flow account, with the reason | Our systems | To show customers when and why we accessed their account | Legitimate interests (transparency and security) | Life of the account |
We do not sell personal data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects.
Where we rely on legitimate interests, we have weighed our interests against yours and you can object (section 9).
4. Our emails
We send emails needed to run your account: sign-in links, invitations, receipts and important notices about the service or these terms. These are not marketing and you cannot opt out of them while you have an account.
We only send product news if you ticked the box asking for it. Every such email has an unsubscribe link.
5. If you were sent a job by email
If a business that uses Flow gave you a job, you will have received emails with a link to that one job. The business gave us your name and email address and asked us to send them. We are acting for that business, so its privacy notice applies. We use your details only to send emails about that job and to record what you do through the link. We never use them for marketing. Reminders stop when the job is done, dropped or given to someone else; if you think you should not be receiving them, tell the business or email us and we will pause them while it is sorted out.
6. If you are in a Flow account or on a recorded call
When we process data on a business's behalf, we:
- use it only to provide Flow to that business, under a data processing agreement;
- keep it in the UK (AWS, London), except where the business uses a feature that sends it to Anthropic or Recall.ai (section 7);
- delete audio recordings after 30 days, and keep transcripts with the process they belong to;
- keep every saved version of a business's workspace, so it can see and put back an earlier one, for as long as the business has its account;
- keep the questions people ask Ask Flow, and its answers, with the business's other data, where only the person who asked can see them; the access record notes that a question was asked, never what it said;
- access it only to analyse the business's processes, give support or keep the service secure, in visits of no more than an hour that the business can see in its own access log.
A business that records a call through Flow must tell everyone on it first. If you want to exercise your rights over this data, contact the business. If you contact us, we will pass your request to them and help them answer it.
7. Who we share personal data with
We use these service providers. Each is bound by contract to protect the data and use it only to provide its service to us.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting Flow, storage, transcription and sending email | United Kingdom (London) |
| Anthropic | Turning conversations and maps into structured data and analysis, and answering questions people ask Ask Flow about their own work, in the features that use it | United States and other countries where it operates |
| Recall.ai (Hyperdoc Inc.) | The meeting bot, only when a business sends it into a meeting | United States |
| Stripe | Card payments | European Union, United Kingdom and United States |
| Netlify | Hosting noodell.com and receiving website form submissions | United States and its global network |
| Supplying the web fonts on our pages (see section 11) | United States and its global network | |
| Google Workspace | Our own email | United States and other countries |
We may also share personal data with our professional advisers, with our accountants, with a buyer of our business, or where the law requires it.
8. Transfers outside the UK
Where a provider processes personal data outside the UK, the transfer is protected by the UK Addendum to the EU standard contractual clauses, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or another safeguard recognised by UK law. Email us for details of the safeguard for a particular provider.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- correct it if it is wrong;
- delete it, in some circumstances;
- restrict how we use it, in some circumstances;
- object to our using it on the basis of legitimate interests, and to direct marketing at any time;
- move data you gave us, in a machine-readable format, where we use it on the basis of consent or contract;
- withdraw consent where we rely on it, without affecting what we did before.
Email whatsup@noodell.com. We will reply within one month, and will not charge unless a request is clearly unfounded or excessive. We may need to check who you are first.
10. Complaints
If you are unhappy with how we have used your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
11. Cookies and similar technologies
We checked every page of noodell.com and the Flow app on 13 October 2026. Neither uses analytics, advertising, tracking pixels or social media plugins, and neither sets any cookie for those purposes. What they do use is below. All of it is strictly necessary for something you asked for, so we do not ask for consent.
In the Flow app
| Name | Type | What it does | How long |
|---|---|---|---|
| flow_session | Cookie (HttpOnly, Secure) | Keeps you signed in | Up to 12 hours, or 7 days for a read-only board view, or until you sign out |
| flow_operator | Cookie (HttpOnly, Secure) | Set only in a Noodell team member's own browser during a support visit | 1 hour |
| flow-cloud:...:book | Your browser's local storage | Keeps a copy of your map on your device so work is not lost if your connection drops | Until you sign out |
On noodell.com
- noodell.com sets no cookies.
- Some tools on the site, such as the Flow costing tool, remember your answers in your browser's local storage so you do not lose them if you leave the page. That stays on your device. We only receive what you choose to submit in a form.
Fonts. Our pages load fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address and browser details. Google Fonts does not set cookies. Google's use of that data is covered by Google's privacy policy.
You can clear cookies and local storage in your browser settings at any time. Blocking the flow_session cookie will stop you signing in to Flow.
12. Children
Flow and noodell.com are for businesses and are not aimed at children.
13. Changes
We will update this notice when what we do changes, and change the version date above. If a change materially affects people with Flow accounts, we will email the account's Admin before it takes effect.