Trust & information
Privacy policy
Effective 7 September 2026. Updated 18 October 2026.
Nordform Group Oy (business ID 3662743-8) operates Nordform at nordform.ai and app.nordform.ai. We are the controller for account administration, service operation and our own support communications. Contact: privacy@nordformgroup.com. Postal address: Valkjärventie 17b, Espoo, Finland.
Information we use
Account information. You can sign in with Google, Microsoft, Apple, or a single-use link sent to your email address. From a sign-in provider we receive an account identifier, an email address and a profile name, and nothing else; a sign-in link tells us only the address you entered. Apple offers to hide your address behind a private relay, and if you choose that, the relay address is the only one we hold. The next profile release also retains a Google profile-photo URL when provided and lets you save a display name and uploaded avatar. Google-hosted photos load from Google; uploaded avatars are resized in the browser and stored privately with your account. We request only OpenID, email and profile access. Signing in does not give Nordform access to your mail, files, contacts or calendar with any of these providers. We store an account record, sign-in events and a secure session identifier to recognize you and protect your workspace.
Cookies. We set cookies that are strictly necessary to sign you in and keep you signed in: a session cookie, and short-lived cookies during sign-in that bind the attempt to this browser and remember which page you started from. They last from ten minutes to seven days. We set no advertising or cross-site tracking cookies, so there is no consent banner to dismiss.
Product news. If, and only if, you tick the box on the sign-in page or in your profile, we record that you agreed, when, and on which page, and we may email you about the product. You can withdraw that at any time in your profile or from the link in any such message. Withdrawal stops the mail; we keep the record of what was agreed. Sign-in links and messages about your own projects are separate and are not affected either way.
Design work. Cloud features store the projects, revision inputs, briefs, selected context packages, uploaded files, comments and review information you deliberately submit. We also record generated outputs, job progress, failures and usage counters. Local projects can remain in your browser until you choose cloud synchronization. Clearing browser storage may remove local-only work.
Collaboration. Invitation email addresses, permissions, acceptance and expiry records determine access. Comments retain the author's identity and source revision. Files are shared with a review when you explicitly select them. Company membership does not automatically make your private projects visible to everyone in the company.
Service and support information. Our infrastructure processes connection and security information, such as IP addresses and request logs. If you contact us, we use your message and contact details to respond. An inquiry sent from this site is stored for twelve months so the group's sales team can answer it and plan a pilot, then deleted. A copy is sent to the team's inbox at info@nordformgroup.com so a person can reply to it; what the team has taken into its customer records, that email included, stays there as a customer record. Please avoid sending unnecessary sensitive personal information in briefs, uploads or support messages.
Why we process information
We process account, project, collaboration and requested generation data to provide the service you request and perform our agreement with you. We use necessary security and operational records for our legitimate interests in protecting the service, preventing misuse and diagnosing failures. Where applicable, we retain records to meet legal obligations. Optional processing that requires consent is explained when offered; you may withdraw consent without affecting earlier lawful processing.
Providers and AI features
This is the complete list of the providers that process information about you or your designs for Nordform. Each receives only what the operation in its row needs. Where a row says a feature runs only when someone turns it on, a person who never uses that feature sends that provider nothing.
| Provider | What it receives | When | Purpose |
|---|---|---|---|
| Cloudflare | Everything the service stores: your account record, projects, uploaded files, generated outputs, job records, and the email we send you | Whenever you use Nordform | Hosts the application, database, private file storage and job infrastructure, and sends our email |
| Cloudflare Workers AI (models running on Cloudflare's network) | The text of .txt and .csv files uploaded to the project, with your request. The request and the alternatives a run produced, with their check results. In a company workspace, a saved DXF or IFC import a member asks to have read. Messages sent to a project's design hub address, and, while the hub is open and its owner has not switched this off, the review comments, expert change requests and imported BCF notes on that design, and comments others leave on the parts of its delivery document drawn from a saved version; a reviewer or commenter is told so above the box they write in. Meeting notes imported from a notetaker you connect, and the transcript of a call the meeting note-taker joined. On a company delivery, its plan and the question a member asks when they ask for optimisation advice |
Checks on a run; ordering alternatives when a run produces more than one. The other three only when someone turns them on: a member asks for the import to be read, the project owner sets up a design hub, you connect a notetaker, or someone sends the note-taker to a call; delivery advice only when a member asks for it | Points to the passages that state a value the checks assume, orders alternatives, proposes company learnings from an import, sorts what a hub message asks for, summarizes meetings, and reads a note-taker's transcript for what was decided, asked and left to do and which changes were asked for, each quoted from what was said. Other uploaded files are not read this way |
| Anthropic | Your brief and request, the current design's dimensions, rooms and construction system, the context packages you selected, tables, document text and reference images you attach to a request, and your company's house rules on a company project. The text of a comment someone asks to have made into a change, with the design it is on. The sheets of a drawing set you ask to have read. For an investment programme whose rules let a model word its notices, the recipient's name and the schedule facts the notice reports | Each time you ask for a design proposal or change in the design conversation, in any design family; when someone asks for a comment to be made into a change; when you have a drawing set read; and when a programme notice is worded | Plans the change as typed data, which our own code checks and builds, reads drawing sheets into proposed inputs, and words a notice that our code checks against its facts before it is sent. If your company has added its own Anthropic key, your company's requests are sent under that account instead of ours, and never under ours if that key cannot be used. Where our Anthropic service is not configured, design-conversation and comment requests go to a Llama model on Cloudflare Workers AI instead, and drawing sets, image review and notice wording do not run |
| Google (sign-in) | An account identifier, email address, profile name and, where Google provides one, a profile-photo address | Only if you sign in with Google | Sign-in |
| Microsoft (sign-in) | An account identifier, email address and profile name | Only if you sign in with Microsoft | Sign-in |
| Apple (sign-in) | An account identifier, and an email address or Apple's private relay address | Only if you sign in with Apple | Sign-in |
| Google (Gemini) | A rendered preview image, the scene instruction and a short list of facts from the saved version, described below | Only when you use the Decorator or AI presentation video and accept its disclosure | Makes an illustrative image or video |
| ElevenLabs | Your microphone audio, and what the voice assistant reads from the open project to answer you: the project name, a summary of the design, the brief, your last request and the planner's answers | Only while you have voice mode on in the chat, from a signed-in account | Turns speech into text, runs the spoken conversation and speaks the answers. We do not store the conversation; requests it sends to the planner are saved in the chat like typed messages |
| Google Workspace | Messages you send to our email addresses, and our replies | When you email us | Hosts our mailboxes |
| PostHog (EU) | One app-open event, without your name, email, brief, file names or design contents | When the app opens | Counts app opens |
| Slack | Build results, enrollment counts and new-account notices, which name the account, described below | When those events happen | Internal notifications to our team |
| Recall.ai (EU, Frankfurt) | Only when someone sends the meeting note-taker to a call from a design's hub, or someone the design knows invites its mail address to a meeting: the meeting link and the start time of each occurrence it joins, the note-taker's name (the design's name) and the call itself, which Recall records and transcribes. An invitation sent to a design's address is kept on its hub with the meeting's title and time. We keep the transcribed lines until the notes and the follow-up are on the design's hub, then keep the notes and the full transcript there | ||
| Google Maps Platform (3D map tiles) | Requests for the map tiles around the site in view, sent from your browser with the Maps key your company provides. Never your name, account or design | Only when someone opens the 3D surroundings on a plant layout | Shows photorealistic surroundings around a site |
| National Land Survey of Finland, Geological Survey of Finland, Open-Meteo and OpenStreetMap's Nominatim | An address you search for, or the coordinates of a point you choose. Never your name or account | Only when you search for an address or place a project on a site | Address search, parcels, ground height, aerial imagery and soil maps |
You can back up your own projects to a GitHub repository you own: each saved project is copied there whole, including its design conversation and any voice notes in it and the text read from attached spreadsheets and PDFs, while images and original files stay with us; GitHub then holds that copy under your agreement with GitHub. A company workspace can also connect services of its own: a GitHub repository that mirrors saved versions (their parameters, check results and exports) and, if the company turns backup on, holds a whole copy of each company project, Slack or Microsoft Teams channels that receive event notices with a link, webhook endpoints, and the meeting notetakers Circleback, Fathom, Fireflies and Granola, from which we read notes with the key you give us. These receive or hold information because an administrator or member connected them, and your own agreement with each of them applies. The owner of a design can likewise connect one Slack channel to it with Connect Slack: messages and mentions in that channel become messages on the design, and the design's answers are posted in that channel's threads, with the follow-up of each meeting its note-taker joined.
The meeting note-taker joins a call under a name everyone in it can see, and records only calls it is sent to, either from the design's hub or by inviting the design's address to the meeting. Only an invitation from someone the design knows sends it: its owner, the people holding its roles and its approved senders, or on a company design the company's members. A cancelled invitation withdraws it. The person who sends it is responsible for telling the people in the call and for having their agreement; it answers in the meeting chat only when someone says “Nordform” or asks about the design, and only with the design as recorded.
A design can also book a meeting. The people its booker names receive a calendar invitation from Nordform's own address with the title, the time and the meeting link the booker gave, and a note that the note-taker will record the meeting when it is set up to. Their calendar answers come back to the design and are kept with the meeting; a reply to the mail goes to the booker.
The deterministic design kernel, our own code, produces all supported geometry and exports; no provider above does. Model providers receive the information needed to perform the requested operation.
Before we add a provider. We will email the administrators of every company workspace at least 30 days before a new provider begins processing information on this list, and update this page.
The optional Decorator feature, when enabled, sends a rendered preview image and an instruction to Google only after the disclosure in that feature is accepted. The instruction holds the selected scene, an optional style description from the catalogue, and a short list of facts read from the saved version that the image must keep: the storey count, the footprint and wall height, the roof pitch, and how many doors and windows each wall has. It does not upload your original documents as part of that render request. Generated decoration can differ from the design and is a derived illustration.
Our PostHog integration uses the EU endpoint for a limited app-open event. Its current configuration disables session recording, automatic interaction capture and person profiles, and uses memory-only persistence. It does not include your name, email, brief, file names or design contents in that event. Providers may still process connection information when receiving requests.
We use Slack for internal operational notifications such as build results, enrollment counts and new sign-ups. A new-account notice names the account: the display name your sign-in provider gave us, your email address and which provider it was. The notification integration excludes design contents, project titles and original documents. Authorized operators may access service records to maintain and support Nordform. We do not sell personal information or use sign-in account information for advertising.
Some providers may process information outside Finland or the EEA. An EU storage location does not guarantee that every support, security or AI operation occurs only in the EU. Applicable provider agreements and lawful transfer safeguards govern such processing. Contact us for information about the safeguards relevant to your use.
Customer image review
When you choose Analyse images in Drawing QA, Nordform sends PNG review derivatives and your review instructions to the configured Anthropic service. Original file bytes stay in your browser; Nordform does not persist the image derivatives or create public image links for this review. Owner-scoped report text and run metadata are retained privately for duplicate-request protection. Downloaded reports can contain the images and are under your control. The company name and report styling do not grant anyone access to the review.
Storage, retention and deletion
We keep cloud project information while needed to provide your workspace, maintain revision history and support the reviews you request. Archiving a project is not deletion. Session and invitation credentials expire; some security, audit and usage records may need to remain after access ends. Retention depends on the purpose, applicable legal obligations and unresolved disputes rather than a single period for every record.
You can remove supported files using the product controls. Your profile in the workspace downloads your account as one file and schedules its deletion, which takes effect after thirty days and can be withdrawn until then; files you uploaded and records Nordform generated are listed there by name and hash and downloaded separately from the project they belong to. Words you wrote inside someone else's project stay with that project, which is why the export carries your copy of them. For project deletion, a workspace you own, or questions about retained records, email privacy@nordformgroup.com. We may verify your identity before acting. We will explain any information that must be retained and why. Removing access cannot recall copies another authorized recipient has already downloaded.
Your rights
Depending on the applicable law, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent where processing relies on it. You may complain to the Finnish Office of the Data Protection Ombudsman, or another competent supervisory authority.
You can revoke Google's connection through your Google Account settings; that does not itself delete a Nordform account or its saved projects. Nordform does not make decisions producing legal or similarly significant effects about you solely through automated processing.
Changes and contact
We will update this page as the service changes and provide notice of material changes where required. Questions and privacy requests: privacy@nordformgroup.com.
Optional AI presentation video
When enabled, AI video sends the displayed model preview and chosen scene instruction to Google only after consent in the export panel. Original documents and review notes are not included. Nordform retains the source preview, settings and output privately against the selected revision. Cancellation stops delivery in Nordform but may not stop Google's processing of an already submitted request. Local model-flyby recording stays on your machine.
Private customer deliveries
Delivery owners can store reviewed image packages and optional reference libraries in private storage. Files are served only after checking a live owner grant or invitation. Nordform email sign-in identifies invited accounts; invitations distinguish viewing from analysis. Shared delivery passwords are no longer accepted. Deliveries and invitations can expire or be revoked. Customer-branded drawing-review PDFs are generated in the browser; model handover PDFs are retrieved from private storage. With a model handover, the owner can also store the design inputs that model was built from, so it can be rebuilt later; only the owner can retrieve them, never an invited account. Both can include confidential source material; downloaded copies remain with the recipient after revocation. Owners can prepare a drawing review by uploading a PDF and writing buyer questions in the app, without model inputs or technical JSON. This records document review, not engineering approval. A new revision preserves earlier drawings and responses; publishing it closes the earlier delivery to new answers. Buyer access to the new revision requires a separate invitation. Owners can also upload a handover PDF, design inputs and evaluation together in the app. Their revision and PDF hash must match before upload; completed files are pinned and an interrupted upload can resume with the same files. When a delivery includes a design evaluation, the owner and each invited account can answer its decisions; the answer, any note and the answering account's email address are stored with the delivery and shown to the owner and the other invited accounts. Answers are kept as a history rather than overwritten. An invitation email carries a link that signs the invited address in once; only a digest of that link is stored, and sending the invitation again, revoking it or its expiry ends it. When the owner chooses, the people already invited receive a separate notice naming the new invitee's email address, without that link. The owner sees, for each invited address, when the invitation email was sent, when its link was first opened (an email security filter that checks links can open it too), when it signed the address in and how many decisions that address has answered. When an invited account answers, the owner receives at most one email an hour about that person, naming them and counting their answers without quoting them. The owner can send a reminder, which is the invitation again with a new link, to someone who has not signed in or answered two days after their last invitation; nothing sends one on its own. An invited account with analysis permission can ask the owner for a checks run: the request stores its note, the asking account's email address, the time and the owner's project it would run on, and is shown to the owner. Nothing runs until the owner approves it; the asking account then sees the name of the project it runs in, the run's state and its check results, and nothing else from the owner's project.
Offers from a Nordform Group company
A company in Nordform Group can send an offer from its own workspace through Nordform. Each person it is sent to receives an email from Nordform's sending address. The email names the salesperson and the company, and replies go to the salesperson. It carries a personal link that opens the offer without an account or password, and it does not contain the offer's title, price or text. We store only a digest of each link. The link opens the latest version the company has sent, and stops working when the company withdraws it or the offer passes its valid-until date.
For each person, the company sees whether their email is queued, sent or bounced, how many times and when their link was opened in a browser, and how many times and when it was fetched by something else, such as an email security filter that checks links. A bounce reported later by the recipient's own mail server may not be seen. Nothing else about a visit is recorded: not how long the offer was read, which files were followed, the IP address, the location or the device. The offer page sets no cookies and loads no analytics. Files linked from an offer are served by wherever the company keeps them, under that host's own terms.