Privacy policy

Last updated 2026-09-18

Who we are

The AI Bakkie ("we", "us") provides Nodara. Our address is Oud Mehta Street, Dubai, United Arab Emirates, and you can reach us at support@theaibakkie.com. "You" means the person reading this.

This policy covers three things:

• this website
• the Nodara console, the web app where technicians sign in
• the Nodara agent, the software installed on the computers ("endpoints") an organisation manages

Our role

For this website and for console account data, we are the controller. We decide why and how that data is used.

For data the agent collects from a customer's endpoints, the customer organisation is the controller. We process that data only on the customer's instructions. If your computer is managed with Nodara and you have a question about data from it, contact that organisation first, usually your employer or IT provider. We will help them answer you.

This website

• Server logs. When you visit, our web server records your IP address, browser user agent, the URL you requested and the time. We use these logs to run and secure the site.
• Analytics, only with your consent. If you accept analytics, we use Google Analytics to understand how visitors use the site. If you decline or ignore the banner, the analytics script is never loaded. See Cookies and similar storage.
• The site has no forms and no advertising, and we do not sell your data. If you email us, we use your message and address only to reply.

Console accounts

When an organisation gives you a Nodara console account, we hold:

• Identity: your email address, your organisation, your role and permissions, and, where your organisation sets them, your team, seniority level and manager.
• Authentication: a password hash (never the password itself), and your multi-factor authentication details if you set it up: an encrypted authenticator-app secret or registered security keys and passkeys.
• Sessions and sign-in security: when each session started, was last used and expires, how you completed multi-factor authentication, and the IP address it came from. We briefly keep failed sign-in attempts, recorded as your IP address and email, to block password-guessing.
• Audit trail: a record of actions taken in the console: who acted, what they did, to which resource and when. Some entries, such as sign-ins, include your IP address.
• Activity you create: for example, alert acknowledgements, approval requests and the reasons given for them, remote session chat messages, files attached to tickets, and ratings or notes you leave on AI answers.
• API keys: the key name, who created it and when it was last used. We store only a hash of the key.

We use this data to provide the service, to keep it secure, and to give your organisation an audit trail of what happened and who did it.

Endpoint data

The agent sends the following to the Nodara control plane. Your organisation's administrators choose which features to turn on, so not every endpoint sends everything.

• Device and operating system inventory: hostname, manufacturer, model, serial number, processor, memory, disks, graphics, BIOS, network adapters, operating system and version, domain membership, and last boot time.
• Software: installed applications (name, version, publisher, install date and location), system services and recent service crashes.
• Software licence keys: administrators can record a licence key against a device, along with the software name, version and a label of their choosing. This is typed in by an administrator; the agent does not collect it. The key itself is encrypted before it is stored, is never included in ordinary listings, and is shown again only when an administrator signed in through the console asks to reveal it — which we record in the audit log. The software name, version, label and dates are ordinary text and are not encrypted.
• User accounts: the name of the user currently signed in to the device, how long the device has been idle, and the local user accounts on it (username and home folder). Administrators can add a contact email for a device's main user, for example to arrange a support session.
• Performance and health: CPU, memory and disk usage, antivirus status, and agent health.
• Network activity: the device's network interfaces and addresses, its open network connections (local and remote addresses and ports, and the program that owns each connection), and the public IP address it connects from.
• Security posture and patches: disk encryption, firewall and screen-lock status, missing and installed updates, and patch results.
• Security monitoring (if your organisation uses Nodara Shield): security-relevant events from the operating system's logs, changes to watched files (file path and owner), configuration checks and tamper alerts.
• Script and command output: when an administrator runs a script or command on a device, its output, errors, exit code and duration are stored centrally so technicians can review them. Diagnostic log bundles an administrator requests are stored after sensitive values are redacted.
• Screen previews (off by default): only if your organisation's owner has turned on unattended screen access, the agent captures a small preview image of the screen about once a minute. We keep only the latest one for each device.
• Mobile devices and network equipment: where an organisation connects a mobile device management service or network devices, we hold the device details and status those systems report.

We use this data so the customer's administrators can monitor, support, secure and update their own devices.

Remote support sessions

• Consent first. By default, before a technician can view or control a screen, the person at the computer is asked to approve it, and a banner is shown while the session runs. There is no prompt in three cases: the device is a server or virtual machine; the customer has turned on unattended access and classed the device as an unattended server; or the customer has turned on unattended access and an administrator starts a background administration session, which does not show or control the signed-in user's desktop. The device keeps its own activity log of what the user allowed and refused, and when the session ended.
• Screen content is relayed, not recorded. The screen, keyboard and mouse stream goes directly between the technician's browser and the device, through a relay server if a direct connection is not possible. Our control plane only helps the two sides connect. We do not record session video.
• What we log. Which technician connected to which device, when, the type of session, who else joined and who had control, whether consent was given, the reason access was allowed, errors, and chat messages sent during the session.
• File transfer during a session goes directly between the two sides, and the device user is asked before a file is sent or received, except where the customer has deliberately turned on file transfer for unattended sessions.

AI assistance

The console includes an optional AI assistant that answers technicians' questions and suggests likely causes and patch plans. It only uses an outside AI provider if the operator of that Nodara installation has configured one. Otherwise it gives simple built-in answers and sends nothing out.

• What is sent, and when. Only when a technician asks a question or requests an analysis, we send the question with a summary of the relevant data. That summary can include device hostnames, identifiers, operating systems and status, alert titles and details, recent performance figures, recent command results and errors, missing patches, recent audit entries (action, actor and resource), and the title and description of a support ticket being discussed.
• To whom. OpenAI or Anthropic, depending on which one the installation is configured to use.
• What we keep. We do not store conversations on our servers. The conversation is kept in the technician's browser until they sign out. If a technician rates an answer, we store the question, the answer and their rating so we can improve the assistant.

Who we share data with

• Hosting and infrastructure providers that run our servers and store our data.
• Google, for website analytics only, and only if you consent.
• OpenAI or Anthropic, for the AI assistant as described above, where it is configured.
• Team Cymru, a public IP address directory service. We look up which network owns the public IP addresses that managed devices connect to, and those addresses are sent as lookup queries.
• Services your organisation connects. We send data to email servers, chat or paging tools, webhooks, IT service management tools, mobile device management services and log receivers only when a customer sets them up, and only to the destinations the customer chooses. We do not use an email delivery provider of our own for these messages. Where a customer connects an IT service management tool to receive device health, that customer can also choose to include their software inventory: the applications installed on their devices, and their software licence records — the software name, version, label, dates and whether a key is stored, but never the key itself. This is off unless one of the customer's administrators turns it on, and turning it off again tells the other system to drop what it holds.
• Authorities, where the law requires it.

We do not sell personal data.

International transfers

If data leaves the country it was collected in, we rely on appropriate safeguards, such as standard contractual clauses.

How long we keep it

• Account data: for as long as the account exists, plus a short period to close things down.
• Endpoint data: according to the customer's retention settings and our defaults. By default, detailed performance data is kept for 90 days and hourly summaries for 365 days. Security monitoring events stay in the live database for 30 days by default and are then moved to archive storage, where they are kept until the customer deletes them. For most other device records, only the latest version is kept, and it is replaced with each update. When a customer deletes a device or its account, the related data is deleted with it.
• Audit logs: customers can choose an audit-log retention period; audit events are currently kept until the customer deletes them.
• Failed sign-in records: removed automatically after the short window used to block password-guessing.
• Website analytics: at most 14 months.

Security

• Encryption in transit: the website and console are served over HTTPS.
• Encryption of stored credentials at rest: device keys, authenticator secrets, remote session tokens, software licence keys and integration credentials are encrypted with AES-256-GCM. Passwords and API keys are stored only as hashes.
• Signed command execution: each device checks that a command carries a valid signature from its own device key before running it.
• Role-based access control, with optional approval steps and multi-factor authentication for sensitive actions.
• Audit logging, with sensitive administrative actions signed and chained to the previous signature so tampering can be detected.

Your rights

Depending on where you live, you may have the right to:

• access your personal data
• have it corrected (rectification)
• have it deleted (erasure)
• restrict how it is used
• object to how it is used
• receive it in a portable format
• withdraw consent at any time, without affecting what happened before

To use these rights, email support@theaibakkie.com. For data from a managed device, we will pass your request to the organisation that manages it. You also have the right to complain to a data protection supervisory authority.

Cookies and similar storage

You can change your analytics choice at any time by clearing this site's data in your browser.

Children

Nodara is a business service. It is not meant for children under 16.

Changes to this policy

When we change this policy, we update this page and the date at the top.

Contact

Email support@theaibakkie.com, or write to The AI Bakkie, Oud Mehta Street, Dubai, United Arab Emirates.