Privacy policy

1. Who is responsible

Nebb Capital is responsible for the processing described here.

2. Information we process

• Google Ads connection: an encrypted OAuth refresh token, the configured Google Ads customer ID and optional manager account ID, the internal ID of the team member who connected the account, connection and check dates, and connection error codes. Google handles Google Account sign-in; Nebb does not receive your Google password.
• Advertising performance: for our own Google Ads accounts only, daily campaign reporting data: campaign ID and name, date, currency, cost, clicks, impressions, conversions and conversion value. These are aggregate account metrics, not information about individual Google users.
• Keyword research (where available): submitted keywords, selected country and language, and historical search-volume estimates. These are aggregate research metrics, not individual Google users’ search histories.
• Access and support: information needed to operate authorised team accounts and sessions, technical request information such as IP addresses and browser details processed by our hosting infrastructure, and information you send when contacting us.

3. Purpose and Google authorisation

We use this information to maintain the requested connection, calculate the advertising cost and profit of our own stores per day, assess product demand for selected markets, display this to authorised team members, secure the application and respond to support requests.

The Google Ads API uses the https://www.googleapis.com/auth/adwords permission. Google describes this permission broadly, including managing Google Ads accounts and data. Nebb uses it read-only: to list the accounts the owner can access, to read daily campaign reporting data of our own accounts so we can calculate the profit of each store, and to check connectivity. It does not create, edit or delete campaigns, budgets, users or billing settings, and it is not used for accounts of third parties.

Requests to Google include the relevant account identifiers, keywords, country and language. Only an authorised dashboard owner can initiate or disconnect the connection. Google authorisation can be withdrawn at any time.

Where personal information is involved, we rely on our legitimate interests in securely operating our internal business tools and handling support, and on consent where required. Google OAuth permission controls API access; it does not give public visitors access to Nebb.

4. Storage, access and sharing

Connection information and research results are stored in our application database. Refresh tokens are encrypted at rest, and communication with Google uses HTTPS. Access to the dashboard is authenticated and restricted according to team permissions.

Google processes the API requests we send to it. Our hosting and infrastructure providers process information needed to operate the service. Information may also be disclosed where required by law. We do not sell Google user data or use it for personalised advertising.

Nebb Discovery’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google account data and OAuth credentials are not used to train general-purpose AI models.

Google and other service providers may process information outside your country. Where applicable data protection law requires safeguards for international transfers, the relevant safeguards must apply.

5. Retention, disconnection and deletion

The stored Google connection is kept while connected. Using Disconnect in Nebb removes the saved connection, including its encrypted refresh token, account identifiers and pending OAuth attempts, from the active database. You can also revoke access through your Google Account connections.

Disconnecting does not automatically delete previously collected advertising performance data or keyword research. Daily cost figures remain part of our financial records (bookkeeping), and research results remain with the relevant research records until removed; the 30-day freshness check is a refresh rule, not an automatic deletion period. Contact us to request deletion of retained information associated with your connection.

Temporary OAuth attempts expire after ten minutes. They are removed on successful use, when the connection is disconnected, or during cleanup when another authorisation attempt starts. Support correspondence and technical records are retained only for as long as needed for their purpose, security or applicable legal obligations. Deletion from the active application may not immediately remove copies in backups.

6. Cookies and external resources

Nebb uses necessary session and security cookies for sign-in and a temporary cookie for Google authorisation. A browser preference stores the selected colour theme. The public pages do not add advertising or analytics trackers. The shared site styling loads fonts from Google Fonts, which causes your browser to send technical request information to Google.

7. Your choices and rights

You can decline or revoke Google access and ask us about the information we hold. Subject to applicable law, you can request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. Send requests to TODO-BRAND-contact@example.com. We may need to verify your identity before acting on a request.

You can also raise a concern with the Dutch data protection authority, the Autoriteit Persoonsgegevens, or your local supervisory authority.

8. Changes and contact

We will update this page when the described processing changes and revise the date above. For questions about Nebb Discovery or this policy, contact TODO-BRAND-contact@example.com.