Privacy policy

This Privacy Policy explains how Dot Square Lab Ltd ( "Nerb", "we", "us"), a company registered in England & Wales, collects, uses, stores, and shares information when you use the Nerb service at nerb.ai and its hosted MCP gateway (the "Service"). Dot Square Lab Ltd is the data controller for the purposes of UK data protection law. If you have any questions, email hello@nerb.ai.

1. What Nerb does

Nerb is a hosted gateway that, with your explicit authorization, connects to your advertising and analytics platforms — today Google Ads, Google Analytics 4, Google Search Console, and Reddit Ads, with more added over time — and makes that data available to your own large-language-model or MCP client (for example Claude or Cursor). Access to analytics and search data (such as Google Analytics and Search Console) is read-only; for advertising platforms (such as Google Ads and Reddit Ads) Nerb can also make changes that you direct. Nerb acts on the requests you make through the client you connect; it is an instrument you operate, not an advertising or analytics product of our own.

2. Information we collect and our lawful basis

Under the UK GDPR we must have a lawful basis for each type of personal data we process. This section sets out what we collect and the legal ground we rely on in each case.

Account information

When you create a Nerb account we store your email address and a one-way bcrypt hash of your password. We never store your password in plain text.

Legal basis: contract performance (Article 6(1)(b)) — processing this data is necessary to create and maintain your account and provide the Service.

Platform connection data

When you connect a platform, its OAuth flow returns to us a refresh token (or, for some platforms, an equivalent long-lived API credential) together with an account identifier, and — where the platform provides them — your account email address or username and the set of scopes you granted. We store that credential encrypted at rest (AES-256-GCM, with a key derived from a server secret) so that we can mint short-lived access tokens on your behalf. Access tokens live only in memory for roughly an hour before they are refreshed or discarded.

Legal basis: contract performance (Article 6(1)(b)) — storing and using your platform credentials is necessary to deliver the Service you have authorised.

Platform service data

When you make a request through your connected client, Nerb uses a short-lived access token to read the relevant data from the connected platform's API — or, for advertising platforms, to submit the changes you direct — and relays the response back to your client. We do not persist this reporting data in our own systems; it passes through to fulfil your request and is not stored beyond what is briefly held in memory to serve the response.

Legal basis: contract performance (Article 6(1)(b)) — relaying platform data is the core function of the Service.

Other information

• Feedback: messages you send us through the in-product contact tool, with your email address, so we can respond. Legal basis: legitimate interests (Article 6(1)(f)) — we have a legitimate interest in receiving and responding to user feedback to improve the Service, and have assessed that this does not override your rights.
• Analytics and advertising measurement: where enabled, we use Google Analytics 4 and Google Tag Manager to understand site usage, and advertising technologies from Google and Reddit to measure how our own ads perform. This can involve sharing limited event data with Google and Reddit, including a hashed, irreversible form of your email address for conversion matching if you provide one. In the UK, EEA, and Switzerland none of this runs until you accept; elsewhere it runs by default until you opt out, and we honour Global Privacy Control everywhere. See our Cookie policy. Legal basis: consent (Article 6(1)(a)). You can change or withdraw consent at any time via the "Cookie preferences" link in the footer.

Security and operational data

We also process limited technical data — such as server logs, error logs, and request metadata — for security, debugging, and service reliability. This data is retained for up to 90 days and then automatically purged.

Legal basis: legitimate interests (Article 6(1)(f)) — maintaining the security and stability of the Service. We have assessed that these interests do not override your rights and freedoms. You may object to this processing by contacting hello@nerb.ai.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of any processing carried out before withdrawal.

3. How we use your platform data

We use the data accessed through the Service for one purpose only: to provide the Service to you, at your direction — reading the data you ask for and, for advertising platforms, making the changes you instruct — and relaying results to the client you have connected. We do not use it for any other purpose.

4. Platform-specific data commitments

Google

Nerb's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not and will not:

• sell Google user data;
• use or transfer Google user data for serving advertisements;
• use Google user data to train or improve generalized or non-personalized artificial-intelligence or machine-learning models;
• allow humans to read Google user data, unless we first obtain your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymized.

Reddit

Where you connect a Reddit Ads account, we access your data through the Reddit API in accordance with Reddit's Developer Terms and Data API Terms. We apply the same commitments as above: we do not sell Reddit user data, use it for advertising, use it to train AI or ML models, or allow humans to read it except with your consent, for security, or to comply with law.

All platforms

As additional platforms are connected to Nerb over time, the same principles apply: your platform data is used solely to provide the Service at your direction and is subject to the terms imposed by each platform's API programme.

5. How we store and protect data

• Credentials are encrypted at rest with authenticated encryption; application secrets are managed in a dedicated secrets manager (HashiCorp Vault).
• All data in transit is protected with TLS.
• The Service and its database run on Google Cloud Platform in Europe.
• We request only the scopes each platform needs. For Google: adwords (Google Ads — read and write; the only scope Google offers for the Ads API), analytics.readonly (read-only), and webmasters.readonly (read-only). For Reddit: adsread and adsedit (Reddit Ads — read and write), and identity (read-only; your Reddit username, used only to label the connected account).

6. Sharing and sub-processors

We do not sell your data and we do not share your platform data across customers. We use a small number of sub-processors to run the Service:

• Google Cloud Platform — hosting and database.
• Resend — transactional email.
• HashiCorp Vault — secrets management.

Separately, for our own website analytics and ad measurement, and only where you have consented (or, outside the UK, EEA, and Switzerland, have not opted out), we share limited event data with Google (Analytics, Tag Manager, and Ads) and Reddit (its advertising pixel and Conversions API), as described in our Cookie policy. This is separate from the platform data you connect through the Service, which is never used for advertising.

We may also disclose information where required by law or to protect the rights, safety, and security of Nerb and its users.

7. Retention and deletion

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law.

Operational data — deleted when no longer needed:

• Platform credentials (encrypted OAuth tokens): deleted immediately when you disconnect a platform or close your account.
• Platform service data (API responses, reporting data): not persisted. Held in memory only for the duration of the request.
• Server and error logs: up to 90 days, then automatically purged.
• Feedback messages: kept until you close your account, then deleted.

Contractual records — kept for up to 6 years after account closure to meet our obligations under the Limitation Act 1980 and, where applicable, HMRC requirements:

• A minimal record of your account: email address, date created, and date closed.
• The version of the Terms of Service you accepted.

Invoices and payment records (once the Service introduces paid plans) are retained by our payment processor, Stripe, as the system of record.

You can disconnect any connected account at any time from the Connected accounts page; doing so revokes and deletes the stored credential. You can also revoke Nerb's access directly from the platform's own settings — for Google, from your Google account permissions. To delete your Nerb account and all associated data (other than the contractual records described above), use Close account on the Billing page, or email hello@nerb.ai and we will action the request within one month.

8. Your rights

If you are in the UK or EEA, you have rights under the UK GDPR and the Data Protection Act 2018, including the rights to access, rectify, erase, restrict, port, and object to the processing of your personal data. To exercise any of these, contact hello@nerb.ai. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).

9. International transfers

Some of our sub-processors may process data outside the UK. Where they do, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) as required by applicable law.

10. Children

The Service is not directed to children and is intended for use by people aged 18 or over.

11. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date above and, where changes are material, take reasonable steps to notify you.

12. Contact

Dot Square Lab Ltd — hello@nerb.ai. See also our Terms of Service.