Privacy policy
About this translation. This is an English translation of the Spanish original, provided for convenience. If the two versions differ, the Spanish version prevails.
This policy explains what personal data naab AI processes, why, on what legal basis, how long we keep it, who we share it with and how you can exercise your rights. It describes how the service works today. If anything changes, we'll update it and change the date above.
In short
- naab AI only reads the accounts you connect (Google Ads, Meta Ads, Google Analytics 4, Google Search Console and the other sources in the catalog). It doesn't create, modify, pause or delete anything in them.
- We don't sell data, we don't use it for advertising and we don't use it to train artificial intelligence models.
- Data is hosted on Google Cloud, in the European Union: in Belgium, with backups in the Netherlands and in Google Cloud's European Union multi-region.
- Some document features send the documents' text to AI providers (such as OpenAI) so they can be searched and summarized. We explain this in section 5.
- We only use technical cookies, which are essential for signing in and protecting your account. No analytics or advertising cookies.
- You can disconnect a source from naab whenever you want: syncing stops, naab deletes the stored authorization and asks Google or Meta to withdraw access. If they can't confirm it, naab tells you and you withdraw it yourself from your Google or Meta account (see section 4.6).
- naab also has a competitor analysis module, which is not part of the offering, with public information about other brands that may include personal data. We explain this in section 14.
1. Who the controller is
naab AI is a service of Calendulab. The data controller is:
- Operator: Calendulab Digital, S.L.U.
- Tax ID (CIF): B56453210
- Registered address: C/ Jorge Manrique, 6, 28420 La Navata (Galapagar), Madrid
- Privacy contact: hi@naab.ai
In this policy, “naab”, “we” and “the service” refer to naab AI and its operator.
2. When we are controllers and when we are processors
naab AI is a service for businesses and professionals. Depending on the data, we act in one of these two roles:
- As controller, for the data we need to provide the service and to deal with you: user accounts and their access, security, access requests and sales contact, the public information we collect for competitor analysis (section 14) and, once there is billing, invoicing.
- As processor, on behalf of the client company, for the content that company brings to naab: data from the platforms it connects, its documents, tasks, comments, time logged, procedures, annotations and brand context. In that case the client company is the controller and we process the data following its instructions, under the data processing agreement that forms part of the Terms of service.
If your data appears in the content of a naab client company (for example, you're one of its employees and you're assigned tasks), that company decides about it. You can contact that company or us; if you write to us, we'll pass your request on to it.
3. What data we process
Account and access
- Username and, if provided, first name, last name and email address.
- The password, which is stored only as a cryptographic digest (hash), never in plain text.
- Two-factor authentication (2FA): the authenticator app secret is stored encrypted and the recovery codes, as hashes.
- The organizations, brands and workspaces you have access to and your role in each one (viewer, editor, admin or owner).
- The API keys you create (stored as hashes) and the connections you authorize for your AI assistant (MCP connector), with their permissions and expiry.
- Which version of the Terms of service and of this policy you accepted, the language they were shown to you in, and when. Each new version you accept is stored separately, without deleting the earlier ones.
Security and technical logs
- A security event log: successful and failed sign-ins, 2FA use, password changes, creation and revocation of keys, connection and disconnection of sources and changes to a team's members. It doesn't store your IP address or your browser in plain text, but an encrypted fingerprint (HMAC) that lets events be linked without revealing the original value.
- The technical server logs that Google Cloud generates with each request (they include the IP address, the date, the URL requested and the browser). They are used to operate the service, resolve incidents and detect abuse.
- Usage counters per brand and month (for example, number of queries), without the content of those queries.
Content the client company brings to naab
- Data from connected platforms: aggregated daily metrics (spend, impressions, clicks, conversions, revenue, sessions, etc.), the ID and currency of the connected account and, for Google Ads and Meta Ads, the ID, name, status and activity dates of each campaign, with its totals of spend, clicks, impressions and conversions for each active period. For Meta Ads, also the settings of campaigns, ad sets and ads (name, status, objective, budget, spend caps, bid strategy, learning phase and dates) when queried on demand; those settings are not stored. The details are in section 4.
- Tasks, comments, time logged, procedures (SOPs) and recurring series.
- Timeline annotations and the market calendar.
- Documents you upload or paste, the text extracted from them and, where applicable, their summary and search index (see section 5).
- Brand context: a profile of the business, its advertising and its tone of voice.
This content may include personal data of third parties (for example, employees' names in tasks or data inside a document). The client company decides what it uploads and is responsible for being entitled to do so.
Sales contact
The data you give us when you request access or write to us (name, email address, company and the content of your message).
Billing
Once the service is billed, the client company's billing data. There is no billing inside the application today: invoicing is handled outside naab, by email, under the proposal or contract signed with each client. When we enable billing in the application, we'll update this policy with the payment provider and the invoice retention periods (in Spain, 4 years for tax purposes and 6 for commercial purposes).
4. Data we receive from Google and Meta
When you connect a source, you sign in on the provider's own screen (Google or Meta) and authorize naab AI to access it. naab never sees your Google or Meta password. What it receives is an access token, which is stored encrypted and tied to your brand.
4.1. Permissions we request and what for
| Source | Permission naab requests | What naab uses it for |
|---|---|---|
| Google Ads | https://www.googleapis.com/auth/adwords |
Listing the Google Ads accounts you have access to (including those managed from a manager account) and reading their performance: spend, impressions, clicks, conversions and their value, campaigns, search terms and negative keywords. It's the only permission the Google Ads API offers; technically it would allow changes to the account, but naab only runs read queries. |
| Google Analytics 4 | https://www.googleapis.com/auth/analytics.readonly |
Listing your properties and reading their aggregated reports (sessions, users, conversions, revenue, products, etc.). It's a read-only permission. |
| Google Search Console (if you connect it) | https://www.googleapis.com/auth/webmasters.readonly |
Reading aggregated search performance for the site you choose (queries, clicks, impressions and position). It's a read-only permission. |
| Meta Ads (Facebook and Instagram) | ads_read |
Listing the ad accounts you have access to and reading their statistics (spend, reach, impressions, clicks, purchases and other actions) and the settings of their campaigns, ad sets and ads (name, status, budget and bid strategy). It's a read-only permission: naab doesn't create, modify or pause campaigns, ads or budgets. Earlier versions of naab also requested the ad-management and Business Manager permissions, which it has never used; if you connected Meta with one of them, Meta keeps them granted (reconnecting does not remove them) until you remove naab under "Business Integrations" in your Facebook settings; naab still doesn't use them. |
| Google Merchant Center (if you connect it) | https://www.googleapis.com/auth/content |
Listing the Merchant Center accounts you have access to and reading, for the one you choose, the performance of its product listings (clicks, impressions and CTR, from ads and free listings) and, when you query it, each product's performance, status and price, the summary of product statuses and the account's issues. It's the only permission the Merchant Center API offers; technically it would allow changes to products, data sources and account settings, but naab only runs read queries. |
naab doesn't ask for access to your Google profile or your email: it doesn't obtain your name or your email address from Google or Meta.
4.2. What we use this data for and what we store
We use Google and Meta data solely to provide the features you see in naab:
- Showing your metrics on the timeline, alongside your annotations, the market calendar and campaigns, in the currency each account declares.
- Answering the queries that you or your AI assistant make through naab (for example, “last week's spend” or “search terms with no conversions”).
- Alerting you to connection errors and giving you support when you ask for it.
naab syncs periodically and stores the aggregated daily metrics of each connected account, its ID and its currency, and, for each Google Ads and Meta Ads campaign, its ID, name, status and activity dates, with its totals of spend, clicks, impressions and conversions for each active period. On-demand queries (search terms, negative keywords, the status of Merchant Center products or custom reports) are requested from the provider at that moment, returned to whoever asked and not stored in naab.
4.3. What we don't do with it
- We don't sell it or hand it over to data brokers.
- We don't use it for advertising, to build profiles of people or to serve you ads.
- We don't use it to train artificial intelligence models, our own or third parties'.
- We don't use it to assess anyone's creditworthiness or for lending purposes.
- We only transfer it to provide the service: to you and your AI assistant when you ask for it, to the subprocessors on the published list, when required by law or to protect the security of the service, or, in the event of a merger, acquisition or sale of the business, only with your prior express consent.
- No one on our team reads it unless you ask us to (for example, to give you support or because you've signed up for the managed service), for security reasons (investigating abuse or a failure) or because the law requires it.
4.4. Limited use of Google data
naab AI's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
4.5. Other sources in the catalog
Besides the ones above, naab's catalog includes connectors for other platforms (Shopify, Klaviyo, Stripe, Microsoft Advertising and Windsor.ai). If you connect any of them, naab follows the same approach: it only reads and stores aggregated daily metrics; for those connected via Windsor.ai it also stores campaigns, as with Google Ads and Meta Ads. For example, from Shopify it only requests order amounts and line items, without your customers' data; from Stripe it counts each day's new customers without storing who they are. The API keys you give us for these sources are stored encrypted. In the managed service, our team may connect sources via Windsor.ai with Calendulab's Windsor account; in that case Windsor processes that data as our subprocessor (see Subprocessors).
4.6. How to disconnect a source and withdraw access
- From naab: in your workspace's Settings › Integrations, disconnect the source. Syncing stops at that moment. When you remove the brand's last source that uses your Google or Meta account, naab deletes the stored authorization and asks Google or Meta to withdraw naab's permission from your account; the same happens when you delete the workspace, the brand or the organization. While another source in the brand uses that same account (GA4, Search Console, Google Ads and Merchant Center share the Google one), the authorization is kept for it. If Google or Meta don't confirm the withdrawal, or if that same account is still connected in another naab brand (withdrawing the permission would disconnect it there too), naab tells you when you disconnect and you can withdraw it yourself with the steps below. Metrics already imported stay in your workspace until you delete that workspace or the brand, or ask us to erase them.
- From Google: at myaccount.google.com/permissions, choose naab AI and remove its access.
- From Meta: in your Facebook account settings, under “Business integrations” (facebook.com/settings?tab=business_tools), remove naab AI.
Once access is withdrawn in Google or Meta, naab can no longer read new data from that account. To have us also erase the data already imported and the stored authorization, write to us at hi@naab.ai.
Your AI assistant's connection to naab (MCP connector) is revoked in Settings › API keys.
5. Artificial intelligence
5.1. Your AI assistant
naab is designed to be used from your own AI assistant (for example, Claude or ChatGPT) through the MCP protocol. When you connect it, a naab screen shows you the permissions it requests (query; create, modify and delete work; run processes) and you decide whether to authorize it. Your assistant only sees the brands you have access to and can never do more than your role allows.
The data your assistant requests from naab travels to that assistant and is subject to your terms with its provider. If you choose it and sign up for it yourself, that provider is not a naab subprocessor. We recommend checking how it handles your data before connecting it.
In the managed service, it's the Calendulab team that works your accounts with naab, including from the AI assistants Calendulab subscribes to. Those assistants receive the data the team queries (for example, Google Ads metrics, campaigns or search terms) and their provider processes it as our subprocessor: it's on the subprocessor list. The team only uses those assistants on business or API plans whose terms exclude using your data to train models. Today these are Claude (Anthropic) and ChatGPT (OpenAI), on business or API plans; their terms are on the subprocessor list.
5.2. AI features naab runs on its servers
Some naab features use third-party language models, which act as our subprocessors:
- Document search: when you upload or paste a document, a daily process sends its text to the OpenAI API to compute a numerical representation (embedding) that lets it be searched by meaning. Each document search also sends the search text to OpenAI for the same purpose.
- Document summaries: that same process sends the document's text to a language model to generate a short summary that helps find it.
- Brand profile proposal: if you ask naab to propose your brand's profile from your documents, it sends excerpts of the documents marked as context to a language model. The proposal isn't saved until you apply it.
Search representations are always computed with OpenAI. The language model that summarizes documents and proposes the brand profile is chosen in naab's internal configuration among models from OpenAI, Anthropic and Google. All three are on the subprocessor list with their location and safeguards, because the configuration can switch between them. These providers receive the text needed for each task, we don't use it to train models and their API terms exclude training on that data and limit its retention to a short period (at most 30 days at OpenAI and Anthropic) for abuse detection.
These features don't send Google Ads, Meta Ads or Google Analytics data to any AI model. naab also has an internal assistant (“Nerd”) that can send data from connected sources to language models (depending on its configuration, from OpenAI and Anthropic) to answer questions; it isn't available to clients and only our team uses it. It isn't enabled in production today: in the managed service the team works with the assistants in section 5.1.
6. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing user accounts, giving access to the service and providing the contracted service (timeline, tasks, documents, context, MCP connector) and its support. | Performance of the contract with the client company (Art. 6(1)(b) GDPR). For users who work for the client, legitimate interest in maintaining that professional relationship (Art. 6(1)(f) GDPR and Art. 19 of the Spanish data protection act, LOPDGDD). |
| Connecting the sources the client company chooses (Google, Meta and others) and reading their data. | The client company decides this as controller; we do it as processor, under the data processing agreement in the Terms (Art. 28 GDPR) and in performance of the contract with it (Art. 6(1)(b) GDPR). The authorization given on the Google or Meta screen is the technical permission to read the account, not the legal basis for the processing. |
| Protecting the service and the accounts: mandatory 2FA, security event log, usage limits and abuse detection. | Legitimate interest in the security of the service and its users (Art. 6(1)(f) GDPR) and the duty of security (Art. 32 GDPR). |
| Handling access requests and sales inquiries. | Taking pre-contractual steps at your request (Art. 6(1)(b) GDPR) or legitimate interest in answering you (Art. 6(1)(f) GDPR). |
| Measuring use of the service in aggregate (per brand and month) to operate and size it. | Legitimate interest (Art. 6(1)(f) GDPR). |
| Analyzing competitors with public information about other brands (section 14). | Legitimate interest (Art. 6(1)(f) GDPR). |
| Invoicing and meeting accounting and tax obligations, once there is billing. | Legal obligation (Art. 6(1)(c) GDPR). |
| Processing the rest of the client company's content (section 2). | The client company decides this as controller; we act on its instructions (Art. 28 GDPR). |
We don't make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
7. How long we keep data
| Data | Period |
|---|---|
| User account | While the account is active. After it's closed, we deactivate it immediately and erase its data within 30 days, except for data we must keep by law. |
| Client company content (imported metrics, tasks, documents, annotations, context) | For as long as the contract lasts or until the client deletes it (imported metrics are deleted when the workspace or the brand is deleted, or if the client asks us to). When the contract ends, the client has 30 days to export it and we erase it within the following 30 days. Disconnecting a source doesn't delete metrics already imported. |
| Access authorizations for Google, Meta and other sources (encrypted tokens) | Until you disconnect in naab the last source that uses them, the brand they belong to is deleted, or you ask us to erase them. When they are deleted, naab also asks Google or Meta to withdraw the permission (see section 4.6). If you withdraw access from Google or Meta, the stored authorization stops working. |
| naab session | Access expires after 15 minutes and renews automatically while you use the application; if 7 days go by without using it, you'll have to sign in again. Your AI assistant's connections use 1-hour access renewable for 30 days from the last renewal, until you revoke them. |
| Technical server logs | 30 days. |
| Security event log | 2 years. Today the log doesn't expire on its own: we purge it manually when that period is up. |
| Database backups | Automatic daily backups, kept for 30 days, and point-in-time recovery for the last 7 days. We also make manual backups before each deployment that modifies the database and before other sensitive operations: those don't expire on their own and are kept for 90 days. Deleted data may remain in these backups until they are deleted. |
| Document files | When you delete a document, it disappears from naab immediately. To also remove the original file from storage and its previous versions, ask us; we'll do it within 30 days of your request (storage keeps a backup copy of the deleted file for 7 more days). |
| Sales contact data | If the request doesn't lead to a contract, 12 months from the last contact. If it does, for as long as the relationship lasts. |
| Public information from competitor analysis (section 14) | Not deleted automatically today. We commit to keeping it no longer than 24 months from capture: until deletion is automatic, we erase it manually when that period is up. |
We may also keep data blocked during the limitation periods for any legal liability arising from the processing, available only to judges, courts and authorities.
8. Who we share data with
To provide the service we use providers that process data on our behalf (subprocessors): hosting on Google Cloud, the AI providers in section 5 and, in the managed service, the AI assistants and the Windsor.ai account our team uses. For competitor analysis, the providers in section 14. The full list, with their location and safeguards, is in Subprocessors.
We don't disclose data to third parties except where legally required (for example, to authorities or courts that require it) or in the event of a merger, acquisition or sale of the business, with prior notice (and, for data received from Google and Meta, only with your prior express consent, as stated in section 4.3).
Google, Meta and the other platforms you connect are not recipients: they are the source of the data. If you sign up for it yourself, your AI assistant isn't a recipient of ours either: it receives what you ask it for (see section 5.1).
9. International transfers
The application, the database and the files are in the European Union: Google Cloud's Belgium region (europe-west1). Automatic database backups are in the Netherlands (europe-west4) and manual ones in Google Cloud's European Union multi-region (eu), which stores data in data centers in EU countries.
These are the cases in which data may leave the European Economic Area:
- Google Cloud technical logs: they're stored in a global Google location, which may be outside the European Union. The transfer is covered by the European Commission's standard contractual clauses incorporated in the Google Cloud data processing addendum.
- AI providers: OpenAI and, depending on the configuration, Anthropic or Google (see section 5) may process data in the United States. With each of them we have accepted their data processing addendum, which incorporates the European Commission's standard contractual clauses for those transfers.
- Managed service: the provider of our team's AI assistants and Windsor.ai. Anthropic and OpenAI process in the United States, under the standard contractual clauses of their data processing addenda; Windsor.ai (Windsor Group AG) processes in Switzerland, a country with a European Commission adequacy decision.
- Competitor analysis: Bright Data and Apify (section 14). Bright Data (Bright Data Ltd) is in Israel, a country with a European Commission adequacy decision; Apify (Apify Technologies s.r.o.) is in the Czech Republic, within the European Union.
The details for each provider are in Subprocessors.
10. How we protect data
- All connections are encrypted (HTTPS with HSTS).
- Two-factor authentication (2FA) is mandatory for all accounts.
- Passwords, recovery codes and API keys are stored as hashes. Access tokens for Google, Meta and other sources, and third-party API keys, are stored encrypted; the encryption key lives in a secrets manager, separate from the database.
- The database only accepts encrypted, authenticated connections through the Cloud SQL connector, with a client certificate; it has no open authorized networks.
- Each client company only sees its own data, and within it each person sees what their role allows. A viewer can't modify anything.
- Sensitive operations are recorded in a security log that can't be modified from the application.
- Staff with administrative privileges can technically see all clients' data. That's why this access is restricted to authorized staff and is only used for support, security, legal compliance or to provide the contracted managed service. Only the designated Calendulab staff who operate the service have it, always with 2FA, and a written internal rule sets when it may be used.
If we detect a security breach affecting personal data, we'll notify the supervisory authority and, where appropriate, the people affected, within the time limits set by law. Where we act as processor, we'll notify the client company without undue delay.
11. Your rights
You can exercise your rights at any time to:
- Access: find out what data about you we process.
- Rectification: correct data that's inaccurate.
- Erasure: ask us to delete it.
- Objection: object to processing based on legitimate interest.
- Restriction: ask us to stop using it while a complaint is being resolved.
- Portability: receive it in a structured format. naab lets you download in JSON the tasks, comments, procedures, annotations and document index of a brand or organization, and query metrics from your AI assistant.
- Withdraw your consent for processing based on it, without affecting what was processed before. Today, none of the processing in this policy is based on consent. To stop giving a source access, follow section 4.6.
To exercise them, write to us at hi@naab.ai stating the right you want to exercise and a detail that lets us identify you (for example, your naab username). We'll reply within one month, which may be extended in the cases provided by law. If the request concerns a client company's content, we'll pass it on to that company.
If you believe we haven't handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
13. Minors
naab AI is a service for businesses and professionals. It isn't directed at minors and we don't create accounts for them.
14. Public information about other brands (competitor analysis)
naab has a competitor analysis module that isn't part of the offering described in the Terms of service, but that is active today. For that module we automatically collect information that other brands and third parties have made public on the internet. For this processing, we are the controller.
What personal data it may include
- Public reviews by those brands' customers (for example, on Trustpilot): the name the author signs with, the rating, the date, the title and the text.
- Public posts from those brands' social media accounts (such as Instagram, TikTok or Facebook): the text, hashtags, accounts mentioned or tagged, public metrics (likes, comments and views) and, in some cases, a copy of the image.
- Public profiles of the accounts those brands collaborate with (for example, content creators): username, profile address and photo, bio, category, whether the account is verified and the number of followers, accounts followed and posts.
For each post and each profile we also store the full response from the provider that obtains it, which may include other public data.
What for and on what legal basis
To analyze those brands' commercial and communications activity: their products and prices, their promotions, their reputation and who they collaborate with. We don't use this data to contact those people, to send them advertising or to make decisions about them. The legal basis is the legitimate interest, ours and our clients', in understanding the market based on published information (Art. 6(1)(f) GDPR). We have weighed that interest against the rights of the people concerned: the information is already public and is published by business accounts or open profiles, it's processed in aggregate for market analysis, it isn't used to contact anyone or to make decisions about anyone, and you can object at any time.
Who processes it and who sees it
- It's obtained on our behalf by Bright Data (access to public web pages, including review pages, through its network of proxies and browsers) and Apify (reading public social media posts and profiles).
- The text of the posts, with their hashtags and tagged accounts, is sent to the OpenAI API to classify it (content type, product category, whether it announces a promotion).
- It's stored on Google Cloud, in the European Union, and naab users with access to the module can view it.
These providers' locations and safeguards are in Subprocessors.
How long and how to object
Today this data isn't deleted automatically. We commit to keeping it no longer than 24 months from capture: until deletion is automatic, we erase it manually when that period is up. If you're the author of a review or the owner of an account and you don't want us to process your data, or you want to exercise any other right in section 11, write to us at hi@naab.ai.
15. Changes to this policy
If we change how we process data (for example, when adding a source, a permission or a provider), we'll update this policy and its version date before applying the change. If the change is significant, we'll let each account's admins know through the contact details we have.