Terms of service

1. Who we are

naab AI is a product of Calendulab, provided by:

• Operator: Calendulab Digital, S.L.U.
• Tax ID (CIF): B56453210
• Registered address: C/ Jorge Manrique, 6, 28420 La Navata (Galapagar), Madrid
• Contact: hi@naab.ai

Registered with the Madrid Companies Registry, volume 45768, folio 94, section 8, sheet M-804493, entry 1.

2. The service

naab AI is an online service that brings together, in one place, the data from a brand's advertising and analytics platforms and its marketing work, and makes them available to the client's AI assistant (for example, Claude or ChatGPT) through the MCP protocol, as well as in its web application. It includes:

• Read-only connection with Google Ads, Meta Ads and Google Analytics 4 (Google Merchant Center, coming soon). From the application, Google Search Console and the other sources in the catalog described in the Privacy policy (sections 4.1 and 4.5) can also be connected, read-only.
• A timeline with the metrics from all sources and the currency each account declares, annotations and a market calendar.
• Tasks with procedures (SOPs) and recurring series.
• Documents and brand context.

It's offered in two plans:

• Self-service: monthly subscription per brand. The client uses naab with its own team.
• Managed: Calendulab manages the client's ad accounts using naab. In addition to these terms, it's governed by the proposal or services agreement the parties sign, which prevails on anything it specifically regulates.

Features marked as “beta” or “in testing”, and those that aren't part of the contracted offering, are provided as is and may change or be withdrawn.

3. For businesses and professionals only

naab AI is contracted in the course of a business or professional activity. It isn't offered to consumers.

4. Accounts, access and security

• We create accounts at the client's request, after its access request.
• Two-factor authentication (2FA) is mandatory. Each account is personal: credentials aren't shared.
• The client decides who on its team has access and with what role (viewer, editor, admin or owner), and is responsible for what its users do, the API keys they create and the AI assistants they connect.
• If the client suspects unauthorized access, it must let us know as soon as possible at hi@naab.ai.

5. Connecting sources and the AI assistant

• The client connects its sources by authorizing them on the provider's own screen and represents that it has the right to give access to those accounts and their data.
• naab only reads from connected platforms. It doesn't create, modify, pause or delete campaigns, ads, budgets or any other element of those accounts.
• In self-service, the client chooses and signs up for the AI assistant. When it's connected, naab shows the permissions it requests (query; create, modify and delete work; run processes) and the user decides whether to authorize them. The assistant never has more permissions than the user who connects it. What the assistant does with the data it receives is governed by the terms between the client and its provider.
• In the managed service, the Calendulab team works the client's accounts with naab, including from the AI assistants Calendulab subscribes to and, when a source is connected via Windsor.ai with Calendulab's account, through Windsor. Those providers process the client's data as naab subprocessors and are listed on the subprocessor list.

6. Acceptable use

The client and its users agree not to:

• Use the service for unlawful purposes or to process data without a legal basis for doing so.
• Resell, sublicense or redistribute the service or the data obtained from connected platforms, or use them in a way that breaches those platforms' terms. The client must comply with the terms and policies of Google (including those of the Google Ads API and the Google API Services User Data Policy) and Meta (including the Platform Terms), and those of any other source it connects.
• Try to access other clients' data, circumvent access controls or security measures, or test the service for vulnerabilities without our written permission.
• Reverse engineer the service, except to the extent the law expressly allows it.
• Overload the service, bypass its usage limits or automate access by means other than the application, the MCP connector and API keys.
• Upload content that is unlawful, malicious or that it doesn't have rights to.

If we detect use that breaches these terms and puts at risk the service, other clients or access to connected platforms, we may suspend the affected access immediately and will inform the client.

7. Client data

• The data and content the client brings to naab (data from its platforms, documents, tasks, annotations, context) belong to the client.
• The client grants us a limited, non-exclusive, royalty-free license to host, process and display them only to the extent necessary to provide the service, give support and maintain security. The license ends when they are deleted.
• We don't sell client data, we don't use it for advertising and we don't use it to train artificial intelligence models.
• We may use technical usage metrics of the service (for example, number of queries per brand and month, without their content) to operate and size it.

The processing of personal data included in that content is governed by the data processing agreement in clause 16 and by the Privacy policy.

8. naab's intellectual property

The software, design, documentation, trademarks and other elements of naab AI belong to its operator or its licensors. For as long as the subscription lasts, the client has a limited, non-exclusive, non-transferable right of use, for its internal purposes. If the client makes suggestions for improvement, we may use them freely, without this giving us any rights over its data.

9. Plans, prices and payment

• Prices are those of the current offer we communicate to the client in writing before signing up. They don't include taxes, which will be added under applicable law.
• In self-service, the subscription is monthly per brand and renews automatically every month unless the client cancels it. On the managed plan, the financial terms are those of its proposal or agreement.
• Payment method and timing: in advance, at the start of each monthly period, by card or bank transfer against invoice.
• If a payment isn't made, we'll notify the client. If it isn't settled within 15 days, we may suspend access until it's paid. During the suspension we don't delete the data: if 60 days go by without the payment being settled, we may terminate the contract and clause 10 will apply.
• If we change prices, we'll give 30 days' notice. A client that doesn't agree can cancel before the change applies.
• Cancellation takes effect at the end of the current period and the unused part isn't refunded, unless the service ends for a reason attributable to us (clause 10), in which case we'll refund the proportional part of the paid period.

10. Term, cancellation and end of the service

• The client can cancel at any time by writing to hi@naab.ai. Cancellation takes effect at the end of the current monthly period.
• We may terminate the service if the client seriously breaches these terms (for example, persistent non-payment or unauthorized use), with prior notice, or immediately if the breach puts at risk the security of the service or access to connected platforms. We may also stop providing the service generally, with 90 days' notice.
• Before the service ends, the client can download its work: naab lets it export in JSON the tasks, comments, procedures, annotations and document index of a brand or organization, download the original documents and query the metrics from its AI assistant. After the service ends, the client will have 30 days to do so.
• Once that period has passed, we'll erase the client's data within the following 30 days, except for data we must keep by law. Automatic database backups expire after 30 days; the manual backups we make before changes to the database are kept for 90 days. Until then, erased data may remain in them.

11. Availability and support

We take reasonable steps to keep naab AI available and working properly, but we don't guarantee that it will work without interruptions or errors. There may be downtime for maintenance, because of failures at our providers or for reasons beyond our control. Unless a service level is agreed in writing, there are no availability commitments or compensation for unavailability.

Support is provided by email at hi@naab.ai. We're available on business days in Spain, from 9:00 to 18:00 (Madrid time), and we reply within 2 business days at most.

12. Third-party platforms and services

naab depends on the APIs of Google, Meta and the other platforms the client connects. Those platforms may change, limit or withdraw their APIs, impose quotas, require the client to authorize access again or ask for new permissions. We'll try to adapt, but we're not responsible for those changes or for the data as each platform delivers it. When a source has known limitations (for example, metrics the provider doesn't send or attribution windows that change data from previous days), naab points them out.

13. Artificial intelligence output

An AI assistant's answers and the summaries or proposals generated by naab's AI features may contain errors or omissions. The client must review them before making decisions based on them. naab isn't responsible for the decisions the client makes based on that output.

14. Liability

• To the extent permitted by law, naab's total liability to the client for any cause related to the service is limited to the amount paid by the client to naab in the 12 months preceding the event giving rise to it.
• naab isn't liable for indirect or consequential damages, such as loss of profits, loss of business or damages arising from decisions made with the service's data.
• These limitations don't apply in cases of willful misconduct or gross negligence, or in the other cases in which the law doesn't allow liability to be limited.
• The client is liable to naab for damages caused by the content it brings to the service or by use that breaches these terms.

15. Confidentiality

Each party will keep confidential the non-public information it receives from the other in connection with the service and will only use it to provide or receive the service. This obligation continues after the service ends, except for information that is already public or whose disclosure is required by law or by an authority.

16. Data protection and data processing agreement

The personal data we process as controller is governed by the Privacy policy. For the personal data included in the client's content, the client is the controller and naab the processor, under Article 28 of the GDPR:

1. Subject matter and duration: processing that data only to provide the service, for as long as the contract lasts and during the return and erasure period in clause 10.
2. Nature and purpose: hosting, syncing with connected sources, querying, organizing, searching and indexing (including the indexing done by the AI providers described in the privacy policy) and support.
3. Types of data: identification and contact details of the client's users; work data (tasks, comments, time logged); whatever the client includes in documents, annotations and context; metrics and campaigns from connected platforms, usually aggregated and non-personal.
4. Data subjects: the client's users, employees and collaborators, and the people who appear in its content.
5. Instructions: we'll process the data following the client's documented instructions, which are these terms and the way it configures the service. If we believe an instruction breaches data protection law, we'll tell the client.
6. Confidentiality: the people authorized to process the data will be bound to respect its confidentiality, by written commitment or by legal obligation.
7. Security: we apply the measures of Article 32 of the GDPR described in the privacy policy (encryption in transit, encryption of credentials, mandatory 2FA, role-based access control, isolation between clients and a security log).
8. Subprocessors: the client gives general authorization for the subprocessors on the published list. We'll give 30 days' notice of any addition or replacement; if the client objects on reasonable grounds and we can't find an alternative, it may cancel the service. We'll impose on each subprocessor data protection obligations equivalent to these.
9. Assistance: we'll help the client handle requests to exercise rights and meet its obligations regarding security, breach notification and, where applicable, impact assessments.
10. Security breaches: we'll notify the client, without undue delay and in any case within 48 hours of becoming aware of it, of any security breach affecting its data, with the information available.
11. End of processing: when the service ends, we'll return or erase the data as the client chooses (clause 10), unless the law requires keeping it.
12. Information and audits: we'll make available to the client the information needed to demonstrate compliance with these obligations and allow reasonable audits, with prior notice and at most once a year, at the client's expense, during business hours and under a confidentiality commitment; before an on-site audit we'll answer a questionnaire in writing.
13. International transfers: only with the safeguards of Chapter V of the GDPR, as detailed in the subprocessor list.

If the client needs it, we'll also sign a data processing annex with this same content: request it at hi@naab.ai.

17. Changes to these terms

We may modify these terms. We'll let each account's admins know about significant changes with 30 days' notice. If the client doesn't agree, it can cancel before they take effect. Changes required by law or by a connected platform may apply sooner, and we'll explain this when we announce them.

18. General provisions

• The client may not assign the contract without our consent. We may assign it in the event of a merger, acquisition or sale of the business, with notice to the client, except as regards the data received from Google and Meta: in that case it will only be transferred with the client's prior express consent, as Google's limited use requires and as the Privacy policy (section 4.3) promises.
• Notices will be given by email to the addresses the parties have provided to each other.
• If any clause is held invalid, the rest remains in force.

19. Governing law and jurisdiction

These terms are governed by Spanish law. For any dispute, the parties submit to the courts of Madrid, waiving any other jurisdiction that may apply to them.

20. Contact

For any question about these terms, write to us at hi@naab.ai.

Version of October 14, 2026.