Privacy Policy

Effective date: October 5, 2026

1. Who we are

datanephew ("we," "us," "the datanephew team") provides an MCP-based service that lets you access your business's web presence data — Google Analytics, Search Console, PageSpeed Insights, Google Business Profile, Bing Webmaster Tools, and other connected services — conversationally through AI assistants like Claude.

2. What we collect

  • Account information: your email address and name, collected when you sign up.
  • OAuth tokens: for each third-party service you connect (Google, Meta/Facebook, Microsoft/Bing, and others as they're added), we store an encrypted authentication token so we can act on your behalf.
  • Connected asset records: the business assets you connect — websites, social media pages (Facebook, Instagram), YouTube channels, business locations, email marketing lists, advertising accounts, and other properties as they're added — along with which of your connected accounts each one belongs to, so you don't have to re-specify these each time.
  • Saved action plans and summaries: notes, plans, or summaries that you or your AI assistant choose to save during a session.
  • Billing information: if you subscribe or buy research credits, payment is handled by Stripe. We keep your Stripe customer ID and which plan you're on; we never see or store your full card number.
  • Research credit records: your credit balances, plus a ledger entry for each credit grant, purchase, and research request charged against them — recording when it happened, how many credits, and which research tool was used. Ledger entries do not include what you searched for or the results.
  • Product usage events: a record of each request your account makes to our service and each tool your AI assistant calls through datanephew — the tool or feature name, whether it succeeded, how long it took, your plan, and the type of asset involved — tagged with an identifier derived from your account rather than your name or email.
  • Issue reports: messages you or your AI assistant send us through datanephew's issue-reporting tool, along with the context attached to them.
  • Standard infrastructure logs: automated AWS logs generated by our hosting infrastructure. These are not used to track individual user behavior.

3. What we do NOT collect or store

We do not store the data returned by the services you connect — your Google Analytics numbers, Search Console rankings, PageSpeed scores, Business Profile stats, email marketing metrics, and so on never touch our servers for storage. That data is fetched live at the moment you ask a question, passed through to your AI assistant, and not retained afterward.

We do record how the product is used — which tools and features each account uses and whether they worked (see "Product usage events" above) — but those records never contain the data returned from your connected accounts.

4. Why we collect it

  • To authenticate you with the third-party services you choose to connect.
  • To remember which connected accounts belong to which of your business assets, so setup only happens once.
  • To save action plans or summaries you or your assistant create, so you can pick up where you left off.
  • To send you emails related to your account and use of the service — account confirmations and service notices (transactional, sent regardless of preference), plus onboarding tips, feature updates, and occasional product news, which you can opt out of individually at any time from your account settings.
  • To bill you for subscriptions and credit purchases, and to keep track of your research credit balance.
  • To understand how the product is used, find and fix what's broken, and measure which of our ads lead to signups.
  • To make changes to your connected accounts that you explicitly request in conversation — for example, creating a custom dimension in Google Analytics or updating the title, description, or tags on your own YouTube video. datanephew never makes these changes automatically; every change happens only when you specifically ask for it.

5. Platform Data Policies

5a. Google API Services User Data Policy

datanephew's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through Google APIs is:

  • Used only to provide and display the requested information back to you, or to make a specific change to your connected account that you explicitly requested.
  • Never used for advertising purposes.
  • Never sold to third parties.
  • Never used to train generalized AI or machine learning models.
  • Never accessed by humans, except (a) with your explicit consent, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and de-identified.

5b. Meta Platform Data

If you connect a Facebook Page or Instagram Business account, datanephew's use of that data follows the same principles as our use of Google data: it is used only to provide and display the requested information back to you through your AI assistant, never used for advertising, never sold to third parties, never used to train generalized AI or machine learning models, and never accessed by humans except under the same limited circumstances described above.

6. Third-party sharing

We never sell your data, and data from your connected accounts is never shared with advertisers or data brokers. We share information only with the service providers below, and only what each needs to do its job:

  • Amazon Web Services — hosts the service and stores the information described in Section 2.
  • Stripe — processes payments. Receives your email address and an internal account ID when you first subscribe or buy credits, plus the payment details you enter at checkout.
  • Brevo — sends our account and product emails. Receives your email address, the dates of account milestones (such as signing up, connecting an account, or upgrading), your email preferences, the ad campaign you arrived from (if any), and which AI assistant you use with datanephew.
  • Google Analytics — receives the product usage events described in Section 2, under the account-derived identifier rather than your name or email. When you sign up, finish setup, or upgrade, we also record that event in the Google Analytics property for this marketing website, so we can tell which visits led to a signup.
  • Google Ads, Meta, and Microsoft Advertising — if you arrived by clicking one of our ads, we tell that ad network when you sign up, finish setup, or upgrade, identified only by the ad's click ID. They do not receive your email address or any data from your connected accounts.
  • DataForSEO and SerpAPI — supply Premium Research and some public search and business-listing data. They receive the keywords, domains, or business names a request is about — not your account information or data from your connected accounts.
  • Public lookup services — Google PageSpeed Insights, Yelp, and domain-registration (RDAP) lookups receive the public page, business, or domain being checked.
  • Contentsquare — our session-recording provider (see Section 7).

7. Session recording

We use Contentsquare, a third-party analytics provider, to record sessions on our web app so we can understand and improve the product experience. By default, Contentsquare blurs all on-screen words and numbers so no page content is captured as plain text or images; we additionally mark the account name and email fields on the settings page for masking. Contentsquare never records pages that carry OAuth authorization data (login/connection callback screens).

8. Website analytics & advertising

This marketing website (datanephew.com, separate from the logged-in product covered elsewhere in this policy) uses Google Analytics (GA4) to understand site traffic, the Google Ads remarketing tag to show datanephew ads to prior visitors on other sites, and the Microsoft Advertising UET tag to measure our Microsoft ads. These use cookies; see Google's Privacy Policy, how Google uses data from sites that use its services, and the Microsoft Privacy Statement. You can opt out of Google Ads personalization at Google Ads Settings or of GA4 tracking generally via the Google Analytics Opt-out Browser Add-on.

Cookie consent. If you're visiting from the EEA, UK, or Switzerland, a banner asks for your consent to analytics and advertising cookies. As soon as we detect you're visiting from one of those regions, those cookies are switched off and any already set on your visit are deleted; they stay off unless you accept. Visitors elsewhere aren't shown this banner. If your browser's time zone is in Europe, your browser confirms your region with a lookup to ipapi.co (a third-party IP geolocation service) using your IP address; we don't store the result — it's cached in your own browser only, to avoid repeating the lookup on later visits.

9. Data retention

  • OAuth tokens are stored encrypted and retained until you disconnect the associated service or delete your account.
  • Account information is retained until you delete your account.
  • Saved plans and summaries are retained until you delete them or delete your account.
  • Research credit ledger entries are deleted automatically 400 days after they are recorded.
  • Billing information: your Stripe customer ID and plan are retained until you delete your account. Payment records held by Stripe are retained under Stripe's own policies.

You may request deletion of your data at any time by emailing privacy@datanephew.com.

10. Security

We use industry-standard measures, including encryption of stored tokens, to protect your information. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

11. International users

datanephew is based in the United States, but is available to users anywhere. If you are located in the European Economic Area, United Kingdom, or another jurisdiction with data protection laws, you have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. Our legal basis for processing your information is your consent (when you connect a service) and our need to perform the service you've requested. To exercise these rights, contact privacy@datanephew.com.

12. Children's privacy

datanephew is not directed to, and is not intended for use by, individuals under the age of 13. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated effective date at the top of this page.

14. Contact us

Questions about this policy or your data: privacy@datanephew.com