Privacy Policy

1Our role

1.1. NLS as controller. We are the controller of personal data we process for our own purposes: data about visitors to our website, prospective customers, users of the Services and their account, billing and support data.

1.2. NLS as processor. When our customers use the Services, they collect and upload data about their own campaigns and about End Users — people whose clicks and conversions are tracked on domains and landing pages the customer connects to the Services. For this data the customer is the controller and we process it on the customer's behalf and according to its instructions. This Privacy Policy does not govern that processing. If you are an End User, please contact the company whose website or ad you interacted with. We also describe this processing in our End-User Privacy Notice.

2Data we collect

2.1. Account data. When you register or are invited to the Services: your name, email address, avatar, password (stored in hashed form), two-factor authentication settings, language and interface preferences, and the company and workspaces you belong to, together with your role and access rights. If you sign in with Google, we receive your name, email address and profile picture from Google.

2.2. Activity within the Services. Records of actions you take in the Services, such as creating, changing or deleting campaigns, settings and tasks, and actions you confirm from the AI Assistant. These records are shown in your company's audit log. We also process your online status and last activity time, which are visible to other members of your company.

2.3. Connected advertising accounts. When you connect an advertising account: session data of that account (such as cookies and tokens), the user-agent, proxy details you provide, and identifiers and settings of the account, its ad accounts, campaigns, ad sets and ads, together with performance and spend data received from the advertising platform. Session data and proxy credentials are stored in encrypted form and used only to perform the functions you request.

2.4. AI Assistant data. The questions you ask the AI Assistant, the context you attach (such as selected period, filters and rows), the responses generated, the tools used to prepare them, your ratings of responses, and the custom instructions ("skills") your team creates.

2.5. Billing data. Plan, invoices and payment history. Card payments are processed by Stripe; we do not receive or store full card numbers. For cryptocurrency payments, we process the transaction amount, asset, network, wallet address and transaction identifier.

2.6. Website visitors and leads. When you submit a form on our website: your name, your Telegram handle or email address, the size of your team, your message, the language of the page and the source you came from (such as a UTM parameter or the referring website). When you contact us: the content of your messages and your contact details.

2.7. Technical data. IP address, browser and device information, pages and features used, timestamps, error reports and security logs, collected automatically when you use the website or the Services.

2.8. Cookies. We use cookies and similar technologies as described in our Cookie Policy.

3NLS browser extension

The NLS browser extension helps you transfer the session of an advertising account to the NLS connection form instead of copying it manually.

• The extension accesses session data of an advertising platform only when you start the transfer, and only for the account open in your browser at that moment.
• The extension does not send data over the network itself. It passes the session data to the NLS connection form open in your browser. The data is sent to NLS only when you check and save the account in the Services.
• Data obtained through the extension is used only to connect and operate the advertising account in the Services. It is not used for advertising, is not sold, and is not transferred to third parties except as needed to provide the Services or as required by law.
• We do not use the extension to collect your browsing history or data from other websites.

4How we use personal data

We do not sell personal data.

5Who we share data with

5.1. Within your company. Other members of your company can see your name, avatar, role, online status, and your actions in the audit log, within the limits of their own access rights.

5.2. Service providers. We use the following categories of providers, who process data on our behalf and under contractual obligations:

5.3. Advertising platforms and other Third-Party Platforms. When you connect an advertising account or perform actions through the Services, we transmit data to the relevant platform as needed to perform your request.

5.4. Authorities. We may disclose data where required by law, a court order or a binding request of a competent authority, or where needed to protect our rights, our users or third parties.

5.5. Business transfers. If NLS is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor, which will be bound by this Privacy Policy.

6International transfers

Customer Data and account data are stored on servers in Germany. To generate AI Assistant responses, the relevant data is transmitted to AI model providers in the United States. Payment processors may also process data outside the European Economic Area. For such transfers we rely on appropriate safeguards, such as standard contractual clauses approved by the European Commission or the EU-US Data Privacy Framework where the provider is certified under it.

7How long we keep data

• Account data — for as long as your account exists, and then for the period needed to comply with law and resolve disputes.
• Customer Data in the Services — for the data retention period of your plan, and after the Agreement ends, for the export period stated in our Terms of Service, after which it is deleted.
• Advertising account session data — until you remove the account from the Services or your account is closed.
• Billing data — for the period required by tax and accounting laws.
• Lead data — up to 24 months after our last contact, unless you become a customer.
• Technical and security logs — one month.

8Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption of advertising account session data, access control based on roles and permissions checked on the server, two-factor authentication, and logging of changes. No system is fully secure; if we become aware of a personal data breach that affects you, we will notify you as required by law.

9Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw your consent at any time. To exercise these rights, contact us at abuse@nlscrm.com. We may need to verify your identity before acting on a request.

If your account is part of a company in the Services, some data (for example, your activity in the audit log) is also controlled by that company, and we may refer your request to it.

You also have the right to lodge a complaint with a data protection authority.

10Children

The Services are intended for businesses and are not directed to persons under 18. We do not knowingly collect data from them.

11Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in the Services before they take effect.

12Contact

abuse@nlscrm.com