Privacy policy

• Account information: your email address, your name if you give it, and the business details you enter, such as business name, type, timezone and when you want your daily digest.
• Your voice and facts: the tone notes, example replies, banned phrases and business facts (for example hours, parking or a booking link) you give Nod to write with.
• Data from accounts you connect: when you connect Google Business Profile, and with your permission, we receive your business profile and location details, the reviews customers leave (including the reviewer's public name and rating), and the replies and posts on that profile. When other channels such as Instagram become available, we receive the comments and messages on the accounts you connect, in the same way.
• What Nod produces: draft replies, your edits and decisions, the rules you set, and an activity log of what was approved, sent, skipped or undone and when.
• Technical information: a session cookie that keeps you signed in, and server logs (such as IP address, browser type and request times) that we use to run and secure the service.
• Payment information: when paid plans launch, payments will be handled by our payment processor. We will not store your full card number.

• To provide Nod: read new reviews and messages, draft replies, send you a daily digest, and post the replies you approve or your rules allow.
• To keep you in control: apply your rules, hold sensitive items for you, keep the undo window and the activity log.
• To run, secure and support the service, including fixing problems and preventing abuse.
• To tell you about your account and important changes to Nod.

We do not sell your information, use it for advertising, or share it with data brokers. We do not use it to train AI models.

To draft a reply, Nod sends the review or message, together with your voice profile and business facts, to our AI provider, Anthropic, which processes it on our behalf and returns a draft. Nod also asks the AI to flag reviews that need a human, such as refund, health or legal issues. A draft is only a suggestion: nothing is posted until you approve it or one of your rules allows it, and negative or sensitive reviews always wait for you.

Nod accesses Google Business Profile data only after you sign in with Google and grant permission, and only to show you your reviews, draft replies, and post the replies and updates you approve or your rules allow, on the profiles you choose to connect.

Nod's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the features described here; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition; we do not use it for advertising; we do not allow humans to read it except with your consent, for security, to comply with law, or when it has been aggregated and anonymized; and we do not use it to develop, improve or train generalized AI or machine-learning models.

You can remove Nod's access at any time from your Google Account permissions page or by disconnecting Google in Nod. When you do, we stop fetching data and delete the access tokens we hold.

We share information only with service providers that help us run Nod, under contracts that limit their use of it to providing their service to us:

• Supabase, for our database and sign-in.
• Vercel, for hosting the app.
• Anthropic, for drafting replies, as described above.
• Resend, for sending email such as your daily digest.
• Google, and later Meta, to post the replies you approve on the accounts you connected.
• A payment processor, once paid plans launch.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

We keep your information while your account is open. If you close your account, we delete your account data, connected-account data and drafts within 30 days, except where we must keep something longer by law. Copies in encrypted backups are deleted on their normal rotation, within 90 days.

Data is encrypted in transit. Access to each business's data is restricted to that business's members, and the access tokens for connected accounts are stored encrypted and used only by the server. No method of storage or transmission is perfectly secure, but we work to protect your information and will tell you about a breach that affects you as the law requires.

You can see and change most of your information in Nod, disconnect any connected account, and close your account. You can also ask us to access, correct, export or delete your information by emailing privacy@ai-nod.com. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, including the right to object to or restrict some processing and to complain to your local data protection authority. We will not treat you differently for exercising them.

If you left a review or message for a business that uses Nod, that business decides how to respond to it. You can contact the business directly, or email us and we will help where we can.

• Nod is for businesses and is not intended for anyone under 16.
• Our service providers may process information in the United States and other countries. Where required, we use appropriate safeguards for these transfers.
• If we change this policy in a meaningful way, we will notify customers by email or in the app before the change takes effect.

Questions about this policy or your information: privacy@ai-nod.com, or write to [Company legal name], [Mailing address].