Privacy Policy

1. Information We Collect

a. Account Information

When you register, we collect your name, email address, and (if applicable) a hashed password. If you register via Google OAuth, we receive your name, email, and profile picture directly from Google.

b. Connected Ad Platform Data

When you connect a Meta (Facebook), Google Ads, TikTok, or LinkedIn ad account, we access your advertising performance data via read-only OAuth tokens. This includes:

• Campaign names, objectives, status, and budget
• Ad set and ad-level performance data (spend, ROAS, CTR, CPA, impressions, conversions, frequency)
• Creative metadata (ad name, headline — not media files)

We do not access personal data about your ad audiences. We cannot create, modify, pause, or delete any ads or campaigns.

c. AI Chat Data

Your questions and AI-generated responses in the Pulse chat interface are stored to maintain conversation history within your workspace. Chat messages are processed by Anthropic's Claude API to generate responses.

d. Usage Data

We collect anonymised information about how you use the Service, including pages visited, features used, and session duration, to improve the product.

e. Payment Information

Billing and payment information is processed exclusively by Razorpay. We do not store payment card details on our servers. We store only your subscription plan, payment status, and billing history.

2. How We Use Your Information

We use the information collected to:

• Provide, operate, and maintain the Pulse Service
• Retrieve and display your advertising account performance data
• Generate AI-powered analysis, audits, and recommendations via Claude (Anthropic)
• Manage your subscription and process billing via Razorpay
• Send transactional emails (account activation, password reset, billing receipts)
• Improve the Service through aggregated, anonymised analytics
• Detect and prevent abuse, fraud, and security incidents
• Comply with applicable legal obligations under Indian law

We do not use your data for advertising purposes, and we do not sell or rent your personal data to any third party.

3. Data Sharing

We share your data only with the following categories of recipients, and only to the extent necessary to operate the Service:

We may also disclose your information if required by law, court order, or a government authority in India or another applicable jurisdiction.

4. Data Security

We implement industry-standard security measures to protect your data:

• All data encrypted at rest using AES-256
• All data in transit protected by TLS 1.3
• OAuth access tokens stored encrypted — never in plaintext
• Row-level security (RLS) enforced on all database tables
• Read-only access scopes requested for all ad platforms
• Regular internal security reviews

No method of transmission over the internet is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security.

5. Data Retention

• Account information: retained until you delete your account
• Ad performance data: retained for 24 months from the last sync date
• Chat history: retained until you delete it or your account
• Billing records: retained for 7 years as required under Indian GST law
• Anonymised analytics: may be retained indefinitely

Upon account deletion, your personal data is deleted within 30 days, except where retention is required by law.

6. Your Rights Under the DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023 (India), you have the following rights:

• Right to access: Request a summary of the personal data we hold about you.
• Right to correction: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to withdraw consent: Withdraw consent at any time by deleting your account or disconnecting ad accounts from Settings.
• Right of grievance redressal: File a complaint with our Grievance Officer (see Section 11) or with the Data Protection Board of India.

To exercise any of these rights, contact us at support@nurdd.club. We will respond within 30 days.

7. Cookies

We use minimal, strictly necessary cookies only:

• Session cookies for Supabase authentication (HTTP-only, secure)
• CSRF protection cookies

We do not use advertising tracking cookies, third-party analytics cookies, or behavioural profiling cookies.

8. International Data Transfers

Our service infrastructure may process your data in the United States (Supabase, Vercel, Anthropic) and India (Razorpay). By using the Service, you consent to this cross-border transfer of data. We ensure contractual protections are in place with each sub-processor under applicable data transfer frameworks.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at support@nurdd.club.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice within the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, we have appointed a Grievance Officer:

12. Contact Us

For any questions about this Privacy Policy or your data, contact: