Privacy Policy

1. Who we are

Nilhan & Co. Limited ("we", "us", "our"), registered in England and Wales as NILHAN & CO. LIMITED, company number 07992110, registered office 78 Locks Hill, Portslade, East Sussex, BN41 2LD, United Kingdom, operates the marketing and analytics platform available at nilhan.co (the "Service"). We act as the data controller for the personal data described in this policy, and as a data processor for the analytics data you connect to the Service on behalf of your own organisation. We are established in the United Kingdom and this policy is written to the UK GDPR and the Data Protection Act 2018.

You can reach us at nilhan@crearty.io for any question about this policy or your data.

2. Data we collect

• Account data — the name, email address and password hash you provide when registering, plus login timestamps.
• Connected platform data — the metrics, dimensions, campaign, keyword and search performance data we retrieve from the third-party accounts you explicitly connect (such as Google Analytics 4, Google Search Console and Google Ads).
• Website and content data — the pages, metadata, screenshots and text content collected when you ask the Service to crawl or index a website you control.
• Usage data — technical logs such as IP address, browser type, requested URLs and error traces, used to keep the Service secure and working.
• Content you submit — prompts, questions and files you send to the AI assistants in the Service, together with the responses generated.

3. How we use your data

We process personal data only to:

• provide, operate and maintain the Service and the features you use;
• authenticate you and secure your account;
• retrieve, store, analyse and visualise the analytics data you connect;
• generate AI-assisted insights, reports and recommendations at your request;
• diagnose faults, monitor performance and prevent abuse;
• comply with our legal obligations.

We do not sell your personal data, and we do not use it for advertising or profiling unrelated to the Service.

4. Legal bases (UK GDPR)

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, relying on the following legal bases: performance of a contract to deliver the Service you signed up for; legitimate interests to secure, debug and improve the Service; consent where you explicitly authorise a third-party connection such as a Google account; and legal obligation where the law requires retention or disclosure.

5. Google user data

When you connect a Google account, we request only the scopes needed for the features you enable (read access to Google Analytics 4, Google Search Console and Google Ads reporting data). Access and refresh tokens are stored encrypted at rest and are used solely to retrieve data on your behalf.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer Google user data to third parties except as necessary to provide or improve the Service, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.

You can revoke our access at any time from your Google account permissions page, or by asking us to delete the connection.

6. AI processing

Some features send your prompts and the relevant analytics or content data to third-party AI providers (such as OpenAI, Anthropic, Google and Cohere) to generate responses. These providers act as processors under contract and are not permitted to use your data to train their models. Avoid submitting special-category personal data or credentials to the AI assistants.

7. Sharing and sub-processors

We share data only with service providers who help us run the Service: hosting and infrastructure, database and cache providers, vector search (Pinecone), the AI providers listed above, and the Google APIs you connect. Each is bound by a data processing agreement. We may also disclose data where legally required, or as part of a merger or acquisition, in which case we will notify you first.

8. International transfers

Some of our providers process data outside the United Kingdom. Where that happens, transfers are covered by UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional safeguards the transfer risk assessment requires.

9. Retention

Account data is kept while your account is active and for up to 90 days after closure. Connected analytics data, crawled content and chat history are kept until you delete them or close your account. Technical logs are retained for up to 12 months. Backups are rotated within 30 days.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Contact us at nilhan@crearty.io and we will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to resolve your concern first.

11. Security

We use TLS in transit, encryption at rest for credentials and tokens, role-based access control, and least-privilege access for staff. No system is perfectly secure, but where a breach affects your personal data we will report it to the Information Commissioner's Office within 72 hours where required, and notify you without undue delay where the risk to you is high.

12. Cookies

We use strictly necessary cookies for session management and CSRF protection. These are exempt from the consent requirement under the Privacy and Electronic Communications Regulations (PECR). We do not use advertising or cross-site tracking cookies on the Service.

13. Children

The Service is intended for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced in the Service or by email, and the "last updated" date above will change.