Legal
Data processing and sub-processors
What neb processes for your store, who helps us do it, and how to get a DPA.
When neb answers your shoppers, it handles their personal data on your behalf. Under the GDPR and similar laws, your store is the controller of that data and OneDai, which runs neb, is your processor. This page explains what that covers, lists every company we use to do it (our sub-processors), and how to get a Data Processing Addendum (DPA).
The Data Processing Addendum
Pending legal review. Our DPA is drafted and waiting for review by our legal counsel. It is not published here yet because its final legal details (company registration, governing law) are still being confirmed.
If you need a signed DPA before then, email hello@neb-app.com with the subject "DPA" and your store's name. We will send you the current version to review and sign.
The draft covers: what we process and why, that we process it only on your instructions, confidentiality of our team, our security measures (see Security), the sub-processors below, helping you answer shoppers' requests, telling you about a personal data breach, international transfers (using the EU Standard Contractual Clauses), and deleting the data when you leave.
What neb processes for your store
| Data | Why |
|---|---|
| Shoppers' chat messages and neb's answers, the page they were on, and the time | To answer the question, and so you can read the conversation in your dashboard and morning report |
| A random visitor id the widget keeps in the shopper's browser | To keep one shopper's conversation together across pages and visits |
| Email addresses shoppers choose to leave, with their question | So your team can reply |
| Your store's public pages and, if you connect them, your product catalog | To answer from what your store says |
Card numbers, email addresses and phone numbers that shoppers type into the chat are masked before the message is saved, sent to the AI or logged. Conversations are deleted automatically no later than 12 months after their last message, and everything is deleted when you close your account.
Sub-processors
These are all the companies that process personal data for neb today, and what each one receives. When we add or change one, we update this list first.
| Provider | What neb uses it for | What it receives | Where |
|---|---|---|---|
| RackNerd LLC | Hosting: the server neb runs on | Everything neb stores: merchant accounts, store settings and pages, shopper conversations, emails shoppers leave | Buffalo, New York, USA |
| Anthropic, PBC | AI answers (when a store's assistant runs in AI mode) | The shopper's question and the recent conversation, the passages from the store's pages used to answer, and the store's name and tone settings. Card numbers, emails and phone numbers typed into the chat are masked first. | USA |
| Stripe, Inc. | Merchant billing | The merchant's email, the store it pays for, and the card, which the merchant enters on Stripe's own page (neb never sees the card number). No shopper data. | USA |
| Resend (Plus Five Five, Inc.) | Email: account emails, the morning report, shopper-lead notices, incident notices, and mail sent to @neb-app.com addresses | The merchant's email address. The morning report and lead notices also contain shopper questions and the emails shoppers chose to leave. | USA |
| Google LLC (Google Drive) | Off-site database backups | Only a backup file encrypted before it leaves our server. Google does not have the key to read it. | Google's data centres |
neb's chat widget can also send chat events (for example "chat opened") to the Google Analytics or Meta pixel already on your store. Those are your own tools, under your own settings and consent banner, not neb's sub-processors. See cookies and storage.
Shoppers' requests
If a shopper asks you to see or delete what they said to neb, email hello@neb-app.com from your account's address with the details (for example their email address or the date of the conversation), and we will help you find and delete it.