Privacy Policy

Nephia watches public Sources for the terms you choose, keeps what it finds as mentions for a stated number of days, labels them with AI and delivers them to the channels you configure. It is a store, not a pipe, and this policy is written accordingly.

• We are the controller for your account and for what the Services do the same way for everyone: collecting public mentions, keeping them for the windows in section 7, labelling them with AI, embeddings, anonymous price observations and AI-answer runs.
• We are your processor for what you decide: the terms and Sources you watch, your mute and VIP rules, your channels, your exports, and what you do with mentions afterwards. The DPA covers that part.

2.1 Account and sign-in

• Your email address, and a normalised form of it (lower-case, without a +tag, and without dots for Gmail addresses) that we keep so the same mailbox cannot open several accounts. The normalised form is never shown or emailed.
• If you sign in with Google: your email, name, Google account id and profile picture if your account has one.
• Session tokens that keep you signed in, and hashed API keys.
• The domain of your email address, checked at sign-up against a list of disposable providers and for a valid mail server. The list is a package on our servers; the mail check is a DNS lookup. Neither sends your address to a third party.

2.2 What you configure and how you use the Services

• Your Keywords: search terms, Sources, refresh intervals, AI instructions, sorting buckets, and mute or VIP rules — which may contain the public handles of people you chose to silence or highlight.
• Your delivery channels: Slack, Discord and HTTP endpoints, the Telegram chats you connected, and the email addresses you chose as recipients. A recipient you add who is not you is told nothing by us; you are responsible for having their agreement.
• The usage ledger: which calls were made, when, with what result, and the credits they consumed.
• Your IP address, for rate limiting, the sign-up cap and security logs, kept as stated in section 7.
• Admin audit events when we act on your account.

2.3 Payments

None during the public beta: nothing is for sale and no payment provider is called. The provider that will act as merchant of record, and what it receives, will be added to the Sub-processors list before the first sale.

2.4 Communications

When you email us, or we send you sign-in links, account notices, digests, briefs or reports, we process the content and metadata of those messages. When you keep your first Keyword, we start a morning brief and a weekly recap to your account address, and the screen says so before you confirm. Every one of those emails carries a one-click link that stops it, and Settings, Notifications switches them off at any time.

2.5 Website analytics

Only after you accept analytics cookies. If you decline, your visit is counted without a cookie and without an identifier that survives the tab. A refused sign-up is recorded as an event with the reason and the page, never with the address. See the Cookie Policy.

2.6 Replies you send from Nephia

Only if you connect an X account to reply from the inbox.

• When you connect it, X gives us the account’s id, handle, display name and profile picture, and access tokens that let us post on its behalf. The tokens are stored encrypted and used for two things only: identifying the account when you connect it, and posting a reply when you click Send. They are deleted when you disconnect the account; its id, handle and name stay, so your past replies keep their author.
• Each reply you send is recorded: its text, the post it answers, the X account it was sent as, the link X returns, the credits it cost, and whether it went out. X Corp receives the text and the post it answers, and publishes the reply under your X account, where X’s own terms and privacy policy apply.
• Nothing is ever posted without your click, and the connection is never used to read. Mentions keep coming from public content as described in section 3; we do not read your timeline, your messages or your followers.

2.7 The free check

The free check at /check runs without an account. When you enter a site, we read up to a few of its public pages, ask ChatGPT and Perplexity three questions about its category, and search public posts on Reddit, Hacker News and Bluesky. We keep a record of each check:

• The site you entered, the result shown on its page, what the check cost us, and whether you clicked through to sign up.
• Your IP address, the country it resolves to, your browser’s user agent, the page you came from and its campaign tags. We use them to stop abuse, to cap the number of free checks per visitor and per day, and to understand where visitors come from. The legal basis is our legitimate interest in keeping a free service available and affordable.
• The IP address and the user agent are erased after 90 days; the rest is kept. If you create an account after a check, the check is linked to it.

A check’s result page can be opened by anyone who has its link and is never offered to search engines. It shows excerpts of public posts, cut to 280 characters. To have a page removed, write to support@nephia.cc.

A mention is a public post, comment, video, article, listing or AI answer that matched a Keyword. It is written by someone who is usually not our customer. This section is about them.

3.1 What a stored mention contains, by kind of Source

3.2 What we add to it

• AI labels: which group a mention belongs to, its sentiment, which sorting bucket it went to, whether a rule fired, and the result of any agent step you configured.
• Summaries, digests and weekly reports that quote or paraphrase mentions.
• A semantic embedding of the text, kept 30 days, so you can find similar mentions.
• Your own marks: read, starred, muted, and the notes you attach.

3.3 What we do not do with authors

• We do not build profiles of authors across Keywords or across customers. The only author-level view is the Authors tab of a Keyword: at most 25 public handles ranked by how often they mentioned your terms in a window, showing what the mentions themselves carry and nothing more.
• We do not re-identify anyone — we do not link a handle to a real name, an employer or another platform — and the Terms forbid our customers from doing so with our data.
• We do not train, fine-tune or evaluate any AI model on mentions, and forbid our customers from doing so.

• Provide, secure and improve the Services
• Authenticate you and manage your account, API keys, Keywords and channels
• Collect, store, label and deliver mentions as your Keywords instruct
• Meter usage, enforce quotas and prevent fraud or abuse
• Send service communications — not marketing unless you opt in later
• Comply with law and enforce our Terms
• Produce aggregated, non-identifying analytics about product health

Where the GDPR or UK GDPR applies, we rely on:

• Contract — to provide the Services you signed up for
• Legitimate interests — ours and our customers’, for collecting and labelling public mentions of names, brands and products (Article 6(1)(f)); for security, abuse prevention and product improvement. The interest is weighed against the author’s: we keep public content only, for a stated time, without profiling, and with a removal procedure (section 8).
• Legal obligation — tax, accounting and lawful requests
• Consent — analytics cookies, which are set only after you accept them and which you can withdraw at any time from the "Cookie settings" link in the site footer or the Privacy card on your Account page

Grouping, sentiment, sorting, summaries, weekly reports, reply drafts, agent steps and semantic embeddings are produced by large language models. For that purpose, the content of mentions, the public posts around them and the context you give (the instructions you wrote for a Keyword, your brand card, a note you type) are sent to our AI providers, listed on the Sub-processors page. We do not say which provider or model handles which feature, because that changes. These commitments do not:

• No AI provider trains on that content.
• None keeps it for more than 30 days, except when a request is flagged for abuse or when the law requires it.

AI outputs are estimates. A sentiment, a group or a summary is an automated reading of a text written by a stranger, offered as decision support; it is not a statement of fact about the author or about you.

7.1 Sub-processors

We do not sell personal information. Data is processed on our behalf by our hosting provider in France, by Cloudflare in front of the site, by OpenRouter and Anthropic for AI processing, by Resend for email, by Google when you sign in with it, by PostHog for analytics with your consent, by Better Stack and Sentry for logs and errors, by TinyFish or Firecrawl when you ask us to read the pages of your own website, by X Corp when you send a reply from the inbox through an X account you connected, and by the providers through which public Sources are reached. Who they are, what each receives and where it is processed is on the Sub-processors page, which forms part of this policy.

7.2 Legal and safety

We may disclose information if required by law, or if we reasonably believe disclosure is necessary to protect rights or safety or to investigate abuse.

7.3 Business transfers

If Nephia is transferred to another operator or company, personal information transfers with it under this policy, and you are told beforehand.

7.4 Retention

The windows below are the ones the code enforces: a scheduled sweep deletes what has aged out, and this table is generated from the same constants.

Closing your account is done by email today; self-service closure is planned. We delete your account data within 30 days of the request, and the mentions your Keywords collected with it. A request to erase your personal data is handled the same way, subject to legal retention exceptions.

If something you posted publicly has been collected by Nephia and you want it removed, email support@nephia.cc with the subject "Removal request" and the URL of the post. We will:

• Confirm receipt, and answer within 30 days.
• Delete the mention and its AI labels from every Keyword that holds it, and tell you when it is done. We do not tell you which customers were watching it.
• Tell you if we cannot act — for example if the URL is not one we hold, or if the request is really about the platform where the post still lives.

You can also ask what we hold about a public handle. We do not re-check Sources for posts their authors have since deleted; a removal request is how a deletion reaches us before the retention window does.

Your data is yours to take. At any time, without charge and in open formats, you can export a Keyword’s mentions with their AI labels as CSV from the dashboard (5,000 rows per file) or page through them with the product API, and read your account and Keyword configuration from the same API. When the Services end — for you, or for everyone — you keep that access for 30 days before deletion. This is our commitment under the EU Data Act’s switching provisions, stated in full in the Terms.

• TLS for data in transit
• Access controls for production systems and admin actions
• API keys stored as hashes; sign-in by link or Google, never by password
• X access tokens stored encrypted, and deleted when you disconnect the account
• Rate limiting, a per-address sign-up cap and abuse monitoring

No method of transmission or storage is perfectly secure. You are responsible for protecting your API keys and the endpoints you configure.

Data is stored in France. Some providers in section 7 process data in the United States; for those we rely on the EU–US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses with supplementary measures otherwise.

12.1 GDPR / UK GDPR

You may have the right to:

• Access, rectify or erase your data
• Restrict or object to certain processing — including the collection of a public post you wrote
• Receive the data you provided in a portable format
• Lodge a complaint with a supervisory authority. Ours is the CNIL, cnil.fr.

12.2 California and similar US state laws

We do not sell personal information. Residents of California and similar jurisdictions may request to know or delete the personal information we hold about them.

To exercise a right, email support@nephia.cc with the subject "Privacy Request". We may need to verify your identity, and we answer within 30 days.

We use essential cookies for sign-in and dashboard preferences, and analytics cookies only with your consent. See our Cookie Policy. The product API authenticates with API keys and sets no cookies.

The Services are not directed to individuals under 18, and we do not knowingly open accounts for them. Public posts by minors can appear in mentions like anyone else’s; a removal request from a minor or their parent is handled as in section 8, with priority.

We update this policy by posting a revised version and dating it. For material changes we email account holders 30 days before they take effect.

Privacy questions and requests: support@nephia.cc