Privacy Policy

1. Overview

Controller

The controller for the processing of personal data under this policy is:

nebty GmbH
c/o BASE Coworking
Blütenstr. 15
80799 Munich, Germany
Email: [email protected]

Please send all questions about data protection and all requests about your rights to this address.

What this policy covers

This policy covers:

• the website nebty-id.com,
• the free tools: the website scanner, the domain lookup, the API and the MCP server at tools.nebty-id.com, the DoppelCart search and the Impersonation Explorer,
• the nebty platform at dash.nebty.de with its API at app.nebty.de and the MCP server mcp.nebty-id.com.

Personal data is any information that relates to an identified or identifiable person, for example a name, an email address or an IP address.

When we act on behalf of our customers

When our customers use monitoring or takedowns, we process the third-party data involved on their behalf. The customer is then the controller. This is governed by our Data Processing Agreement. Section 6 describes this processing so that the people concerned know what happens.

2. Visiting the website

Hosting and delivery

The website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). When you open a page, Cloudflare processes technically necessary data: your IP address, date and time, the address you open, the page you came from (referrer), and your browser and operating system. Cloudflare uses this data to deliver the page and to block attacks. For this, Cloudflare can set the cookie __cf_bm. We do not keep log files for the website ourselves.

The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). The cookie is strictly necessary for this service (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). Cloudflare is certified under the EU-U.S. Data Privacy Framework.

Browser storage

The website stores a few entries in your browser storage (localStorage and sessionStorage): your choice in the cookie banner with its date, your language, the currency you chose on the pricing page and, for a moment, the result of a website scan. These entries are necessary for the functions you request (§ 25(2) no. 2 TDDDG) and do not leave your device. If you allow ad measurement, the website also keeps the click ID of an ad for the current tab (see "Google Ads conversion tracking" below). All entries with their purpose and duration are listed in the Cookie Policy.

Audience measurement with Ahrefs Web Analytics

We measure the use of the website with Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd., Singapore. The script loads from analytics.ahrefs.com, also on our short-link pages. Ahrefs receives your IP address, the page you open, the referrer, your browser, operating system and device type. Ahrefs sets no cookies and stores nothing on your device.

According to Ahrefs, a hash is built from your IP address and browser identifier together with a random value that changes every day. Ahrefs does not store the IP address itself, and the random value is deleted after 24 hours. We only see aggregated figures, for example visits per page, country and source.

The legal basis is our legitimate interest in measuring the reach of our content and improving the website (Art. 6(1)(f) GDPR). There is no adequacy decision of the EU Commission for Singapore. The transfer relies on the EU Commission's Standard Contractual Clauses, which we have agreed with Ahrefs. You can object to the measurement under Art. 21 GDPR. To prevent it technically, block analytics.ahrefs.com in your browser.

Apollo.io (only with consent)

If you consent in the cookie banner, we load the website tracker of ZenLeads, Inc. (Apollo.io), 440 N Barranca Ave #4750, Covina, CA 91723, USA. The tracker records the pages you visit, your IP address, browser and device details and the referrer, and sets cookies for this. Apollo.io matches the IP address to a company. This shows us which companies visit our website, so our sales team can contact them.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Your consent is valid for twelve months. You can withdraw it at any time with effect for the future, via "Cookie settings" in the footer of every page. Without consent, the tracker does not load. Apollo.io processes the data in the USA and is certified under the EU-U.S. Data Privacy Framework. We have a data processing agreement with Apollo.io.

Google Ads conversion tracking (only with consent)

We run ads on Google. If you allow "Ad measurement" in the cookie banner, we load the Google tag of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for Google Ads conversion tracking. It shows us which ad clicks lead to a takedown request, a demo booking or a trial signup, so we can see which ads are worth paying for. Without your consent, the Google tag does not load and this website sends nothing to Google Ads.

When you reach our website through one of our ads, Google adds a click ID (gclid, gbraid or wbraid) to the address. With your consent, the Google tag stores it in cookies on nebty-id.com, and we keep it in your browser's session storage until you close the tab. If you then send a takedown request or click the link to book a demo, the tag reports this conversion to Google with the click ID, the time and the conversion type. Google receives your IP address, browser and device details and the address of the page in the process. In Google Ads we only see aggregated figures, for example how many conversions an ad led to.

We do not use the data for remarketing or for personalised ads based on what you do on our website. Ad personalisation and Google signals are switched off in the tag. Google processes the data as an independent controller under the Google Ads Controller-Controller Data Protection Terms.

When you click "Free Trial", the same consent covers handing the ad click over to our platform dash.nebty.de. The link then carries the click ID and a note that you consented on the website. On the platform, the Google tag reports a completed registration to Google Ads as a conversion and can set the Google Ads cookies on dash.nebty.de too. Without your consent, the link carries neither and the platform does not load the Google tag.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Your consent is valid for twelve months. You can withdraw it at any time with effect for the future, via "Cookie settings" in the footer of every page. After a withdrawal, the website sends no further conversions and deletes the Google Ads cookies on nebty-id.com and the stored click ID. Google can transfer data to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; Google has also agreed Standard Contractual Clauses for these transfers.

Videos from YouTube

Some pages show videos from YouTube. We only load a video when you click its preview image. Before that, no data goes to YouTube. After the click, the player loads from youtube-nocookie.com, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives your IP address, the page and browser details and can store data in your browser.

The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google can transfer data to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Website icons from Google

The website scanner, the domain lookup and the platform show the icon (favicon) of a domain next to it. Your browser loads these icons from the service www.google.com/s2/favicons. Google receives the name of the domain shown, your IP address and browser details. The legal basis is our legitimate interest in a clear display (Art. 6(1)(f) GDPR). The provider is Google Ireland Limited; transfers to Google LLC are covered by the EU-U.S. Data Privacy Framework.

Exchange rates

The cost calculators on our comparison pages load the current exchange rate from api.frankfurter.dev, an open service based on the rates of the European Central Bank. Your IP address reaches the operator and its network provider Cloudflare. The operator states that it does not store IP addresses. We do not send any input. The legal basis is Art. 6(1)(f) GDPR.

3. Contact, meetings and forms

Contact by email

When you email us, we process your address, your name and the content to answer your request. Our mailboxes are hosted by Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland). The legal basis is the preparation or performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

Booking a meeting

For demo meetings we link to a Notion Calendar booking page. When you book there, Notion Labs, Inc., USA, processes your name, email address, the meeting and your notes on our behalf. We copy the details into our customer management system in Notion. The legal basis is Art. 6(1)(b) GDPR. Notion is certified under the EU-U.S. Data Privacy Framework; we have a data processing agreement with Notion.

Report sign-up and takedown request

Our forms let you request a free nebty report or a takedown. We process:

• for the report: name, company, email address, domain, your note, language, source page and time,
• for the takedown request: company, email address, type of request, the reported address, your original domain, your description, language, source page and time.

The forms send the details to our automation server (n8n) at Hetzner Online GmbH in Finland. From there we store them in our customer management system in Notion. We use the details to create the report or handle the request and to contact you about it. The legal basis is Art. 6(1)(b) GDPR.

4. Free tools

Website scanner, domain lookup, API and MCP server

The website scanner and the domain lookup run at tools.nebty-id.com, as do the API and the MCP server. The service runs on Cloudflare (Cloudflare Workers), where the database and the stored files are also kept. For a scan, our capture service on servers of Hetzner Online GmbH in Germany opens the page you entered. It uses proxy servers of Oxylabs, UAB, Vilnius, Lithuania.

We process:

• the address you enter and the resulting snapshot with screenshot, source code and page text,
• public details of the domain from DNS and registration databases (RDAP), including the abuse contact addresses of providers,
• your IP address, to limit the number of anonymous scans. For this we keep one counter per IP address for the current minute, which every new request overwrites,
• if you use an API key, the key, so that we can assign private scans to you,
• technical request logs at Cloudflare.

Snapshots are public by default. Anyone with the link can open them, and they appear in the searchable archive. The legal basis for the scan is the use of the service under our Terms of Use (Art. 6(1)(b) GDPR). The IP-based limit and the logs are based on our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR).

People on scanned pages

A snapshot shows a third-party website as it was publicly available. It can therefore contain personal data that appeared there, such as names, contact details or photos. The source of this data is the scanned, publicly accessible website. We store snapshots to document suspicious websites in a verifiable way, so that users can recognise and prove fraud and phishing. The legal basis is this legitimate interest (Art. 6(1)(f) GDPR).

If you appear in a snapshot, you can object to the processing and request deletion. Write to [email protected] and give the scan ID or the address. Snapshots stay stored until they are deleted on request or by us.

DoppelCart search

The search in our DoppelCart investigation sends your search term to investigations.nebty-id.com. The service runs on Cloudflare and uses your IP address briefly to limit the number of requests. The pages at investigations.nebty-id.com count visits with Cloudflare Web Analytics, without cookies. The legal basis is Art. 6(1)(f) GDPR.

Lookalike check

The lookalike check on the home page computes possible fake domains in your browser. Your input does not leave your device. If you then request a report, we carry the domain over into the form.

5. The nebty platform

Hosting

The platform at dash.nebty.de, its API at app.nebty.de, the database and the storage for screenshots and evidence run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. The MCP server at mcp.nebty-id.com runs on Cloudflare and forwards requests to the platform.

Registration and account

For an account we process your email address and your password. We store the password only as a hash. If you register with Google, we also receive your name. To confirm, we send you a link by email. To stop bots from registering, Cloudflare Turnstile checks the sign-up; Cloudflare receives your IP address and browser details for this.

The legal basis for the account is our contract with you (Art. 6(1)(b) GDPR), and for Turnstile our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). We keep account data for as long as the account exists. You can request the deletion of your account by email at any time.

Signing in

You sign in with a password, with a link sent by email (valid for 15 minutes, we only store a hash) or with Google. When you sign in with Google, we receive your name, your email address and an identifier of your Google account from Google Ireland Limited. Optionally, you protect your account with a code sent by email as a second factor. For access through the API or AI assistants (MCP), we store API keys only as a hash and access tokens with a limited lifetime, together with the time of last use. The legal basis is Art. 6(1)(b) GDPR.

Connecting AI assistants through MCP

When you connect an assistant such as Claude (Anthropic) or ChatGPT (OpenAI), you choose which provider receives results from nebty. OAuth records your authorization, the client, granted permissions and connection activity. The connection can retrieve account metadata, brand records and monitoring findings available to your account, including public profiles, evidence descriptions and notes. It can also read existing takedown status and history. We limit results to reviewed fields; arbitrary personal data inside an evidence description or note is not automatically removed.

The purpose is to provide the integration you request (Art. 6(1)(b) GDPR). The chosen assistant provider processes the results under its own terms and privacy policy. Its retention and international transfers depend on your plan and settings. Review those policies and your organization's rules before connecting. OAuth credentials are used for authentication and are not included in tool results. Never enter credentials in a conversation.

For account signup during a connection, we temporarily store the signup and connection context so you can verify your email and complete checkout. Essential cookies bind those steps to your browser (§ 25(2) no. 2 TDDDG). We retain connection records with the account and apply the platform's retention rules below. You can revoke access in the dashboard settings or disconnect in the assistant. Revoking blocks future use of that connection; it does not erase results already held by the provider or reverse completed actions. Account deletion can be requested by email.

Browser storage in the platform

The platform stores in your browser your sign-in (access tokens), your language, view settings and the search history of the Impersonation Explorer. A cookie remembers for seven days whether the sidebar is open. These entries are necessary for the functions (§ 25(2) no. 2 TDDDG). After 30 minutes without activity, the platform signs you out. The platform loads its font from Google Fonts; Google receives your IP address (Art. 6(1)(f) GDPR).

Logs and error monitoring

For every request to the platform, our servers log the IP address, browser, user ID, requested address and time. The logs are overwritten continuously and kept only briefly. To block attacks on sign-in and the API, we count requests per IP address for one minute to one hour.

We send errors and operational messages to Sentry, provided by Functional Software, Inc., USA. Sentry stores the data in the EU. The messages contain technical details and can contain user IDs and email addresses. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Access from the USA is covered by the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses.

Platform emails

The platform sends emails through SendGrid, provided by Twilio Inc., USA: confirmations, sign-in links and codes, invitations, alerts, reports, takedown messages and the confirmation of a power of attorney with the PDF attached. We keep a copy of every email sent, with recipient and content, in the platform. We do not analyse whether you open an email or click its links. The legal basis is Art. 6(1)(b) GDPR. Twilio is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses also apply.

Internal notifications

The platform informs our team in Slack about new monitoring sign-ups, about new takedown requests and about feedback on findings. Depending on the event, the message contains the company name, the brand, the domain, the chosen plan with its price, the name and role of the signing person and the user's email address. This lets us support new customers at the start, review sign-ups and handle takedowns quickly. The legal basis is our legitimate interest in supporting our customers (Art. 6(1)(f) GDPR). Slack is certified under the EU-U.S. Data Privacy Framework.

Contract, onboarding and payment

To conclude the contract we process company name, address, country, VAT ID and the name and role of the person signing. We store the acceptance of the terms and the power of attorney with time and IP address as proof. What we also store for the power of attorney for takedowns is described under "Proof of the power of attorney for takedowns". Payments are handled by Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe collects the billing name, address, email address, VAT ID and payment details and is itself responsible for payment processing. We only store identifiers, subscription and invoice data.

The legal basis is the contract (Art. 6(1)(b) GDPR) and, for invoices, our legal retention obligation (Art. 6(1)(c) GDPR). Stripe can transfer data to Stripe, Inc. in the USA; Stripe is certified under the EU-U.S. Data Privacy Framework.

Proof of the power of attorney for takedowns

With the Terms and Conditions for Takedown Services you grant us a power of attorney to act in your name towards providers, registrars and platforms (§ 3 of the terms). When you accept these terms, the platform creates a PDF as proof. It contains the company name, address and country, the name, role and email address of the person signing, the wording of the power of attorney, the time, IP address and browser identifier (user agent) of the confirmation, and the address, version and full text of the terms. We also store these details in the platform, together with a checksum (SHA-256) of the PDF. The checksum lets us show later that the PDF has not been changed.

The PDF is kept at Hetzner Online GmbH in Germany in storage that locks it against changes and deletion for ten years. We send a copy by email to the person who signed. If a provider or platform asks for proof of our authority, we send it where this is necessary to process the takedown. Transfers outside the European Economic Area are subject to the conditions in section 6.

We create and use the record to carry out the takedowns you request. The legal basis is Art. 6(1)(b) GDPR where you are personally our contracting party. For the data of people acting as representatives and for keeping the record, we rely on our legitimate interest in showing providers and platforms, and demonstrating in legal disputes, that we were authorised to act (Art. 6(1)(f) GDPR), where the processing is necessary for this purpose and your interests or fundamental rights do not override it.

You can revoke the power of attorney in text form at any time. The revocation applies to the future. We still keep the record of the power of attorney you granted for at least ten years from the date it was granted, also if you delete your account or the brand. The platform does not automatically delete the record when the technical lock expires. We assess erasure requests individually. Where the record is necessary to establish, exercise or defend legal claims, the exception under Art. 17(3)(e) GDPR may prevent erasure.

Impersonation Explorer

The Impersonation Explorer lets you search for fakes of a brand without an account. We store the brand name, the domain you enter and the results. We use your IP address only briefly to limit the number of requests. For the search we use AI models and services that retrieve public content (see section 6). The legal basis is Art. 6(1)(f) GDPR.

6. Third-party data in monitoring and takedowns

What we process for our customers

Our customers have us monitor whether their brand is misused online and have fake content removed. In doing so, we process data of people who are not customers:

• owners, operators and contacts of suspicious websites, profiles and ads: domain and registration data, content and screenshots, public profile data such as name, profile picture, job title and profile address, details of advertisers,
• employees of our customers, where we need their public profiles to tell real profiles from fake ones,
• contacts at providers and platforms to whom we send reports.

This data comes from publicly accessible sources: websites, certificate transparency logs, registration databases, social networks and the ad libraries of the platforms. The controller is the customer on whose behalf we act under the Data Processing Agreement. If you want to exercise your rights, you can also contact us. We forward your request to the customer.

Threat indicators under our own responsibility

We use technical features of fraudulent offers, such as domains, URLs, IP addresses, hashes, hosting providers and registrars, under our own responsibility to improve our detection and to protect other customers from the same attacks. The legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR). We do not disclose the identity of our customers.

Takedown reports

For a takedown we send reports with evidence on behalf of the customer to the competent parties: hosting providers, registrars, platforms, search engines and operators of security blacklists. These parties are located worldwide and process the reports under their own responsibility. Transfers outside the European Economic Area require an adequacy decision or appropriate safeguards under Art. 45 or 46 GDPR. Where these are absent, Art. 49(1)(e) GDPR can only apply to an occasional transfer necessary to establish, exercise or defend specific legal claims. We assess these conditions for each transfer and limit every report to what is needed.

Service providers in monitoring and takedowns

We retrieve public content through Bright Data Ltd. (Israel), Oxylabs, UAB (Lithuania) and VostokInc SAS (ScrapingBee, France). We assess findings with AI models of OpenAI Ireland Limited and through OpenRouter, Inc. (USA). OpenRouter forwards requests to providers of AI models that are also located outside the EU, including in Asia. We send these services public data from monitoring and details of the customer's brand, no account data. The full list is available under Sub-processors.

7. Recipients and transfers to third countries

Personal data is only received by the service providers in this table and the parties named in section 6. Our service providers process data only on our instructions, except Stripe for payment processing. Authorities receive data only where we are legally required to provide it.

The EU-U.S. Data Privacy Framework is based on an adequacy decision of the EU Commission (Art. 45 GDPR) and applies to certified companies. Standard Contractual Clauses are appropriate safeguards under Art. 46(2)(c) GDPR. You can get a copy on request.

8. Retention

We keep personal data for as long as we need it for the purpose. In detail:

• account data: for as long as the account exists,
• contract and invoice records: until the end of the legal retention periods of six to ten years (§ 257 HGB, § 147 AO, German commercial and tax law),
• records of a power of attorney granted for takedowns: at least ten years from the date it was granted, also after a revocation and after the account or the brand is deleted,
• requests and form data: until the request is handled, and for the duration of any business relationship that follows,
• platform server logs: only briefly, they are overwritten continuously,
• counters that limit requests: one minute to one hour, for the website scanner until the next request from the same IP address,
• your choice in the cookie banner: twelve months,
• Google Ads cookies on nebty-id.com: up to 90 days, the click ID in session storage until you close the tab; Google keeps conversion data according to its own retention periods,
• website scanner snapshots: until they are deleted on request or by us,
• data we process on behalf of our customers: as set out in the Data Processing Agreement.

9. Your rights

You have the following rights towards us:

• access to the data we hold about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal,
• a complaint to a supervisory authority (Art. 77 GDPR).

Our competent supervisory authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. You can also contact the supervisory authority where you live or work.

Right to object under Art. 21 GDPR

Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data, unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing, you can object at any time without giving reasons. We will then no longer use your data for this purpose.

An email to [email protected] is enough to object.

10. Further information

Obligation to provide data

You do not have to give us any data. Without the required details, however, we cannot create an account, conclude a contract or handle a request.

Automated decisions

We make no automated decisions under Art. 22 GDPR. AI assessments in monitoring prepare decisions. The customer orders a takedown.

Security

All connections to the website, the tools and the platform are encrypted with TLS. Our technical and organisational measures are described in Annex 2 of the Data Processing Agreement.

Changes

We update this policy when our services or the law change. The version on this page applies. The date is shown at the top.