How Nine·Tails collects, uses, and protects information — written so a person can read it, not just a lawyer.
Draft. This document is the initial pre-launch version of the Nine·Tails Privacy Policy. It will be reviewed by counsel before any paid customer signs up. The legal-entity name, the controller/processor designations, and the subprocessor list will be finalized in that review.
This policy describes how Nine Tails ("Nine·Tails," "we") handles the personal information of (a) visitors to ninetailsagency.com, (b) people with Nine·Tails accounts, and (c) end clients of agencies using the Service ("end clients") to the extent we process their information on the agency's behalf.
For end-client data, the agency is the controller and Nine·Tails is the processor — see the Data Processing Addendum at ninetailsagency.com/legal/dpa for the formal terms.
When you connect an ad platform or analytics tool to the Service, we receive metric data scoped to the accounts you authorize. We store snapshots of that data so reports can be regenerated. We do not pull personal information about end customers from those platforms — only aggregate metric series.
We do not contact your end clients. End-client information appears in our system only as part of a Report that you draft and send. The Report's recipient address is processed by our email vendor solely to deliver the message and is not used for any other purpose.
We do not sell personal information, share it with advertisers, or use it to target you with ads outside our own product.
Drafts of report narratives are generated by Anthropic's Claude family at time of writing. The metric snapshots we send to the model are processed under Anthropic's enterprise data terms — Anthropic does not train on the content of those calls. The model's role is limited to drafting; nothing is sent to your end clients without an authorized human review on your team.
We use a small number of operational subprocessors. The list below is current as of this document's effective date and is also maintained in the DPA appendix:
We will notify customers in advance of new subprocessors via email and an in-product banner.
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information. Email hello@ninetailsagency.com and we will respond within 30 days.
If you are in the EEA / UK / California, you can exercise these rights under GDPR / UK GDPR / CCPA respectively. We honor verified deletion and access requests regardless of jurisdiction.
Your data may be processed in the United States and the European Union depending on which subprocessor handles it. Where required, we rely on Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms.
We use a strictly-necessary session cookie for authentication. We do not use third-party tracking cookies on the marketing site at this time. If we add analytics that fire before consent, we will publish a cookie banner and update this section first.
The Service is not directed to children under 13, and we do not knowingly collect information from them.
We may update this policy. Material changes get at least 30 days' notice via email and an in-product banner. The "Last updated" date at the top of the page reflects the most recent revision.
For privacy questions or to exercise your rights — write to hello@ninetailsagency.com.