Privacy Policy

0bull is operated by NANIMAD SL, a company incorporated in Spain with CIF/NIF B88372354, registered office at Plaza Mayor 3, Piso 1 G, 28850 Torrejón de Ardoz, Madrid, Spain, registered with the Registro Mercantil de Madrid. For the personal data described in this policy we are the controller, except where the section on our roles says otherwise. You can reach us about anything in this policy at [email protected].

This policy covers visitors to our website, people who create an account, their team members, and people who contact us. It does not cover the personal data of third parties that you process through the Service (for example the people who appear in the videos you post), for which you are responsible and we act only on your instructions, as explained below.

We collect the following categories of personal data.

• Account data: your name, email address, password (stored as a hash), preferred language, two-factor and recovery settings, and, if you sign in with Google, the name, email and profile identifier Google shares with us.
• Team data: the email addresses of people you invite to your team and the role you give them.
• Billing data: the amount and dates of your charges, invoices, tax details you provide, and a Stripe customer identifier. Your card number and bank details are collected and stored by Stripe, not by us. We see only the card brand, last four digits and expiry.
• Orders and Phones: the Phones assigned to you, when they were assigned, renewed, cancelled or released, the names you give them, and any standing allowance you configure.
• Platform account information: the public profile, post list and public metrics of the Platform Accounts you connect, so that we can show you how your posts are doing.
• Customer Content: the videos, captions, images, macros, prompts and agent instructions you upload or run through the Service.
• Phone operation data: what happens on a Phone while it is assigned to you, including screen captures streamed to your browser, screenshots taken to operate or troubleshoot a Phone, the taps, swipes and text sent to it, the apps opened, on-screen text read by OCR, agent runs and their logs, and the times at which these happened.
• API and MCP data: the tokens and clients you create, the requests made with them, and the results returned, so that the API works and so that we can secure it and investigate abuse.
• Technical data: IP address, browser and device type, operating system, pages visited, referrer, time zone and language, error reports and server logs.
• Ad measurement data: which of our ads or campaigns, or which other website, brought you to 0bull, the steps you took between arriving and paying, a keyed hash of your IP address and device family, and, where ad cookies are allowed, a random identifier for your browser. How we measure our ads explains exactly what this includes.
• Your answer to "How did you hear about us?", if you choose to give one.
• Your cookie choice: whether you accepted or refused ad cookies on our banner, had not answered yet, or were somewhere we do not need to ask, and when.
• Support and communications: the emails you send us, the messages we exchange, and the notes we keep about resolving your requests.
• When you use our contact form we ask Cloudflare Turnstile to check that you are not a bot; Cloudflare processes technical data about your browser and connection for that purpose, and we use the name, email address and message you send only to reply to you and to keep a record of your request.

We do not knowingly collect data from anyone under 18, and we do not ask for special categories of data such as health, religion or biometric data. Do not put such data into the Service beyond what is incidental to operating a Platform Account.

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases. Similar grounds apply under other privacy laws.

• To provide the Service you signed up for (performance of a contract): creating and securing your account, assigning and operating Phones, running your macros and agents, streaming the screen to you, processing payments and sending the emails that go with them, and answering support requests.
• To keep the Service safe and enforce our Terms (legitimate interests): monitoring for abuse, fraud, attacks and breaches of the acceptable-use rules, keeping logs, investigating incidents, protecting our fleet, our network relationships and other customers, and preventing re-registration after a termination for breach.
• To run and improve the Service (legitimate interests): understanding how the website and dashboard are used through cookieless analytics (Ahrefs Analytics and Fathom), our own count of the steps between a visit and a paid order, your optional answer to "How did you hear about us?" and, under the cookie rules explained below, Microsoft Clarity and Google Analytics; fixing errors; and planning capacity.
• To measure our advertising (consent where the law requires it, otherwise legitimate interests): recording which of our ads on X or Google, or which other website, brought you to us; linking the steps you then take, up to a purchase, to your browser and your account; and telling X and Google when a visitor signs up, starts a checkout or buys, so that we can see which ads work and they can show our ads to people likely to be interested. In the EU, the EEA, the UK and Switzerland, and wherever we cannot tell which country you are in, we ask for your consent on our cookie banner before we set ad cookies or keep ad click identifiers on your account. Some measurement does not depend on that choice; How we measure our ads and Who we share data with say which.
• To keep a record of your cookie choice (legal obligation and legitimate interests): storing the choice and when it was made on your account, so that we can show what you agreed to.
• To meet our legal obligations (legal obligation): keeping invoices and tax records, responding to lawful requests from authorities, complying with sanctions law, and reporting child sexual abuse material.
• To tell you about the Service (legitimate interests or consent): sending you service announcements about your account and Phones, and, if you are a customer, occasional emails about features and offers, which you can opt out of at any time. Where the law requires consent for marketing, we ask for it first.
• With your consent, where we ask for it: for anything not covered above. You can withdraw consent at any time without affecting what was done before.

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects on you. Automated abuse detection is reviewed by a person before an account is terminated, unless immediate action is needed to stop harm.

For your account, billing, technical, support and website data we decide why and how it is processed, so we are the controller.

For the Platform Accounts you operate through the Service and the Customer Content you run through it, you decide what to post, where and why. You are the controller of that data (or the processor for your own clients), and we process it only on your instructions to provide the Service, as your processor. Our Terms of Service contain the data processing commitments this requires, and we will sign a separate data processing agreement, including the EU standard contractual clauses and the UK addendum where needed, on request at [email protected].

Strictly necessary cookies, which need no consent: the session cookie that keeps you signed in, a cross-site request forgery token, your language choice if you change it, and cookie_consent, which remembers your answer to our cookie banner for 6 months.

Where we ask for consent (visitors in the EU, the EEA, the UK and Switzerland, and visitors whose country we cannot tell), the cookies and tools described below are used only after you click Accept on our cookie banner. Everywhere else they are used without asking. Where we ask, you can change your answer at any time with the Cookie settings link at the foot of our pages. If you click Reject, we delete the ad_attribution and visitor_id cookies, delete the cookies that the X pixel, the Google tag and Clarity keep on our own domain if they were running, and stop loading them. Cookies they keep on their own domains are governed by their own policies.

ad_attribution (our own cookie, kept for 30 days from its last update). Set when you arrive from one of our ads or from another website. For an ad, it records the ad's click identifier (X's twclid, or Google's gclid, gbraid, wbraid and gad_campaignid), its campaign tags (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the page you landed on and the time. It also keeps the name of the website that first sent you to us (its host name only, such as example.com, never the full address of the page), and, once you arrive from a second ad, the first ad as well as the latest one. A visit from another website that is not an ad stores only that website's name. We use it to credit a sign-up or purchase to the ad or website that brought you.

visitor_id (our own cookie, kept for 1 year). A random identifier (a UUID) for your browser, not derived from anything about you. It lets us link the steps your browser takes on our website before you sign up to the account you then create (see How we measure our ads). It is not strictly necessary: the website works without it. It is set only where ad cookies are allowed and deleted when you click Reject on the banner. We do not send it to X, Google or anyone else.

Our website analytics, Ahrefs Analytics and Fathom, are cookieless. They count page views and referrers without storing an identifier in your browser and without tracking you across sites, and the data they give us is aggregated.

Our website also loads the conversion pixel of X (formerly Twitter) and the Google tag, which runs Google Ads and Google Analytics. They let X and Google set their own cookies in your browser and receive the pages you visit, your IP address and browser details, so that each can measure our ads and build advertising audiences, under its own privacy policy. Through the Google tag we also tell Google when a visitor signs up, starts a free demo, starts a checkout (with its amount) or completes a purchase (with the payment's reference), and we send Google Analytics the steps of our sign-up and checkout funnel. Our server may also report a paid order to Google Ads, as described under Who we share data with. You can also block them with your browser's tracking protection or a content blocker.

Our website also loads Microsoft Clarity. It sets its own cookies and records how you use our pages, such as clicks, scrolling, mouse movement and the page that referred you, and marks steps such as signing up or starting a checkout, so we can see where visitors come from and improve the website. Clarity masks the text you type into forms. If you are signed in, we pass Clarity your account's internal identifier so your sessions are linked, never your name or email.

Your browser may store data locally for the dashboard to work (for example the last phone you selected). That data stays on your device and is not used to track you.

This section explains, in one place, what we keep to learn which ads and websites bring us customers, and what your cookie choice changes. We do not sell any of it for money. What reaches X and Google is listed under Who we share data with.

• Ad details on your account. When you create an account (with the sign-up form, with Google sign-in or by ordering as a guest), we store on it what your ad_attribution cookie holds: the latest ad and the first ad that brought you (click identifiers, campaign tags, landing page and time) and the website that first sent you. We also store the IP address and browser details of that request, and update them when you start a free demo or a checkout, so that a purchase reported later can still be matched to the ad. The IP address and browser details are stored whether or not you accepted ad cookies.
• Click identifiers and your consent. The click identifiers of X (twclid) and Google (gclid, gbraid, wbraid and gad_campaignid) are kept on your account only if you accepted ad cookies or are somewhere we do not need to ask. If you arrive from an ad before answering the banner, the ad's details wait on our server in your session, not in your browser, until you answer or the session ends. If you create an account while the banner is still unanswered, the account gets the campaign tags, landing page and time, but not the click identifiers; if you then click Accept, the click identifiers are added, unless your account already holds one. If you click Reject while signed in, we remove every click identifier from your account, including those of the first ad and of any probable match, and keep the campaign tags.
• Landing records, for a sign-up in another browser. An ad often opens inside the X app's own browser, and the account is then created in Safari or Chrome, which cannot read the first browser's cookies. So when you arrive from an ad, we keep a landing record: the ad's details (click identifiers, campaign tags, landing page and time) under a keyed hash (HMAC-SHA256, made with a secret key only we hold) of your IP address and your device family (such as iPhone, iPad, Android, Windows, Mac, ChromeOS or Linux). The record never contains your IP address or browser details themselves. When an account is created in a browser that holds no ad of its own, and ad cookies are allowed, we look for landing records with the same hash from the previous 24 hours. If exactly one ad matches, we store it on the account as a probable match. A probable match is a guess, not a certainty: everyone on the same network with the same kind of device (an office, a university, a mobile carrier) has the same hash, so the ad can be credited to the wrong person. We use it only for our own reporting and never send it to X or Google. Landing records are written only where ad cookies are allowed, are deleted when you click Reject (with any other record under the same hash), and are deleted automatically 7 days after the last visit from that ad.
• Funnel steps. We count the steps between a visit and a paid order: an engaged visit (a page kept in view for at least 10 seconds with a scroll or a tap), opening the sign-up page, submitting it (and which field was rejected, if any), asking for a setup link by email, signing up, starting a checkout and completing a purchase. Each step is stored with its date, the ad platform (X or Google) and campaign tags the visitor came from, and no IP address, browser details or readable email address. Where ad cookies are allowed, a step also carries your browser's visitor_id and, once you have an account and are signed in, your account; when you sign up, the earlier steps with the same visitor_id are linked to your new account. A purchase step always carries your account, because it is part of your order, together with the visitor_id stored on your account (if any), the number of phones you bought and, if the latest ad that brought you had a click identifier, when that click was recorded. The daily totals our team reads contain counts only, never your account or visitor_id.
• "How did you hear about us?". After a completed order we may ask this once. You can choose X, Google, ChatGPT or another AI, a friend or word of mouth, another search engine, YouTube or somewhere else, and for somewhere else add up to 100 characters in your own words, or you can skip it. We store your answer (or that you skipped) and when on your account, and we do not ask again.
• Your cookie choice. When you create an account, we store on it whether you had accepted or refused ad cookies, had not answered yet, or were somewhere we do not need to ask, and when. Where we ask for consent, we update it each time you answer the banner while signed in. This is our record of your choice.

Clicking Reject does not by itself remove the visitor_id or the campaign tags already stored on your account, or the funnel steps already linked to it. To have any of these records deleted, or to object to them, email [email protected] (see Your rights).

We do not sell your personal data for money. The only personal data we share for advertising goes to X and Google, as described below; because they also use it to show ads to people and build advertising audiences, some US state laws treat this as a "sale" or "sharing" of personal information (see Your rights). We share personal data only with the following recipients, and only what each needs.

• Stripe, our payment processor, which collects and stores your payment details, processes charges and refunds, screens transactions for fraud and sanctions, and issues invoices. Stripe acts as an independent controller for that data under its own privacy policy.
• An application hosting provider located in the European Union, whose servers run our application, database, backups and stored Customer Content, and the mobile and internet connectivity providers that serve the Phones. The names, locations and contractual safeguards of these providers are available on request at [email protected].
• Our transactional email delivery provider, which sends account, billing and support emails on our behalf and processes your email address and the message content.
• Google, if you choose to sign in with Google, which tells us who you are under Google's own privacy policy.
• X Corp., our advertising platform. Through its pixel on our website, X receives the pages you visit, your IP address and browser details. Through X's Conversions API, our server tells X when a visitor from one of its ads arrives, reads a page, opens the sign-up page or asks for a setup link, with the click identifier, IP address and browser details, only where ad cookies are allowed. It also tells X when you sign up, start a free demo, start a checkout or buy, with a one-way hash (SHA-256) of your email address, your IP address and browser details, the order value for a checkout or purchase, and X's click identifier if your account holds one. These sign-up, demo, checkout and purchase reports are sent whether or not you accepted ad cookies; where consent is required and you have not given it, they carry no click identifier. X uses this to attribute and optimise our ads, and acts as an independent controller under its own privacy policy.
• Google Ireland Limited (Google Ads and Google Analytics), our advertising and analytics platform. Through the Google tag on our website, Google receives the ad click identifier, the pages you visit, your IP address and browser details, our sign-up, free demo, checkout and purchase conversions as described under Cookies and analytics, and the steps of our sign-up and checkout funnel. If you arrived from a Google ad and its click identifier is kept on your account (because you accepted ad cookies or are somewhere we do not need to ask), our server may also report your paid orders to Google Ads, with the Google click identifier (gclid, gbraid or wbraid), the amount and currency, the time of payment and a payment reference, so that Google can measure the ad. It does not send Google your email address (in plain text or hashed), your name or your card or bank details. Google uses this to measure and optimise our ads and build advertising audiences, and acts as an independent controller under its own privacy policy.
• Microsoft Corporation (Microsoft Clarity), our website analytics for session recordings and heatmaps. Through Clarity on our website, Microsoft receives how you use our pages, the referring page, your IP address and browser details, and processes them under its own privacy statement.
• TikHub, a public social-media data provider, which receives the public usernames of the Platform Accounts you connect so that we can show you public post metrics.
• Cloudflare, which runs the Turnstile check on our contact form and receives technical data about your browser and connection to confirm that you are not a bot.
• The Platforms you sign in to through a Phone, which see the Phone, its IP address and whatever you and your Agents do on your accounts, under their own terms and policies.
• Professional advisers, and any successor if 0bull is sold or merged, under confidentiality obligations.
• Courts, regulators, law enforcement and Platforms, where we are required by law, where we reasonably believe it is necessary to prevent or investigate unlawful activity, fraud or harm, or where we must enforce our Terms or protect our rights, our customers or the public.

Every service provider that acts on our behalf is bound by a contract that limits what it can do with your data and requires appropriate security.

Our servers and the Phones are located in the European Union. Some recipients listed above, including Stripe, Google, Microsoft, X, TikHub, Cloudflare and our transactional email provider, may process personal data in the United States or elsewhere. Where a recipient processes EU- or UK-protected data outside the EEA or UK, we rely on an applicable adequacy decision, including the EU-US Data Privacy Framework or its UK extension where the recipient is certified, or on the European Commission standard contractual clauses and the UK international data transfer addendum, with supplementary measures where needed. You can ask us at [email protected] for a copy of the relevant safeguards.

If you use the Service from outside the European Union, your data is transferred to and processed in the European Union.

We keep personal data only for as long as we need it for the purposes above, and then delete or anonymise it. The main periods are:

• Account data: for the life of your account, then deleted within 30 days of closure.
• Customer Content and Phone operation data: for the life of the Phone assignment they relate to, then deleted within 30 days of the Phone being released or the account being closed. Screen streams are shown live and are not recorded unless a screenshot is taken to operate or troubleshoot a Phone.
• Public post metrics we collect about your Platform Accounts: 180 days on a rolling basis.
• API and technical logs: up to 12 months, unless needed longer to investigate a security incident.
• Billing records: for as long as tax and accounting law requires, typically 6 to 10 years depending on the country.
• Support correspondence: 3 years after the request is closed.
• Ad measurement data stored with your account (the ads and website that brought you, the IP address and browser details, any probable match, your visitor_id, your cookie choice and your answer to "How did you hear about us?"): for the life of your account, then deleted within 30 days of closure.
• Cookies: ad_attribution for 30 days from its last update, visitor_id for 1 year, cookie_consent for 6 months. Ad details waiting for your answer to the cookie banner stay in your session until you answer or the session ends.
• Landing records (the keyed hash and the ad's details): 7 days after the last visit from that ad, deleted by a daily job.
• Funnel steps: kept for our reporting with no fixed end date. When your account is deleted, the link to your account is removed from them; the step, its date, the ad platform and campaign tags, the number of phones for a purchase and the browser's random visitor_id remain. You can ask us to delete them at [email protected].
• Records of a termination for breach: as long as needed to document the breach and prevent re-registration.

Backups are retained for a limited period and overwritten in the ordinary cycle. Data may persist in backups for a short time after it is deleted from live systems.

We protect your data with measures appropriate to its sensitivity, including encryption in transit, hashed passwords, optional two-factor authentication, role-based access to the dashboard and API, network isolation of the Phones from the public internet except for their own connection, access logging, and a small number of people with production access.

If we become aware of a personal data breach that is likely to result in a risk to you, we will notify the competent supervisory authority and, where the law requires, you, without undue delay.

Depending on where you live, you have some or all of the following rights over your personal data. We honour them for everyone, wherever they are, unless a law prevents it.

• Access: ask for a copy of the personal data we hold about you and information about how we use it.
• Rectification: ask us to correct inaccurate or incomplete data. You can change most account details yourself in the dashboard.
• Erasure: ask us to delete your data. We will do so unless we need to keep it for a legal obligation or a legal claim.
• Restriction and objection: ask us to limit how we use your data, or object to processing based on our legitimate interests, including profiling and direct marketing.
• Portability: receive the data you gave us in a structured, machine-readable format, and have it sent to another provider where technically feasible.
• Withdraw consent: at any time, for any processing based on consent, without affecting what was done before. For cookies, where we ask for consent, use the Cookie settings link at the foot of our pages and click Reject.
• Complain: lodge a complaint with a data protection supervisory authority, in particular in the EU or UK country where you live or work or where you believe a breach occurred. We would appreciate the chance to address your concern first.

To exercise any right, email [email protected] from the address on your account, or tell us how else we can verify that you are who you say you are. We respond within one month, extendable by two further months for complex requests, and we will tell you if that happens. We do not charge for requests unless they are manifestly unfounded or excessive. You can appoint someone to act for you if you give them written authority. This includes the records described under How we measure our ads: on request we delete the ad details, probable match, visitor_id, cookie choice and "How did you hear about us?" answer stored on your account, and the funnel steps linked to it, unless we must keep them for a legal obligation or a legal claim.

Residents of California and other US states with comprehensive privacy laws. You have the rights to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; to obtain a copy of it; and not to be discriminated against for exercising these rights. You also have the right to opt out of the sale of your personal information, of its sharing for cross-context behavioural advertising, of targeted advertising, and of profiling that produces legal or similarly significant effects. We make personal information available to X and Google so that we can measure our ads and so that they can show our ads to people likely to be interested and build advertising audiences. That is targeted advertising and cross-context behavioural advertising, and under some of these laws it can count as a "sale" or "sharing" of personal information. The categories are: online identifiers (ad click identifiers, and the cookie and browser identifiers X and Google set through their tags), your IP address and browser details, a one-way hash (SHA-256) of your email address (sent to X only), and the pages you visit and our sign-up, free demo, checkout and purchase events, as described under Who we share data with. We do not sell personal information for money, we do not sell or share it with anyone else for advertising, and we do not engage in profiling that produces legal or similarly significant effects. We have shared the categories above with X and Google in the preceding 12 months. To opt out of this sale or sharing and of targeted advertising, email [email protected] with "Opt out" in the subject line, and we will honour it. Where our cookie banner appears (see Cookies and analytics), clicking Reject also stops the X pixel and the Google tag in that browser. Our website does not currently detect Global Privacy Control signals, so emailing us is how to exercise this right. If we deny a request you may appeal by replying to our decision, and we will explain the outcome of your appeal in writing and, where required, how to contact your state attorney general.

Residents of the United Kingdom, Switzerland, Brazil, Canada, Australia and other countries. Your local law gives you rights that closely match those above, and you can exercise them in the same way. We will apply the stricter rule where local law is more protective.

We send transactional emails you cannot opt out of while you have an account, such as order confirmations, assignment and renewal notices, payment failures, security alerts and changes to our Terms.

If you are a customer we may also send you occasional emails about new features and offers for similar services, on the basis of our legitimate interest or, where the law requires it, your consent. Every such email has an unsubscribe link, and you can also opt out at [email protected]. We do not send marketing emails to people who are not customers unless they asked for them, and we do not share your contact details with anyone for their own marketing. The one-way hash of your email address that we send X for ad measurement is described under Who we share data with.

The Service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, tell us at [email protected] and we will delete it and close the account.

We update this policy when our practices, the law or the Service change. The date at the top shows the last revision. For material changes we will tell you by email or in the dashboard before they take effect. Continuing to use the Service after a change means you have read the updated policy.

Questions, requests and complaints about privacy go to [email protected]. Put "Privacy" in the subject line so we can route it quickly. If you are not satisfied with our answer you can contact the data protection authority in your country.