LEGAL

Privacy Policy

Last updated October 21, 2026 · Pebble Media LLC

1. Who we are

NodeLens ("NodeLens," "we," "us") is operated by Pebble Media LLC. This Privacy Policy explains how we collect, use, disclose and protect personal information when you visit nodelens.app (the "Site"), join our waitlist, or use the NodeLens desktop app and related cloud services (together, the "Services"). For personal information covered by the EU or UK General Data Protection Regulation, Pebble Media LLC is the controller.

Contact: [email protected] · Pebble Media LLC, [MAILING ADDRESS]

If you use NodeLens on behalf of an agency or a client, information inside your workspace (such as a client's Search Console data) is processed on your instructions. You're responsible for having the right to connect the sites and accounts you add.

2. Information we collect

Information you give us

• Waitlist and link-map requests: email address, the form you used, and (for a free link map) the website address you want mapped.
• Account information: name (if provided), email address, password or sign-in credentials (passwords are handled by our authentication provider and stored only as hashes), workspace name, team members you invite, and your role.
• Billing information: plan, billing name and address, tax details and payment history. Card details are collected and stored by Stripe; we never see or store your full card number.
• Communications: anything you send us by email or through support, including replies to our emails.

Information collected automatically

• Site analytics (first-party): pages visited, buttons clicked, scroll depth, signups, which version of a page you saw (for A/B tests), referring website, campaign (UTM) tags, and device type (phone or computer). These are tied to a random ID, not your name. We don't store your IP address with these events. If your browser sends Global Privacy Control or Do Not Track, we don't record them.
• App and security data: device identifiers we issue for licence activation (limited by your plan), app version, sign-in times, rate-limit counters, and an audit log of security-relevant actions in your workspace (such as connecting Google or creating a share link).
• Server logs: our hosting and database providers process IP addresses, browser type and request details in their logs to deliver the Services and protect against abuse.

Information from the tools you connect

• Google Search Console and Google Analytics (read-only): search queries, clicks, impressions, positions, and traffic reports for properties you choose. See section 5.
• Other integrations you choose to connect (for example SEO data providers or your CMS for publishing links): the data needed to perform the action you request.

Data we don't collect

NodeLens crawls websites from your computer, and the crawled page content and full site maps stay on your device. Our servers only hold what you choose to save or share: map summaries, share links, and the link changes you track. We don't knowingly collect sensitive personal information (such as health, financial account, or government ID data).

3. How we use information, and our legal bases

We don't use personal information to make decisions that have legal or similarly significant effects on you based solely on automated processing.

4. How we share information

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We disclose it only:

• To service providers who process it for us under contract, only to provide their services:

  PROVIDER	PURPOSE
  Supabase	Database, authentication, cloud functions
  Cloudflare	Website hosting, DNS, security, email forwarding
  Resend	Sending email
  Stripe	Payments, invoicing, tax
  Google	Ads conversion measurement (Site), and the Google APIs you connect (app)

• Within your workspace: people you invite can see the workspace's data. Share links you create show a map summary to anyone with the link (and password, if you set one) until you revoke it or it expires.
• Integrations you direct us to use, such as publishing a link to your CMS.
• For legal reasons: to comply with law or a valid legal process, to protect the rights, safety or property of our users, us or others, or to enforce our Terms.
• In a business transfer: if Pebble Media LLC or NodeLens is involved in a merger, acquisition or sale of assets, information may transfer to the successor, subject to this policy.

5. Google user data

If you connect a Google account, NodeLens requests read-only access to Google Search Console (webmasters.readonly) and Google Analytics (analytics.readonly). We use this data only to show search and traffic data for the properties you choose inside NodeLens and to measure whether the links you add changed clicks and rankings. NodeLens cannot make changes to your Google accounts.

• Your Google refresh token is encrypted at rest. Disconnecting Google in NodeLens revokes our access at Google and deletes the token. You can also revoke access from your Google account permissions.
• We don't sell Google user data, use it for advertising, use it to determine creditworthiness, or use it to develop, improve or train generalized AI or machine-learning models.
• We don't allow humans to read Google user data unless you give us permission for specific data, it's necessary for security purposes (such as investigating abuse), it's required to comply with law, or the data is aggregated and anonymized for internal operations.
• We transfer Google user data to others only as needed to provide or improve the features you use, for security, to comply with law, or as part of a merger or acquisition.

NodeLens's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and similar technologies

The Google Ads tag loads only on the thank-you page after a signup, and never if your browser sends Global Privacy Control or Do Not Track. Learn how Google uses information from sites that use its services. You can block or delete cookies in your browser settings; the Site still works without them.

7. How long we keep information

• Waitlist entries: until NodeLens launches and for 24 months after, or until you ask us to delete them or unsubscribe from all emails.
• Account and workspace data: while your account is active. After you close your account, we delete or anonymize it within 30 days, except as below.
• Site analytics events: up to 24 months, then deleted or aggregated.
• Google tokens: until you disconnect Google or close your account.
• Billing and tax records: as long as tax and accounting law requires (generally up to 7 years).
• Backups and security logs: on a rolling schedule, typically up to 90 days.

8. Security

We use encryption in transit (TLS) and at rest, row-level access controls so each workspace can only reach its own data, encrypted storage of third-party tokens, hashed share-link tokens and passwords, rate limiting, and least-privilege access. No method of transmission or storage is completely secure. If we learn of a data breach affecting your personal information, we'll notify you and regulators as required by law. Report security issues to [email protected].

9. Your rights and choices

Wherever you live, you can ask us to:

• Access the personal information we hold about you, and get a portable copy;
• Correct inaccurate information;
• Delete your information;
• Opt out of marketing emails (use the unsubscribe link or reply "unsubscribe");
• Withdraw consent where we rely on it, without affecting earlier processing.

Email [email protected]. We'll confirm we received your request within 10 days and respond within 30 days (45 days where state law allows, with notice if we need longer). We may need to verify your identity, usually by confirming control of your email address. An authorized agent may make a request for you with your written permission. We won't discriminate against you for exercising your rights.

U.S. state privacy rights

Residents of California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia and other states with consumer privacy laws may have the rights above, plus the right to opt out of the sale of personal information, targeted advertising, and profiling. We don't sell personal information or use it for targeted advertising or profiling, and we treat a Global Privacy Control signal as a valid opt-out. If we deny your request, you can appeal by replying to our decision; if we deny your appeal, you can contact your state attorney general.

California notice at collection. In the past 12 months we have collected these categories of personal information: identifiers (such as email address and account ID); customer records (billing name and address); commercial information (plan and purchase history); internet or other electronic network activity (site and app usage); and professional information (your company or website). We collect them from you, your devices, and services you connect, for the purposes in section 3, and disclose them only to the service providers in section 4. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing information of consumers under 16. Retention periods are in section 7.

EU, UK and Swiss rights

You also have the right to object to processing based on legitimate interests, to restrict processing, and to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to address your concern first.

10. International transfers

NodeLens is based in the United States, and our service providers may process data in the U.S. and other countries. Where EU, UK or Swiss law applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework, as offered by our providers, to protect transferred data.

11. Children

NodeLens is a business tool for adults. It isn't directed to children under 16, and we don't knowingly collect their personal information. If you believe a child has given us personal information, contact us and we'll delete it.

12. Links to other sites

The Services link to sites and services we don't control. Their privacy practices are governed by their own policies.

13. Changes to this policy

We'll post any changes here and update the date at the top. If a change is material, we'll notify you by email or in the app before it takes effect.

14. Contact

Pebble Media LLC · [MAILING ADDRESS]
Privacy requests: [email protected]
Support: [email protected]