North Shore Portal and NSL Ads API Privacy Policy

1 Who we are and what this policy covers

North Shore Labs LLC, an Illinois limited liability company (“North Shore Labs,” “we,” “us,” or “our”), provides North Shore Portal at portal.northshorelabs.dev and the connected Google application identified as NSL Ads API. This policy explains how we handle personal information when people use those services, authorize integrations, communicate with our team, or interact with related customer-support and business-management features.

Our services help businesses manage their online presence, review performance, handle customer inquiries, and work with North Shore Labs. Features vary by workspace and service agreement. A description of an optional feature below does not mean it is enabled for every customer or that connecting one service authorizes access to every other service.

This policy does not automatically govern every website or application we build for a client. A client's website, advertising, customer communications, and collection of information are subject to that client's privacy notice. Other North Shore Labs products are covered only if they expressly link to this policy as their governing notice.

Contact us about privacy at hello@northshorelabs.dev, with “Privacy request” in the subject. For NSL Ads API support, you may also contact nslabs.dev@gmail.com, the support address shown on the Google consent screen.

2 Our role and your business workspace

We decide how to use information needed to operate our own accounts, manage our relationship with customers, secure the services, and respond to requests. For those activities, we are the organization responsible for the information, sometimes called a controller or business.

When a business supplies customer inquiries, contact lists, call records, or connected-account information for us to process on its behalf, that business generally determines the purpose of the processing. We handle that information under its instructions and our service arrangements, acting as a processor or service provider where applicable. This notice does not replace any required data-processing agreement.

Your workspace administrators and authorized teammates may access information you place in the workspace and manage your membership. Authorized North Shore Labs personnel may access workspace information to deliver the agreed services, investigate problems, and support you. Google information subject to stricter access restrictions is also governed by section 5.

If you are a customer's employee, website visitor, caller, or contact, you can ask that business about its instructions and privacy practices. You may also contact us; we will identify whether we can handle your request directly or need to assist the business responsible for it.

3 Information we collect and where it comes from

Account and identity information. You, your employer, an inviting administrator, or an identity provider may provide your name, email address, profile image, organization, role, language preference, and optional phone number. We maintain account identifiers, membership records, authentication information, and consent or preference records. Password-based accounts use password hashes rather than storing the password itself as readable account data.

Workspace content and communications. We process messages, support requests, website-change instructions, annotations, uploaded files, images, site content, and AI conversations. Customer-facing features may also process contact names, email addresses, phone numbers, inquiry text, review content, draft responses, and the history of actions taken on those records. This information comes from users, workspace administrators, customer websites, inbound communications, and authorized integrations.

Connected-service information. We receive information that an account holder or administrator authorizes a service to make available. This can include account and property identifiers, website and search performance, advertising and conversion records, business listings, reviews, and related configuration. Section 4 explains the Google integrations in more detail.

Call information when call features are enabled. We may receive caller and business phone numbers, names when supplied, call time and duration, routing and outcome information, recordings, transcripts, speaker segments, tags, referring pages, and advertising click identifiers. Recording and transcription depend on the customer's configuration and the notices and permissions required for that call.

Technical and activity information. Our services and infrastructure process IP addresses, browser and device information, request and error details, login and security events, feature usage, performance measurements, and activity records. Email and messaging providers may report delivery, failures, and engagement events. Review-request links can record clicks. These records help us deliver messages, diagnose failures, and understand whether requested work has been completed.

Do not put passwords, government identifiers, payment-card details, or unrelated sensitive information in a chat, inquiry, or attachment. These services are not designed to collect those items through ordinary message or upload fields. If you include them, they can become part of the content processed for that feature.

4 Google connections and NSL Ads API

Signing in is separate from connecting business accounts. Where Google sign-in is offered, we request basic identity information: your Google account identifier, name, email address, profile image URL, and whether the email is verified. This sign-in flow does not by itself give us access to your Gmail, Drive, advertising account, or other business services. Apple sign-in likewise supplies identity information permitted by that sign-in service, which may include a relay email address.

Analytics and search performance. With the necessary account permissions, we retrieve reports such as traffic, referrals, visited pages, search queries, impressions, clicks, and sitemap status. We use them to populate your workspace, prepare reports, assess website performance, and carry out authorized website or search-visibility work.

Advertising and attribution. Authorized advertising tools can process account, campaign, ad, keyword, budget, spend, performance, and conversion information to report on or manage the customer's advertising. Changes require authorization through the relevant service relationship or workflow. Where call attribution is enabled, the call service sends Google an advertising click identifier, event time, source, and transaction identifier to associate a call with an ad. That specific conversion payload does not include the caller's name, phone number, recording, or transcript. Click and transaction identifiers can still relate to individuals; we do not treat them as inherently anonymous.

Keyword planning when available. A keyword-planning feature uses submitted seed keywords, website addresses, and targeting choices to request keyword suggestions, search-volume estimates, competition measures, and forecasts. Its purpose is to research and plan advertising for the business requesting the work. Access to a planning feature depends on Google's approval and the feature being enabled in our service.

Business profiles and website configuration. Where authorized, we access business-location details, profile content, photos, reviews, and replies. Operational tools can also manage website-verification records, sitemaps, analytics properties, tag configurations, and account permissions to complete agreed setup or maintenance. A reporting-only connection does not authorize unrelated changes.

Connections may use your OAuth authorization or an account administrator's grant to a service account. These are different forms of permission. The information accessible to us depends on the connection, account role, and permissions actually granted. We use connection credentials to communicate with the provider and store reports or records needed for the service. We do not receive your Google password through OAuth.

5 Additional commitments for Google information

Our use of information received from Google APIs, including transfers to another application, adheres to the Google API Services User Data Policy and applicable Limited Use requirements. Those restrictions take priority over broader language elsewhere in this notice.

For data subject to Limited Use, we use it to provide or improve appropriate features visible and prominent in the requesting application. Transfers are confined to permitted service delivery with consent, security, legal obligations, or a business transfer with explicit prior consent. Human access requires affirmative permission for the particular data, a permitted security or legal need, or a permitted internal use of aggregated data, anonymized where the applicable Google policy requires. Restrictions continue to apply to derived information.

We do not sell Google user data or repurpose restricted Google information for advertising audiences, data brokerage, surveillance, or credit decisions. Authorization to manage advertising or measure conversions does not permit use of information subject to Google's Limited Use restrictions for prohibited advertising purposes.

We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI or machine-learning models. We do not permit AI providers to use such data for those purposes. Any permitted AI processing remains subject to the restrictions above and the disclosures in section 7.

6 Why we use information

We use personal information to establish accounts, maintain sign-in, administer workspaces, provide requested features, answer questions, complete authorized work, and communicate about the service. For example, an inquiry and the business's context can be used to draft a response, while connected traffic reports can help explain a change in website performance.

We also use relevant information to investigate abuse, prevent unauthorized access, diagnose errors, measure service reliability, keep appropriate business records, comply with legal obligations, and resolve disputes. We limit these uses to information reasonably needed for the purpose. Information handled for a client remains subject to that client's instructions and applicable service-provider restrictions.

If we send promotional messages about our own services, we use the required permission or other lawful basis and provide a way to opt out. Service notices, security alerts, and responses you request are handled separately from promotional communications.

7 AI features and automated assistance

AI features can process the prompt or conversation you submit, selected attachments or website content, customer-inquiry details, and workspace information retrieved to answer the request. This can include Google-derived analytics. For example, drafting a reply may send the customer's name, email address, inquiry, and relevant business context to the AI service.

Portal AI requests are routed through Vercel AI Gateway to a configured model provider. The provider depends on the workspace and feature; supported configurations include providers such as OpenAI, Anthropic, Google, Moonshot AI, and Z.ai. Call transcription can use Cloudflare Workers AI. Supporting a provider does not mean every request is sent to every provider. You may contact us for information about the provider used for your workspace.

AI providers receive the content needed to process the request and return a result. Conversations and generated results may be stored in the workspace, and operational records may be retained for usage, troubleshooting, or security. Retention by a provider depends on the applicable service configuration and contract; this policy does not promise that every provider has zero retention.

We do not use private workspace content to train generalized AI models, and we do not permit our AI processors to use it for that purpose. The additional Google restrictions in section 5 apply wherever covered Google data is processed.

AI output can be incorrect. AI assistance is used for service-related analysis and drafting; it does not replace the user's or business's judgment. We do not use these portal features to make solely automated decisions that determine an individual's employment, credit, housing, insurance, or other similarly significant eligibility.

User-connected AI assistants. Separately, you can authorize an external assistant, such as ChatGPT, Claude, or Cursor, to access selected business records through an approved connection. Information it retrieves is sent to the company operating that assistant and handled under its own terms, privacy policy, and your settings. Those user-selected services are distinct from the AI processors we engage to run portal features. Disconnecting stops future access but does not erase copies already held by the assistant provider. See our AI assistant connections notice for the data, permissions, and controls available.

8 When we disclose information

Within the authorized workspace and service team. We disclose information to authorized members of the business workspace and North Shore Labs personnel who need it for the agreed work, subject to applicable access restrictions.

To providers supporting the service. Depending on enabled features, providers support hosting, databases, file storage, network security, AI processing, email, SMS, calling, monitoring, and connected-account functionality. Examples include Vercel, Cloudflare, Resend, Twilio, configured AI providers, and Google. We provide information relevant to the service they perform and require appropriate protections through our arrangements with them. Some connected platforms also act under their own policies for their own services.

At your direction. A message you send, reply you approve, change you authorize, or item you publish is disclosed to its intended destination. Public website content, business-profile updates, and published review replies can be visible to others. Recipients can keep their own copies.

File links. Access depends on the storage and sharing method. Some configurations serve uploaded files through a direct public URL; possession of that URL may permit access without signing in. Other configurations enforce workspace authentication. A hard-to-guess URL is not the same as authenticated access. Contact us before uploading information that requires restricted handling.

Legal, security, and business events. We may disclose information when required by law, to respond to valid legal process, or as reasonably necessary to address fraud, security incidents, or legal claims. A reorganization or business transfer may involve relevant records, subject to applicable restrictions and required notice or consent. Google's stricter transfer conditions remain controlling for covered data.

We do not sell private workspace content to data brokers. Advertising measurement performed for a client can have different legal consequences from ordinary service-provider processing, including treatment as “sharing” under some privacy laws. Rights and responsibilities depend on the actual data flow, purposes, contractual roles, and applicable law. The responsible business must explain those practices and provide any required choices.

9 Cookies and similar technologies

The portal uses cookies and similar storage for sign-in, security, and preferences. The current session cookie can last up to 30 days, OAuth security-state cookies up to 10 minutes, and language preferences may persist across visits. Signing out or clearing browser data can remove local cookies; clearing a cookie does not delete server records.

Performance and error-monitoring services may process device, request, and usage information. Connected reporting about a client's website is distinct from tracking the person using the portal. Links to external services, and client websites themselves, may use their own tracking technologies and notices.

You can manage browser storage through your browser settings. Blocking essential cookies may prevent sign-in or other features from working. The portal does not currently use the legacy Do Not Track browser setting to change its operation. That setting is different from Global Privacy Control and other legally recognized opt-out signals. Where applicable law requires us to honor an opt-out signal for processing we control, we will do so; a signal does not prevent essential security or requested service operations.

10 Calls and messaging

When a business enables call recording or transcription, the call flow must provide the required notice and obtain any legally required consent. This policy alone does not obtain recording consent. Calls may be processed by telephony, storage, and transcription providers and made available to the business and authorized service personnel.

For text messages we send, you can reply STOP to opt out where supported. We may retain the minimum information needed to maintain that suppression. Promotional email includes an unsubscribe method. You can also contact us to update communication choices. Operational messages may continue where needed to provide the service, address security, or satisfy legal requirements, using a permitted channel.

11 How long we keep information

We determine retention by the information's purpose, whether an account or engagement is active, the customer's instructions, reasonable operational needs, and legal requirements. Account and workspace information may be needed during the relationship; support, transaction, and security records may need to remain afterward for a specific legitimate purpose. Call audio, transcripts, reports, and attachments require their own retention decisions rather than automatically inheriting the lifetime of the account.

When information is no longer needed for a permitted purpose, our policy is to delete it or de-identify it where appropriate and permitted. A legal obligation, dispute, or security investigation can require a limited hold. Backups and service-provider records may follow separate expiry cycles; they are not necessarily erased immediately when an active record is deleted. We restrict retained information to the reason it must be kept.

Contact us to ask about a particular category, request deletion, or agree a customer-specific retention arrangement. Deletion requests are handled through our privacy contact; disconnecting an account is not a deletion request.

12 Security

We use safeguards appropriate to the information and service, including HTTPS for supported service connections, password hashing, access controls, and activity records. The portal encrypts stored integration credentials. These measures do not mean that every file, record, or deployment has the same access or encryption configuration; the file-link disclosure in section 8 is especially relevant to attachments.

No service can guarantee absolute security. Please use a strong password, protect your devices, and notify us if you believe an account or file has been exposed. Do not send passwords, access tokens, or identity documents in an ordinary privacy-request email. If an incident requires notice, we will provide the notice required by applicable law and our agreements.

13 Your choices and privacy requests

You can ask us to explain our handling of your information, provide access or a copy, correct inaccurate information, or delete information, subject to applicable law and our role. Depending on your location, you may also have rights to portability, restrict processing, object, opt out of certain disclosures or uses, withdraw consent, or appeal a denied request.

You can decline an optional integration or avoid an AI feature. Without required account information, we may be unable to establish or secure your account; without the relevant service permission, the connected feature will not work. These choices do not authorize us to collect substitute data from an unrelated source.

Email hello@northshorelabs.dev with the request, the email associated with the account, and enough context to locate the relevant records. We may need proportionate information to verify identity, workspace authority, or an authorized agent's permission. We will explain if we cannot fulfill a request, any applicable exception, and available appeal options. We will respond within the period required by applicable law and will not penalize you for exercising protected rights.

Google access and deletion are separate. You can revoke OAuth access in your Google Account connections. For service-account access, remove the relevant account or property permission in the Google service, or ask your administrator. Revoking access can stop future retrieval, but does not by itself erase previously collected workspace records. Likewise, disconnecting a sign-in provider does not close your portal account. Send a separate deletion request if that is what you want.

Deleting service data does not necessarily remove copies held by the originating business, a message recipient, or another platform. We will explain the relevant limits and assist the responsible customer where required.

14 Additional rights where local law applies

California and other US states. Where an applicable state privacy law covers our processing, rights may include access, correction, deletion, portability, and opting out of sale, sharing, targeted advertising, or certain profiling. California residents may also have rights concerning sensitive personal information. The categories, sources, purposes, and recipients described above explain the service's processing. Applicable exceptions and our role can affect how a request is fulfilled.

EEA and United Kingdom. Where those laws apply, we rely on the appropriate basis for the particular activity: performing a contract with you, legitimate interests in providing and securing business services, a legal obligation, or consent where required. We weigh legitimate interests against individual rights. You may object to processing based on legitimate interests and to direct marketing. Withdrawing consent does not invalidate processing already lawfully performed. You may complain to your local supervisory authority; UK residents can contact the Information Commissioner's Office.

15 International processing

North Shore Labs is based in the United States. Providers and authorized service personnel may process information in other countries depending on the feature and provider. Applicable privacy protections may differ by location. Where a transfer requires a legal safeguard, we must establish the appropriate mechanism before making that transfer. Contact us for information about the arrangements applicable to your service.

16 Children

The portal and NSL Ads API are business services intended for adults, not services directed to children under 13. We do not knowingly collect personal information from children under 13 through their own use of these services. If you believe a child has provided information, contact us so we can investigate and take appropriate action. A business using our services remains responsible for lawful handling of information it supplies about its own customers.

17 Changes to this policy

We will publish changes on this page and update the effective date. For material changes, we will provide additional notice where appropriate or required, such as in the portal or by email. We will obtain consent when required before using previously collected information for a new purpose. Continued use alone will not be treated as consent where affirmative consent is required.

18 Contact

North Shore Labs LLC
Privacy requests: hello@northshorelabs.dev
NSL Ads API support: nslabs.dev@gmail.com
Service: https://portal.northshorelabs.dev/

If you need this notice in another accessible format, contact us at the privacy address above.