Nudge MCP data processing agreement
Last updated: 14 October 2026
This agreement is between your agency (the controller) and Kyrix Ltd (the processor). It forms part of the Nudge MCP service terms and applies when Nudge processes personal data for you under UK GDPR and the Data Protection Act 2018.
1. What we process
| Purpose | Providing Nudge: reading connected advertising accounts, recommending changes, making approved changes, keeping a change record |
|---|---|
| Data | Advertising account data, which can include names and emails of account users, search terms, and conversion data |
| People | Your staff and your clients' staff who use the accounts; your clients' customers, where account data identifies them |
| Duration | While you use Nudge, plus up to 30 days to delete data after the service ends |
2. Our commitments
We will:
- Process personal data only on your documented instructions. These terms and your use of Nudge are your instructions.
- Make sure everyone who handles the data is bound by confidentiality.
- Keep the data secure, including encryption in transit and at rest, access limited by role, and each customer's data kept separate.
- Use only the sub-processors listed below, tell you before adding or replacing one, and let you object.
- Help you respond to requests from people exercising their data rights.
- Help you meet your security, breach and impact-assessment duties.
- Tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
- Delete your personal data when the service ends, unless the law requires us to keep it.
- Give you the information needed to show we meet this agreement, and allow reasonable audits on 30 days' notice.
3. Anonymised and aggregated data
You instruct and authorise us to aggregate account performance data, so that no person, client, account or campaign can be identified, and to use the result only to improve Nudge's own features. We remove personal data before aggregating. Aggregated data in this form may be kept after this agreement ends. We never sell or share it. This does not apply to data received through the Amazon Ads API.
4. Sub-processors
| Sub-processor | What it does |
|---|---|
| Vercel | Runs the Nudge server |
| Supabase | Stores account data, change records and access tokens |
| Google Workspace | Email with you |
| OpenAI | Language models for Nudge's AI search visibility and content features. Not used for Google Ads data |
| Google (Gemini) | Language models for Nudge's AI search visibility and content features. Not used for Google Ads data |
5. International transfers
If personal data leaves the UK, we protect it with safeguards recognised under UK law, such as the UK-US data bridge or the UK International Data Transfer Addendum.
6. Contact
Questions about this agreement: admin@nudgeai.uk.