How Noddi handles your data

Last updated 31 October 2026. Controller: Bennota Consulting Limited (company number 17470467, registered office Unit 8 Gunnels Wood Road, Stevenage, SG1 2BH, United Kingdom), contact privacy@bennota.com.

What Noddi does

Noddi turns photos and notes you send on WhatsApp into social media posts that you approve before anything is published. To do that it connects to your Instagram professional account and, optionally, your Facebook Pages, LinkedIn profile and TikTok account through the official Meta, LinkedIn and TikTok APIs. Optionally, Noddi also connects to your Google Ads account so its assistants can report on your Search campaigns and propose changes that you approve before anything is applied.

Data we collect

Account identity from Meta: your Instagram or Facebook user id, username, Page names and ids and profile pictures. Used to show which account a post will go to and to publish on your behalf.
Access tokens issued by Meta or LinkedIn. Stored encrypted (AES, key held outside the database) and used only to publish the posts you approve and to read publishing limits and post links.
WhatsApp messages you send to the Noddi number: text, photos and voice notes, plus your phone number and display name. Voice notes are transcribed and the audio is deleted immediately afterwards.
Posts: every draft, revision, approval, publication result and link, kept as the audit trail of what was approved and by whom.
Operational logs (timestamps, errors) with no message content or tokens.

Google user data (Google Ads connection)

If you choose Connect Google Ads, Noddi asks Google for the following permissions. We request only what the features below need; Google offers no narrower permission for reading reports or editing campaigns through the Google Ads API.

Your Google account identity (openid, email): your Google account id and email address. Used only to show you which Google account is connected and to let you disconnect it. We do not use it for marketing.
Manage your Google Ads campaigns (https://www.googleapis.com/auth/adwords): the list of Google Ads accounts you can access (ids and names), and for the accounts you tick: campaigns, ad groups, keywords, search terms, budgets and performance metrics (impressions, clicks, cost, conversions). Used to (a) show the Google Ads dashboard and weekly summary in Noddi, and (b) create new Search campaigns in a paused state, edit budgets, add negative keywords and pause keywords. Campaign creation and budget changes are applied only after you approve each change in Noddi and within the daily spend cap you set. If you switch an account to Auto-safe mode, Noddi may also apply negative keywords and keyword pauses that pass its safety checks without a separate approval; anything that can increase spend always waits for you.
OAuth tokens issued by Google (access and refresh token). Stored encrypted (see below) and used only for the two purposes above.

Limited Use disclosure. Noddi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not sell Google user data, we do not use it for advertising or for building user profiles, we do not let humans read it except with your permission, for security purposes, to comply with the law or when the data is aggregated and anonymised for internal operations, and we do not transfer it to third parties except as described under Processors.

AI/ML disclosure. Noddi does not use Google user data, or any of your data, to develop, improve or train generalised artificial intelligence or machine learning models. Campaign metrics, keyword ideas and your business brief are sent to Anthropic's Claude API only to generate the specific report or proposal you asked for, under Anthropic's commercial terms which prohibit training on that data.

Withdrawing access. Click Disconnect on the Google Ads page in Noddi (we delete the token from our database and revoke it at Google unless another connected account still uses the same Google login), or remove Noddi at myaccount.google.com/permissions. If you revoke access at Google, Noddi stops using the account immediately and deletes its remaining data when you disconnect it in Noddi or ask us to.

How we protect your data

Access tokens, Google Ads data, message content and account identifiers are treated as sensitive data and protected by the following mechanisms:

Encryption in transit: every connection to Noddi, and from Noddi to Google, Meta, LinkedIn, TikTok and Anthropic, uses HTTPS (TLS 1.2 or later). The dashboard sends HTTP Strict Transport Security so browsers never fall back to plain HTTP.
Encryption at rest: OAuth access and refresh tokens are encrypted before they are written to the database with authenticated symmetric encryption (Fernet: AES-128-CBC with HMAC-SHA256). The encryption key is held in the server's environment, outside the database, so a copy of the database alone cannot reveal any token.
Access control: the dashboard requires a login and is operated only by Bennota Consulting Limited staff; each workspace's accounts, posts and Google Ads data are stored and queried separately. Session cookies are HttpOnly, Secure and SameSite, and the Google Ads forms carry an anti-CSRF token. OAuth flows use a signed state parameter, and the Google flow also uses PKCE, to prevent token interception.
Least privilege: tokens are used only for the purposes listed above; nothing is applied to your Google Ads account without your explicit approval, a server-side spend-cap check and a validate-only dry run first. Only named staff of Bennota Consulting Limited can reach production systems, over key-based SSH, and they never see decrypted tokens.
Logging and monitoring: operational logs contain timestamps, account identifiers and error codes, never tokens, message content or campaign performance data. Every change proposed or applied to Google Ads is recorded in an audit trail you can read on the Google Ads page.
Deletion: when you disconnect an account the token is revoked at the provider and deleted immediately; disconnecting a Google Ads account also deletes every cached metric and proposal for that account; on request we delete a whole workspace within 30 days.
Incident response: if we become aware of a breach affecting your data we will notify you and, where required, the Information Commissioner's Office within 72 hours.

What we never do

Publish anything you have not explicitly approved.
Read your Instagram or Facebook inbox, followers or other people's data.
Create campaigns or raise budgets in your Google Ads account without your approval in Noddi.
Sell or share your data with advertisers or data brokers.
Use your content to train AI models.

Processors

Drafts and Google Ads proposals are written with Anthropic's Claude API (text, the photo you sent, and for Google Ads the campaign metrics and keyword ideas, under their commercial data terms, no training on your data). Publishing goes through Meta Platforms (Instagram and Facebook Graph API), LinkedIn and TikTok; campaign reporting and changes go through the Google Ads API (Google LLC). Hosting is on servers in the United Kingdom / European Union. Where a processor is outside the UK, transfers rely on the UK Addendum to the EU Standard Contractual Clauses or a UK adequacy decision.

Retention

Photos are kept until published plus 30 days, then removed. Posts and the approval trail are kept for as long as your workspace exists. Cached Google Ads metrics and proposals are kept while the account is connected and deleted when you disconnect it. Tokens are deleted the moment you disconnect an account in Noddi or ask us to; removing Noddi in your Google or Meta settings stops all use immediately.

Your rights

Under UK GDPR you can ask for access, correction, deletion, restriction or a copy of your data at privacy@bennota.com. To delete the data Noddi holds from Meta, see data deletion. You can complain to the Information Commissioner's Office (ico.org.uk).

Cookies

The dashboard uses one strictly necessary session cookie and one to remember the selected workspace. No analytics or advertising cookies.

Bennota Consulting Limited, registered in England and Wales, company number 17470467. Registered office: Unit 8 Gunnels Wood Road, Stevenage, SG1 2BH, United Kingdom.