Privacy policy

Summary of key points

• Introduction: Native values your privacy and is committed to protecting your personal information through transparent practices.
• Information we collect: We collect information to deliver and improve the Services, including account information, payment data, content you create, usage data, and information from third-party integrations you connect.
• How we use your information: We use your data to deliver, operate, and improve the Services, process payments, communicate with you, secure the platform, and meet legal obligations.
• Use of AI: We use generative AI to produce content on behalf of our customers. We do not train AI models on your data, and our AI providers are contractually prohibited from using our inputs/outputs for training.
• Legal bases: We process data based on contract, legitimate interest, consent, and legal obligations (GDPR Art. 6).
• Sharing of personal information: We share data with service providers (processors) under data processing agreements, only when necessary to deliver the Services. We do not sell personal information.
• Cookies: We use cookies based on consent for non-essential cookies, in compliance with applicable law (including the ePrivacy Directive in the EU and CCPA in California).
• Social logins: When you log in with Google or other services, we receive basic profile data you have authorized.
• Security: We implement technical and organizational safeguards in line with GDPR Art. 32 and US state law standards, including encryption, access control, and MFA.
• Minors: Native does not knowingly collect data from individuals under 18, and complies with the Children's Online Privacy Protection Act (COPPA) for users under 13.
• Your rights: You have the right to access, correct, delete, port, object, and withdraw consent. US, EU/EEA, and New Zealand users have specific additional rights described below.
• Do-Not-Track and GPC: We do not currently respond to DNT signals due to the absence of an industry standard, but we honor Global Privacy Control (GPC) signals for California residents.
• Jurisdiction-specific rights: We explicitly cover GDPR (EU/EEA), CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas), OCPA (Oregon), MCDPA (Montana), TIPA (Tennessee), and others, plus the New Zealand Privacy Act 2020.
• Assistant connector: our Model Context Protocol connector lets Claude, ChatGPT and other MCP assistants read your workspaces, brands, voice, library, products, calendar and posts, and draft and schedule content on your instruction. It uses OAuth, adds no new sub-processors, and we never read your conversations with the assistant. See Section 18.
• Updates: We notify you of material changes by email or in the Services at least 30 days before they take effect.
• Contact: hei@native.no or native.no/en/contact.

1. Data controller and roles

Data controller for information about visitors to native.no, account holders, customer contacts, and leads is: Native AS, registration no. 930 324 787, Møllergata 6, 0179 Oslo, Norway. Email: hei@native.no. Contact form: native.no/en/contact.

Data processor: For personal information that our customers upload or publish through the Services (content, comments, follower information from connected social media, etc.), the customer is the data controller, and Native acts as a data processor under our Data Processing Addendum (DPA), available upon request.

This distinction follows GDPR Art. 4(7)–(8) and Art. 28 and is reflected in the "service provider" / "processor" definitions under CCPA/CPRA and other US state laws.

2. Information we collect

2.1 Information you voluntarily provide

• Account and profile data: name, email, phone number, job title, employer, and password (stored as a hash).
• Billing data: company name, billing address, registration number, and payment information. Card data is handled by Stripe - we do not store full card numbers.
• User content: any content, feedback, comments, messages, or other information you create, edit, or publish through the Services.
• Support inquiries and other communications with us.

2.2 Information collected automatically

• Usage data: pages visited, features used, timestamps, and usage patterns.
• Technical data: IP address, device type, browser type, operating system, language settings, and technical identifiers.
• Location data: approximate geographic location based on IP address. We do not collect precise GPS location.
• Logs and security data: event logs used for operations, troubleshooting, and security.

2.3 Information from third-party sources

• Social media and connected services: when you log in with Google or connect Meta, LinkedIn, TikTok, X, Canva, Pexels, or other third parties, we receive profile information and tokens consistent with the permissions you grant.
• Analytics platforms: aggregated data from PostHog, Meta Ads, and similar tools that help us understand how the Services are used.
• Third-party data providers: we may receive supplemental information (e.g., firmographic B2B data) to verify business information.

2.4 Cookies and similar technologies

We use cookies and similar tracking technologies to improve the user experience, analyze engagement, and enable additional functionality. You can manage preferences via the cookie banner on native.no or through your browser. See Section 7.

2.5 Sensitive personal information

We do not knowingly collect special categories of personal information (GDPR Art. 9 / "sensitive personal information" under CCPA), such as ethnicity, religion, health information, biometric data, union membership, or sexual orientation. We encourage customers not to upload such content without a valid legal basis.

2.6 Information from minors

Native does not knowingly collect information from individuals under 18. See Section 11.

3. How we use your information

3.1 To deliver the Services and manage accounts

• Create and manage user accounts and subscriptions.
• Process payments and renew subscriptions.
• Provide customer support and respond to inquiries.

3.2 To operate and improve the Services

• Ensure stable operations and optimize performance.
• Implement updates, improvements, and new features based on feedback and usage data.
• Protect the platform, users, and data from threats and unauthorized access.

3.3 To produce content with AI

As described in Section 5, we use generative AI to produce text and images for our customers' social media. We process your data only for this purpose and do not share it with AI providers' training datasets.

3.4 To communicate with you

• Send important updates and notifications about the Services.
• Send marketing communications where permitted under applicable law (CAN-SPAM, GDPR Art. 6(1)(a)/(f), TCPA for SMS, etc.).
• Request feedback and insights to improve the Services.

3.5 To comply with laws and regulations

• Meet legal obligations, including bookkeeping requirements (Norwegian Bookkeeping Act § 13: 5-year retention).
• Respond to lawful requests from authorities.
• Enforce our terms and policies.
• Protect the rights, property, and safety of Native, our users, and the public.

3.6 To analyze usage and develop the Services

• Analyze aggregated/pseudonymized usage data to understand trends and user behavior.
• Conduct research and development, including testing of new features.

3.7 No automated decisions with legal effect

We do not use AI or other tools to make decisions that have legal or similarly significant effects on individuals (GDPR Art. 22). We do not engage in profiling that produces legal effects under US state privacy laws.

4. Legal basis for processing

You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal (GDPR Art. 7(3)). For US users, our processing is also justified by your purchase of, registration for, or use of the Services, and by our legitimate business interests as defined under applicable state privacy laws.

5. Use of artificial intelligence (AI)

5.1 No model training on your data

Native does not use customer data, user data, or content to train or fine-tune AI models, with the single exception of the aggregated and anonymised signals used to train Norn, described in Section 5.7. We have contractually agreed with our AI providers (OpenAI, Anthropic, Google, xAI) that content sent through the Services will not be used for training.

5.2 AI providers as processors

OpenAI, Anthropic, Google (Gemini), and xAI process content temporarily to generate responses. Processing takes place either in the EU/EEA or in the US under EU Standard Contractual Clauses (SCC 2021/914) and/or the EU–US Data Privacy Framework. See Section 12.

5.3 Transparency about AI-generated content

Under the EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) Article 50, content that is artificially generated or manipulated must be identifiable as such. Native is the provider of the Services as an AI system. We are responsible for marking synthetic output in a machine-readable format, and for disclosing that an interaction is with an AI system where our features interact directly with a person.

When you as a customer publish AI-generated content under your own editorial control on your social media channels, you act as the deployer. You are responsible for disclosure at the point of publication, in particular where the content is a deep fake or informs the public on matters of public interest (AI Act Article 50(4)). Section 5.7 of our Terms and Conditions sets out this split of responsibility in full.

5.4 No automated decisions

We do not use AI to make decisions with legal or similarly significant effect (GDPR Art. 22; US state law profiling provisions).

5.5 Your responsibility for uploaded content

As a customer, you represent and warrant that you have all necessary rights (copyright, privacy, right of publicity, name and likeness rights) to all material you upload or ask the AI to process.

You may not use the Services to create or distribute unauthorized impersonations of identifiable persons, including celebrities, public figures, or any private individual. This includes prohibited deep fakes and likeness misuse under, among others:

• New York Civil Rights Law §§ 50–51
• California Civil Code § 3344
• Tennessee ELVIS Act 2024 (Ensuring Likeness, Voice, and Image Security Act)
• Other applicable state right-of-publicity statutes

Violations may result in immediate account suspension. Report violations to hei@native.no for prompt review and removal. See also our Terms of Service and Acceptable Use Policy.

5.6 Limitations on AI training

If your data - through consent or another legal basis - has been used to train AI models by a third party, such data cannot always be extracted or removed from the model retroactively. As described in 5.1, Native has contracts that prevent such training, so this should be a hypothetical scenario for our customers.

The anonymised aggregates used to train Norn (Section 5.7) contain no personal data, so there is nothing that could be extracted or removed.

5.7 How we train Norn

Norn is Native's own prediction model. It is trained on aggregated and anonymised performance metrics for content published through the Services, on aggregated and anonymised signals about whether a suggestion was accepted, edited, or rejected, and on publicly available trend data.

Norn is not trained on your content. Your prompts, brand material, uploaded media, drafts, and the AI content generated for you are all excluded, as is anything identifying you, your staff, or any other individual.

These aggregates are anonymised before use and cannot be traced back to a customer, an account, or an individual, so they are not personal data (GDPR Recital 26). For this purpose Native acts as controller rather than processor. You can opt out at any time by writing to hei@native.no, and we will action the request within 30 days. Sections 5.13 to 5.16 of our Terms and Conditions set this out in full.

6. Sharing of personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under CCPA/CPRA and other US state laws. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

We share personal information with the following categories of recipients, always under a data processing agreement (GDPR Art. 28) where applicable:

6.1 Service providers (sub-processors / processors)

An updated list of sub-processors is available on request, and material changes are notified to customers under our DPA.

6.2 Other recipients

• Professional advisors: auditors, accountants, lawyers - subject to confidentiality.
• Government authorities: where we have a legal obligation to disclose.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred to the buyer. We will notify you before processing is transferred, and the buyer must comply with practices consistent with this Policy.
• Affiliates: if Native becomes part of a corporate group, information may be shared internally under equivalent protection.
• Anonymized/aggregated data: may be shared without restriction for analytics, research, or marketing.

6.3 Categories of personal information disclosed (CCPA/CPRA)

For California residents, in the preceding 12 months we have disclosed the following categories of personal information for business purposes to the categories of recipients listed above:

• Identifiers (name, email, IP address, account ID)
• Customer records (billing details, contact information)
• Commercial information (subscription history, transaction data)
• Internet/electronic activity (usage logs, device information)
• Geolocation data (approximate, IP-derived)
• Professional/employment information (job title, employer)
• Inferences (preferences, content engagement patterns)

We do not disclose sensitive personal information beyond what is necessary to provide the Services as requested by the user.

6.4 Social media platforms and joint controllership

When you connect accounts to Meta (Facebook/Instagram), LinkedIn, TikTok, X, or other platforms, those services process your information as independent controllers under their own terms. For certain analytics functions (e.g., Meta Page Insights), Native and the platform may be joint controllers under GDPR Art. 26. You can revoke access by disconnecting integrations in the app or by removing permission directly with the platform.

7. Cookies and tracking technologies

7.1 Types of cookies we use

• Strictly necessary cookies: required for the Services to function (login, security, page loading). No consent required.
• Functional cookies: remember preferences such as language and settings.
• Analytics cookies: measure how the Services are used (PostHog, Google Analytics).
• Marketing cookies: used for retargeting and targeted advertising (Meta Pixel, LinkedIn Insight Tag).

7.2 Consent and management

Use of non-essential cookies requires your consent in jurisdictions where this is required (EU/EEA under the ePrivacy Directive, UK PECR). For California residents, you may opt out of the sale or sharing of personal information through targeted advertising cookies via the cookie banner or by enabling Global Privacy Control (GPC) in your browser.

You can also block cookies in your browser settings, but please note that this may affect functionality.

7.3 Third-party analytics

We engage third-party services (PostHog, Meta, Google) to analyze use and provide statistical insights. These are subject to their own privacy policies.

7.4 Detailed cookie disclosure

A detailed cookie notice with the name, purpose, provider, and duration of each cookie is available via the cookie banner on native.no.

8. Social logins and platform integrations

8.1 Use of social logins

When you register or log in via Google or another third-party provider, you give us access to your email address and basic profile information consistent with your settings with that provider.

8.2 Data handling

The information is used to create and manage your Native account. We do not publish on your behalf to social media accounts without your explicit consent given through the platform's authorization flow.

8.3 Security and privacy

We maintain strict standards for data protection so that your information is handled securely and not used beyond the purposes described in this Policy.

8.4 Your control

You can manage your privacy settings directly with the social media service, and you can disconnect integrations at any time within the Native app.

9. How long we retain your information

We review retention practices regularly to ensure compliance with legal requirements and operational needs. You may request deletion of your data at any time by contacting hei@native.no.

10. Security

We implement appropriate technical and organizational safeguards under GDPR Art. 32 and applicable US state law standards, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Access control under the principle of least privilege with role-based access.
• Multi-factor authentication (MFA) for employees with access to production data.
• Logging and monitoring of access and events.
• Vulnerability management and regular security reviews.
• Incident response procedures with defined accountability.
• Data processing agreements with all sub-processors.
• Employee training in privacy and security practices.

In the event of a personal data breach, we will notify: the Norwegian Data Protection Authority within 72 hours where required (GDPR Art. 33); affected individuals without undue delay where there is a high risk (GDPR Art. 34); US state attorneys general and affected individuals in line with applicable state breach-notification laws (such as California Civil Code § 1798.82); and other regulators where required by applicable law.

Despite our safeguards, no electronic transmission or storage technology can be guaranteed 100% secure. We encourage you to use strong passwords, MFA, and to keep your login credentials confidential.

11. Minors

The Services are intended for businesses and not for individuals under 18. We do not knowingly collect information from minors and do not target this demographic in marketing.

For US users, we comply with the Children's Online Privacy Protection Act (COPPA) and do not knowingly collect data from children under 13. We also comply with applicable state laws governing minors' data, including the California "Shine the Light" law and Connecticut, Texas, and other state requirements regarding processing of minors' data.

If you discover that a minor has provided us with information, contact hei@native.no and we will delete it promptly.

12. International data transfers

Personal information is primarily stored within the EU/EEA (AWS Frankfurt and Google Cloud Europe). Some sub-processors process information in the United States or other third countries. Such transfers are made only on the basis of one of the following:

• Adequacy decision - including the EU–US Data Privacy Framework for certified US recipients (GDPR Art. 45).
• EU Standard Contractual Clauses (SCC 2021/914) supplemented by transfer impact assessments and, where necessary, technical measures (encryption, pseudonymization), under GDPR Art. 46.

For UK users, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.

For New Zealand users, transfers comply with Information Privacy Principle 12 (IPP 12) of the Privacy Act 2020, which requires that recipients are subject to comparable privacy protections or that the data subject provides explicit informed consent.

You may request a copy of the transfer safeguards by contacting hei@native.no.

13. Your privacy rights

You have the right to:

• Access the information we hold about you (GDPR Art. 15; equivalent rights under US state laws).
• Correct inaccurate information (Art. 16).
• Delete information when conditions are met (Art. 17).
• Restrict processing (Art. 18).
• Receive your data in a structured, commonly used format - data portability (Art. 20).
• Object to processing based on legitimate interest, including direct marketing (Art. 21).
• Withdraw consent at any time (Art. 7(3)).
• Lodge a complaint with a data protection authority (Art. 77).

To exercise rights, send a verifiable request to hei@native.no or via native.no/en/contact. You may use an authorized agent. We do not discriminate against users who exercise their rights.

We generally respond within 30 days for GDPR requests (Art. 12(3)) and within 45 days for US state law requests, with the option of a 45-day extension where reasonably necessary, with notice to you.

14. Do-Not-Track and Global Privacy Control

14.1 Do-Not-Track (DNT)

Most browsers offer a Do-Not-Track feature. There is no uniform industry standard for how DNT signals should be processed, and we do not currently respond to DNT signals. If a standard is adopted, we will adjust accordingly and update this Policy.

14.2 Global Privacy Control (GPC)

For California residents, we treat GPC signals as a valid request to opt out of the sale/sharing of personal information under CCPA/CPRA. We also honor GPC signals for residents of Colorado, Connecticut, and other states that recognize such universal opt-out mechanisms. Native does not "sell" or "share" personal information as those terms are defined under CCPA, so the GPC signal confirms our existing practice.

15. Jurisdiction-specific rights

15.1 United States - federal and state level

The US has no comprehensive federal privacy law. Instead, a range of state laws apply. We recognize and respect the rights of US users regardless of state, and offer the following rights to all US users by default:

• Right to know / access the categories of personal information collected, sources, purposes, and recipients.
• Right to delete personal information.
• Right to correct inaccurate information.
• Right to data portability where technically feasible.
• Right to opt out of sale, sharing, or targeted advertising.
• Right to opt out of profiling with legal or similarly significant effect.
• Right to non-discrimination when exercising rights.
• Right to limit use of sensitive personal information.

The following state laws are particularly relevant:

15.1 United States - additional provisions

Native does not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined under CCPA/CPRA. We have not sold personal information in the past 12 months and have no plans to do so.

California "Shine the Light": California residents may request, once per year and free of charge, information about disclosures of personal information to third parties for direct marketing purposes. Since we do not disclose personal information for third-party direct marketing, no such disclosures have occurred.

To exercise rights: send a verifiable request to hei@native.no or via native.no/en/contact. You do not need an account to submit a request. You may use an authorized agent (with written permission). We respond within 45 days, with the possibility of a 45-day extension if reasonably necessary, with notice to you.

Right to appeal: If we deny your request, you may appeal by replying to our response email or contacting hei@native.no. We will respond to appeals within 60 days (or as required by your state's law). If your appeal is denied, you may contact your state attorney general or applicable privacy authority.

California complaints: California residents may complain to the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General.

Right of publicity: Native prohibits any use of the Services to create or distribute unauthorized impersonations of identifiable persons. This includes rights under, among others:

• New York Civil Rights Law §§ 50–51
• California Civil Code § 3344
• Tennessee ELVIS Act 2024 (Ensuring Likeness, Voice, and Image Security Act)
• Other applicable state right-of-publicity laws

Violations may be reported to hei@native.no for prompt review and removal.

15.2 EU/EEA - including Norway, Sweden, Denmark, and other member states

GDPR applies directly. Complaints may be filed with:

• Norway: Datatilsynet (datatilsynet.no), Postboks 458 Sentrum, 0105 Oslo.
• Sweden: Integritetsskyddsmyndigheten (imy.se).
• Denmark: Datatilsynet (datatilsynet.dk).
• Other EU/EEA countries: the supervisory authority in your country of residence.

15.3 United Kingdom (UK GDPR and Data Protection Act 2018)

For UK users, UK GDPR and the Data Protection Act 2018 apply in addition to this Policy. Complaints may be filed with the Information Commissioner's Office (ico.org.uk).

15.4 Switzerland (revFADP)

For Swiss users, the revised Federal Act on Data Protection (revFADP, in effect September 1, 2023) applies. Complaints may be filed with the Federal Data Protection and Information Commissioner (FDPIC).

15.5 New Zealand (Privacy Act 2020)

For users in New Zealand, the 13 Information Privacy Principles (IPPs) apply. Personal information is transferred out of New Zealand only in accordance with IPP 12 - i.e., to recipients subject to comparable protection (such as GDPR in EU/EEA) or with the explicit informed consent of the data subject.

Our privacy contact serves as the "Privacy Officer" for New Zealand and can be reached at hei@native.no. Complaints may be filed with the Office of the Privacy Commissioner (privacy.org.nz).

15.6 Australia (Privacy Act 1988)

For Australian users, the Australian Privacy Principles (APPs) under the Privacy Act 1988 apply. Complaints may be filed with the Office of the Australian Information Commissioner (oaic.gov.au).

15.7 Canada (PIPEDA and provincial laws)

For Canadian users, the Personal Information Protection and Electronic Documents Act (PIPEDA) and relevant provincial laws (Quebec Law 25, BC PIPA, Alberta PIPA) apply. Complaints may be filed with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

15.8 Brazil (LGPD)

For Brazilian users, Lei Geral de Proteção de Dados (LGPD) applies. Complaints may be filed with the Autoridade Nacional de Proteção de Dados (ANPD).

15.9 Other jurisdictions

We strive to comply with applicable privacy laws in all countries where we operate. If you are located in a jurisdiction not explicitly listed above and wish to exercise privacy rights, contact hei@native.no, and we will process the request in accordance with applicable law.

16. Collection and use of Google user data

When you connect Google accounts to the Services, we may access and collect the following based on your explicit permissions:

• Basic profile information (name, email address, profile picture).
• Connections to social media and permissions to publish posts.
• Content you authorize us to publish on your behalf.

16.1 Limitations

We do NOT use Google user data for:

• AI model training or machine learning.
• Targeted advertising or marketing.
• Sale or transfer to third parties.
• Any purpose beyond providing our core social media services.

16.2 Permitted uses

We use Google user data exclusively to:

• Authenticate your account and maintain secure access.
• Publish content to your connected social media accounts.
• Deliver analytics related to your social media performance.
• Provide the specific features you have requested.

16.3 Compliance with Google API Services User Data Policy

The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

17. Collection and use of Canva user data

When you connect your Canva account to the Services, we collect and process Canva user data to enable design import.

17.1 Data we collect from Canva

• Basic profile information (name, email address).
• Design files you choose to import.
• Design metadata (titles, creation dates).
• Folder structures that help you find and select designs.

17.2 How we use Canva user data

We use Canva user data exclusively to:

• Authenticate and maintain your connection to Canva.
• Display your Canva designs for selection and import.
• Store imported designs in your content library.
• Enable scheduling and publishing of imported designs to your connected social media platforms.

We do NOT use Canva user data for AI model training or machine learning; advertising, ad targeting, or marketing; sale or transfer to third parties; or any purpose beyond those described in this Policy.

17.3 Retention of Canva user data

• Imported designs: stored in your content library until you delete them or close your account.
• Connection data: retained as long as your Canva account is connected to the Services.
• On disconnection: Canva authentication data is deleted within 30 days.
• On account closure: all Canva user data is deleted within 30 days.

17.4 Data breach notification

In the event of a data breach that may affect Canva user data, we will:

• Notify Canva via email at legal@canva.com within 48 hours of discovery.
• Notify affected users in accordance with applicable privacy laws.
• Take immediate steps to contain and remediate the breach.

17.5 Security measures

Canva user data is protected by encryption in transit and at rest, access controls, regular security reviews, and secure deletion procedures.

17.6 Your rights

You can disconnect your Canva connection at any time in account settings, request a copy of the Canva user data we hold about you, or request deletion. Contact hei@native.no.

18. AI assistant connector (Model Context Protocol)

Native publishes a connector built on the Model Context Protocol (MCP) that lets you work with your Native account from inside an AI assistant. It works with Anthropic's Claude and with OpenAI's ChatGPT, and with any other assistant that adopts the standard. References to the assistant below mean whichever one you have connected. This section describes that integration specifically. The rest of this Policy applies to it as well.

18.1 What the connector can access

Once you have connected an assistant to Native, the connector can read the following on your behalf:

• Your Native profile: name, email address, profile picture, language, and the date the account was created.
• The workspaces you belong to and the brands you can reach within them, including your role and the plan the workspace is on.
• Brand voice settings: archetype, tone of voice, brand context, and voice fingerprint.
• Images in your brand library, together with their metadata such as filenames, descriptions, labels, categories, and the names of any people tagged in them.
• Products attached to a brand, including descriptions, prices, and product images.
• Your publishing calendar.
• Your posts - drafts, scheduled, and published - including captions, attached media, target platforms, and status.

The connector reaches only the workspaces and brands your own Native account already reaches. Your access is checked on every request, not once when you connect, and the same permission rules apply as in the Native app.

18.2 How you authorize it

• Authorization uses OAuth 2.0 (authorization code flow with PKCE) through Native's identity provider at auth.native.no. You sign in with the Native account you already have and approve an authorization screen.
• Native never sees or stores your credentials for the assistant, and the assistant never receives your Native password.
• No API keys are involved. You are never asked to create, paste, or store a key or a secret, and no application is registered in your name.
• The connector receives two scopes: read access to the data listed in Section 18.1, and write access limited to the content actions listed in Section 18.3.

18.3 How this data is used and stored

Data is served from Native's existing systems to your own assistant session when you ask for it. The connector creates no new data stores and keeps no separate copy of your content.

• Actions you take through the assistant - creating or editing a draft, generating a caption or an image, attaching a library image, scheduling or unscheduling a post - are stored in your Native account exactly as if you had taken them in the Native app, and are covered by the rest of this Policy.
• The assistant asks for your approval before it runs a tool that changes something. Where an assistant supports it, the connector adds a confirmation step of its own; neither Claude nor ChatGPT currently supports that step, so the approval you see is the assistant's own.
• We do not read or store the content of your conversations with the assistant. Native receives only the individual tool requests the assistant sends on your instruction, and returns the answers to them.
• The connector cannot recall or edit a post that has already gone out to your social channels, and it cannot change billing, subscriptions, or team membership, or delete your account.
• In Claude, your calendar and post previews are rendered as interactive cards. Those cards are served by Native and load your brand images from Native's storage into your Claude session. Assistants that do not render those cards, ChatGPT among them, receive the same information as ordinary text and images.

We keep an operational log of connector activity for security and troubleshooting. Each entry records the time, the name of the action, whether it succeeded, how long it took, and an error code if one occurred. Your user identifier and the client identifier are stored as keyed hashes rather than in readable form, and the contents of requests and responses are not written to these logs. Retention follows the “Logs and security data” row in Section 9.

18.4 Sharing with third parties

• Your assistant's provider, Anthropic for Claude and OpenAI for ChatGPT: Native has no separate data-sharing arrangement with either of them and does not transmit your data to them on its own initiative. The connector works by returning tool results to the assistant you have connected, and those results become part of your conversation with it, so they are processed by that provider under the provider's own terms and privacy policy. When you use the connector from claude.ai or from ChatGPT on the web, the request to Native is made by that provider's infrastructure on your behalf rather than from your own device. Neither provider is a Native sub-processor for this purpose, and your use of the assistant is governed by your agreement with that provider. For both, this role is separate from their role as AI providers to Native under Sections 5.2 and 6.1.
• The connector introduces no new sub-processors. It shares data with the same recipients listed in Section 6.1, and only where the equivalent action in the Native app would share it.
• Hosting: the connector runs on Google Cloud in the EU/EEA.
• AI generation: if you ask the assistant to have Native write a caption or generate an image, the request runs through Native's ordinary AI pipeline and the providers named in Sections 5.2 and 6.1. As stated in Section 5.1, none of it is used to train models.
• Publishing: a post you schedule through the connector is published through the same publishing partner listed in Section 6.1 when its time comes, exactly as a post scheduled in the app would be.

18.5 How long we keep it

• Data reached through the connector is kept for as long as it is kept in your Native account under Section 9. The connector adds no retention of its own.
• You can disconnect at any time by removing the connector in your assistant's settings. The authorization is withdrawn straight away, so no further access can be issued, and any access token the assistant still holds stops working within the hour.
• Deleting your Native account removes the underlying data as described in Sections 9 and 21.

18.6 Questions about the connector

Privacy questions about the connector go to hei@native.no, the same address as for the rest of this Policy (Section 20). Setup instructions and a full description of what the connector can and cannot do are published at native.no/claude-connector and native.no/chatgpt-connector.

19. Updates to this Policy

We may update this Privacy Policy as needed. The updated version will be marked with a new "Last updated" date and takes effect when published.

Material changes will be communicated by email or in the Services at least 30 days before they take effect. Earlier versions are available upon request to hei@native.no.

20. How to contact us

For questions or requests regarding this Policy, contact our privacy contact:

Native AS, registration no. 930 324 787, Møllergata 6, 0179 Oslo, Norway. Email: hei@native.no. Contact form: native.no/en/contact.

For US users, privacy rights requests may also be submitted via native.no/en/contact.

21. How to review, update, or delete your data

• Review: Log into Native and open account settings, or contact hei@native.no for a full data export.
• Update: Update profile information directly in Native, or contact us for assistance.
• Delete: Request account deletion by contacting hei@native.no. We will delete the data within 30 days, except for data we are required to retain under bookkeeping or other applicable laws (see Section 9).