Privacy Notice
Client portal operated by Bluebird Media (“NoA Connect”). Last updated 29 May 2026.
This notice explains what personal data the NoA Connect client portal processes, why, who we share it with, and how long we keep it. It covers the portal only — your own use of the underlying advertising platforms (Google, Meta, etc.) is governed by their own terms and notices.
1. Who we are
The portal is operated by Bluebird Media on behalf of your account team. For any privacy question, or to exercise the rights below, contact your account manager or email privacy@bluebirdmedia.se.
2. What the portal is
A secure reporting dashboard that brings your marketing performance into one place, with an optional in-portal AI assistant for asking questions about your numbers. It is read-only reporting — it does not run campaigns or place advertising.
3. Personal data we process
- Account & sign-in data — your email address, your password (stored only as a salted hash by Google Firebase Authentication, never in plain text), your role, and a signed session cookie that keeps you logged in.
- Marketing performance data — largely aggregated business metrics (spend, revenue, conversions, KPIs) drawn from the advertising and analytics accounts connected for your organisation. On- site search terms are redacted to remove emails, phone numbers and personal identity codes before they reach the portal.
- Assistant interactions — the questions you type into the in-portal chat/concierge, sent to our AI provider to generate an answer.
4. Cookies
The portal uses only strictly-necessary cookies: a signed session cookie (valid up to 7 days) and a CSRF-protection token. There are no advertising or third-party analytics cookies.
5. Who we share data with (subprocessors)
We use the following processors to run the portal. Each handles data only on our instructions.
| Subprocessor | Purpose | Region |
|---|---|---|
| Google Cloud Platform — BigQuery, Firestore, Cloud Run, Cloud Logging, Secret Manager | Hosting, database, analytics storage and logging | EU (europe-west1) |
| Google Firebase Authentication | Sign-in and identity | EU / global |
| Anthropic (Claude API) | In-portal AI assistant | United States |
| Meta Platforms | Source of advertising performance data | EU / United States |
| Google Ads & Google Analytics | Source of advertising and site performance data | EU / United States |
| Airbyte | Moves performance data from the sources into our warehouse | EU / United States |
| Asana | Task data, only where the Tasks card is enabled for you | United States |
6. How long we keep data
| Data | Retention |
|---|---|
| Session cookie | Up to 7 days, then you are signed out |
| Account record (email, role) | Until your account is removed |
| Marketing performance data | For the duration of the engagement |
| In-portal assistant history | Kept so you can revisit past sessions; deleted on request |
| Server / access logs | Approximately 30 days |
| Administrative audit log | Retained for security and accountability |
7. Your rights
Subject to applicable law, you may request access to, correction of, or erasure of your personal data, and you may object to or restrict certain processing. To make a request, contact privacy@bluebirdmedia.se. You also have the right to complain to your local data-protection authority.
8. Changes to this notice
We may update this notice as the portal evolves. Material changes will be communicated through your account team.