Cookie & Data-Processing Notice

Scope of This Notice

Newel has two parts and they behave differently:

• The public website (this marketing site, including the home, pricing, and legal pages). It sets no cookies at all and uses only a few small browser-storage preferences described in section 4. If, and only if, you choose Accept on the cookie notice, PostHog analytics (section 7) also runs; it sets no cookies but stores a random visitor ID in local storage. If you do not choose Accept, choose Decline, or send Global Privacy Control or Do Not Track, it does not run.
• The application (the Newel workspace you sign in to). It sets one strictly necessary sign-in cookie and uses browser storage to run your workspace, as described in sections 3 and 5. If you choose Accept on the cookie notice, PostHog analytics and session replay also run in the application with every piece of text, every input and every attribute masked, so your clients' and leads' data is never captured; if you do not choose Accept, nothing runs.

Everything in Part One is either first-party or, where noted and only with your Accept, a pseudonymous analytics provider (PostHog). Nothing here profiles you across other websites for advertising, and we never sell your data.

What "Cookies and Storage" Means

A cookie is a small piece of text a website asks your browser to keep and send back on future visits. localStorage and sessionStorage are related browser features that keep data on your device only, unlike cookies, they are never automatically sent over the network. A service-worker cache stores copies of the app's own files so it can open quickly and work offline. Newel uses all three, for function only.

Cookies We Set

Newel sets exactly one cookie, and only after you sign in to the application:

That is the complete list of cookies we set ourselves. We set no advertising or social-media cookies anywhere. Our analytics provider (PostHog, section 7) sets no cookies, but if you choose Accept it does store a random visitor ID in your browser's local storage (key newel_vid) and its own local-storage entries.

Storage on the Public Website

The marketing site keeps a few preferences in your browser's localStorage so it doesn't nag you twice. These never leave your device:

Storage Inside the Application

The Newel workspace is built to keep as much as possible on your own device. When you use the app, your browser's localStorage holds your working data and preferences. None of this is advertising, it is your workspace. By category:

localStorage and sessionStorage are never sent automatically to us or anyone else, the app reads them locally and only transmits data to our own server when a feature you use requires it (for example, saving your CRM to your cloud account).

Offline Cache (Installable App)

Newel can be installed to your device as an app. To make that work, a service worker keeps cached copies of the app's own files (the page shell, icons, and assets) in your browser's cache storage. This cache contains application code, not your personal data. Sign-in requests and your CRM data are explicitly never cached. Uninstalling the app or clearing site data removes the cache completely.

Third Parties That May Run in Your Browser

A small number of outside services can load in your browser while you use Newel. When any third-party resource loads, that provider necessarily receives your IP address and basic request details, and may set cookies on its own domain under its own policy. We chose each one deliberately, for function or, in the case of analytics, kept cookieless and anonymous:

Services That Never Run in Your Browser

Newel's backend uses several processors that operate server-to-server only. They set no cookies and run no code on your device; they are listed here for completeness because they handle data for features you use:

• Netlify, hosts the website and application.
• Supabase, our database, where cloud-account data is stored with row-level security.
• Anthropic, powers AI features (captions, descriptions, assistant). Content you submit to an AI feature is processed to generate the response.
• MuAPI (Seedance models), powers AI image and walkthrough-video generation.
• Resend, delivers transactional and campaign email you send through Newel.
• Stripe, billing records and subscription state (in addition to its hosted checkout above).

Details on what each processor receives and your rights over that data are in the Privacy Policy and Part Two of this notice.

No Advertising; Analytics Only With Consent

• No advertising cookies, pixels, or tags, first- or third-party.
• No cross-site behavioral tracking and no fingerprinting for advertising.
• We do not sell or share your personal information for advertising purposes.
• In the signed-in application, analytics and session replay mask every piece of text, every input and every attribute, so your clients' and leads' data never leaves the page.

On our website and in the application (text masked in the application), we use PostHog for analytics (section 7) so we can understand how the pages perform, but only after you choose Accept. It stores a random visitor ID in your browser's local storage and builds a pseudonymous per-visitor profile so we can follow a journey through the funnel, and it records on-screen activity such as clicks, scrolling, and navigation (session replay) with all form inputs masked, and all text masked inside the application, so it never captures what you type. Choosing "Decline non-essential", or not choosing at all, keeps it off, and we also treat your browser's Global Privacy Control and Do Not Track signals as a Decline.

Your Choices and How to Clear Data

In the app:

• Sign out, immediately invalidates and removes the session cookie.
• Settings → data controls, export or clear your workspace data from within Newel.
• Disconnect integrations, removing a connection (calendar, automation, etc.) deletes its stored configuration.

In your browser:

• Clear cookies and site data for this site to remove everything in sections 3–6 at once. Note this signs you out, and for local-only workspaces it permanently deletes data that exists only on your device.
• Browser settings can also block cookies entirely; the application requires the one essential cookie to keep you signed in, so blocking all cookies prevents sign-in.

Do Not Track / Global Privacy Control: Newel performs no cross-site tracking and sells no data. If your browser sends either signal, we also keep our analytics and session replay off for you.

Roles of the Parties

This Data Processing Addendum is between you and Prime Edge LLC (operating as "Newel"). As to Client Data, you (or your brokerage) are the data controller and decide why and how that data is processed; Newel is the data processor and processes Client Data only to provide the Service and on your documented instructions (which include your configuration and use of the Service). To the extent the California Consumer Privacy Act applies to Client Data, Newel acts as your service provider: it will not sell or share Client Data, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than the business purposes in this notice, and will not combine it with other data, except as the law permits. You are responsible for the lawfulness of the Client Data and for having a valid legal basis and any required consent to collect it and to upload it to the Service.

Your Obligations as Controller

• provide all notices to, and obtain all consents and legal bases from, your clients and contacts required to upload, store, message, and process their information (including under privacy, data-protection, TCPA, CAN-SPAM, and do-not-call laws);
• only upload Client Data you are authorized to use, and honor opt-out, deletion, and do-not-contact requests;
• not upload special-category or highly sensitive data (government IDs, full financial-account numbers, Social Security numbers, health data) except as strictly necessary for ordinary brokerage operations.

Our Obligations as Processor

• process Client Data only to provide, secure, maintain, and improve the Service and on your instructions, not for our own independent marketing;
• keep Client Data confidential and limit access to personnel and sub-processors who need it;
• maintain reasonable technical and organizational security measures (encryption in transit and at rest, hashed credentials, per-workspace data isolation, access controls, rate limiting);
• assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security and breach-notification obligations.

Sub-Processors

You authorize us to engage sub-processors to deliver the Service, including hosting and serverless compute (Netlify), database and storage (Supabase), AI content providers (such as Anthropic and image/video model providers like MuAPI and the underlying ByteDance Seedance models), transactional email (Resend), and payments (Stripe). We require sub-processors to protect Client Data in a manner consistent with applicable law and this notice. We remain responsible for our processing obligations to the extent required by law, subject to the Terms of Service.

International Transfers

Where Client Data is transferred across borders, we will use a transfer mechanism recognized by applicable law where required, such as contractual safeguards or another legally recognized basis for transfer.

Security Incidents

We will notify you without undue delay after becoming aware of a confirmed personal-data breach affecting Client Data for which notice is required under applicable law, and we will provide information reasonably available to help you meet your own notification duties. Notice of or response to an incident is not an acknowledgment of fault or liability.

Data Subject Requests

If a client or contact asks to access, correct, delete, or restrict their data, you are responsible for handling the request as controller. We provide self-service tools to find, edit, export, and delete workspace data, and will reasonably assist where the tools are insufficient.

Return & Deletion

On termination, or on your request, you may export your Client Data using the in-app tools, and we will delete or anonymize remaining Client Data after a commercially reasonable period, except where retention is required by law.

Liability

This notice is subject to the limitation-of-liability, indemnification, and other provisions of the Terms of Service. To the extent of any conflict on the subject of Client-Data processing, Part Two of this notice controls.

Changes to This Notice

If we add a cookie, storage category, third-party connection, or sub-processor, we will update this page before the change takes effect, and material changes will be flagged in the app. We will never add advertising trackers silently.

Contact

Questions about cookies, storage, or data processing: email hello@newelos.com, or review the Privacy Policy and Terms of Service.