Privacy Policy — Bridge
Nerie Studio — Julien Laumonerie, sole trader (entrepreneur individuel) SIREN: 851578500 Registered office: 126 avenue de Camps, 33470 Le Teich, France Contact: contact@squarebridge.app
Last updated: 30 October 2026
1. Who we are, and in what capacity
Nerie Studio is the trading name of Julien Laumonerie, a sole trader registered in France.
We publish Bridge (squarebridge.app), an analytics and optimisation tool for merchants using Squarespace Commerce. Bridge reads a store's data, produces analysis and recommendations, and — on the merchant's instruction — can apply certain changes to their store.
We act in two capacities:
For store data (orders, the merchant's customers, catalogue, traffic), we act on the merchant's behalf, never on our own. Under the GDPR, we are a processor and the merchant is the controller. Under the CCPA/CPRA, we are a Service Provider.
For the merchant's own account data (section 3), we are the controller.
Bridge is an independent product. Squarespace does not endorse Bridge, and Bridge is not affiliated with, sponsored by, or endorsed by Squarespace, Inc.
2. Store data we process on the merchant's behalf
Store data, retrieved through the Squarespace Commerce APIs after the merchant's explicit authorisation:
Orders — amounts, dates, currency, payment status, line items, discounts, processing fees.
The merchant's customers — name, email address, shipping and billing addresses, purchase history, marketing consent.
Catalogue — products, variants, prices, inventory, descriptions, images, SEO metadata.
Transactions — payment method type, refunds, taxes.
Traffic data, if the merchant installs our measurement script: sessions, page views, product page views, add-to-cart events, on-site search terms and result counts, and — to attribute a visit to its origin — the referring site's host, campaign parameters in the landing URL (utm_*), and advertising click references (gclid, fbclid, oppref), along with the order amount when a visit results in a purchase. This script sets no cookies and creates no persistent identifier. These elements are attached to a session, never to a person: they cannot recognise a visitor from one visit to the next, nor follow them across sites.
Telling visitors from robots. To count only real visits, our server reads the browser identifier (User-Agent) each visit sends, and an AI agent's signature when it presents one. It uses them only to classify the visit (visitor, declared robot, AI agent, likely robot), then discards them: they are neither stored nor logged. The script also counts a few gestures (pointer moves, scrolls, key presses), never keeping their position, content or timing.
Inside the Squarespace administration. The merchant may install a script that displays Bridge's analysis inside their own Squarespace back office. It runs in the merchant's own session, on their own site, and reads what the page already displays in order to add our indicators to it. It never accesses a third party's administration, and no administration session data is retained.
Google data — only where the merchant grants us access: Search Console (read-only, scope webmasters.readonly), and optionally Google Analytics, Google Ads and Merchant Center. Aggregated, with no direct identifiers. Access can be revoked at any time from the merchant's Google account.
Bridge's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We never collect passwords to the merchant's Squarespace account, full payment card details, health data, or any special category data within the meaning of Article 9 GDPR.
3. Account data we process as controller
Beta sign-up — name, email address, store URL, and the answers given in the sign-up form.
Bridge account — name, email address, password (stored only as a hash by our authentication provider), store(s) connected, language.
Onboarding answers — the merchant's answers to the questions Bridge asks about their business, used to tailor recommendations.
Product feedback — 👍/👎 on cards, comments, and call bookings.
Service emails — "analysis ready", weekly recap and beta follow-ups, with delivery status.
Purposes and legal basis: providing the account and the service (performance of the contract); emails about the beta and product improvement (legitimate interest — every email can be unsubscribed from). We do not use this data for advertising.
4. What we do with store data, and on what basis
Display analysis of the merchant's business — performance of the contract.
Generate improvement recommendations — performance of the contract.
Apply changes on the merchant's instruction — performance of the contract.
Measure site audience without trackers — legitimate interest; exempt from consent.
Secure the service and investigate incidents — legitimate interest.
We do not sell, rent, disclose or share any personal information — including as those terms are defined by the CCPA/CPRA. No advertising use. No AI model training. We never combine one merchant's data with another's.
5. Artificial intelligence
Bridge uses Anthropic's Claude API for two purposes.
Drafting analysis and recommendations. Only aggregated data is sent — revenue figures, volumes, search positions, product names. Never the contact details of the merchant's customers: no names, no email addresses, no postal addresses.
Visual page audits (Bridge Vision). We take screenshots of public pages of the merchant's site — the ones any visitor can see — and send them to Claude to classify their quality. A screenshot reproduces the page as displayed, including any public content on it (reviews, names the merchant chooses to display). We audit public pages only: never a members area, never an administration page, never a real person's session.
Anthropic does not use API data to train its models.
6. Where the data lives — sub-processors
Order and customer data is stored in the European Union — Ireland (eu-west-1), for all merchants, European and US alike.
Supabase — database and authentication. European Union, Ireland.
Vercel — application hosting. United States, Standard Contractual Clauses.
Anthropic — analysis generation. United States, Standard Contractual Clauses.
Resend — sending service emails (recipient address and email content). United States, Standard Contractual Clauses.
Google — Search Console, Analytics, Ads and Merchant APIs, where the merchant grants access. United States, Standard Contractual Clauses.
GitHub — automation of scheduled jobs. United States, Standard Contractual Clauses.
Squarespace — hosts our public website www.squarebridge.app.
We notify merchants of any change of sub-processor, and they have a right to object.
7. Cookies and trackers
The Bridge application uses strictly necessary cookies only: a secure, HTTP-only session cookie that keeps the merchant signed in, and a cookie that remembers the interface language. Both are exempt from consent.
No analytics cookies, no advertising trackers, no session recording — neither in our application nor on our merchants' sites. Our measurement script runs without cookies and without any persistent identifier. No consent banner is required for the audience measurement we provide.
8. How long we keep it
Store data (orders, customers, catalogue) — while the store is connected, then deleted within 30 days of disconnection or account closure.
Screenshots of audited pages — 90 days.
Aggregated audience counters, visit sources and visit categories — 25 months maximum.
Change log of modifications applied to the store — 12 months.
Technical logs — 12 months.
Account data — while the account is open, then deleted within 30 days of closure.
Beta sign-ups that never became an account — 3 years from the last contact.
Invoices and accounting records — as required by French law.
Merchants may request deletion or export of their data at any time.
9. Changes made to the store
When Bridge modifies a store (titles, descriptions, SEO metadata, image alt text, tags, variants, prices, inventory, discount codes), the operation is previewed, requires the merchant's explicit confirmation, and is recorded in a change log — what, when, at whose initiative, with what outcome. Changes can be undone where technically possible and paused at any time.
10. Security
Encrypted transport, secrets held in environment variables and never in source code, access tokens encrypted at rest, per-merchant data isolation, and access restricted to those who need it.
In the event of a data breach, we notify affected merchants without undue delay, so that they can meet their own obligations.
11. Individual rights
Merchants can access, correct, export or delete their account data by writing to contact@squarebridge.app. We respond within 30 days.
The merchant's customers exercise their rights — access, rectification, erasure, objection, portability, restriction — with the merchant, who is their controller. We assist the merchant in responding promptly.
California (CCPA/CPRA). Consumers have the right to know, delete, correct, and opt out of the sale or sharing of their personal information. We do not sell or share personal information. We do not discriminate against anyone exercising their rights.
In Europe, complaints may be lodged with the French Data Protection Authority (CNIL, www.cnil.fr) or the competent supervisory authority.
12. Minors
The service is intended for business use. We do not knowingly collect data relating to minors under 16.
13. Changes to this policy
Any material change is notified to merchants by email before it takes effect.