Nexfluence

Legal

Legal Notice, Cookies and Service Providers

DRAFT — prepared for review by a Latvian lawyer. Not yet in force.

Page: nexus.nexfluence.eu/legal [ROUTE NOT BUILT YET]Version: 0.2 (draft)Date of this draft: 24 September 2026In force from: [EFFECTIVE DATE]Languages: English and Latvian. [WHICH LANGUAGE VERSION COUNTS IF THE TWO DIFFER. See Q1.]

1. Who we are

Who runs the service, and how to reach us.

1.1. In this notice:

  • (a) "Nexfluence", "we" and "us" mean the company named in 1.2.
  • (b) "The service" means the website nexus.nexfluence.eu, including its public creator profile pages, and its short links on go.nexfluence.eu.
  • (c) "You" means anyone who uses the service, including people who are not signed in.
  • (d) "Business user" means a business with an account on the service.
  • (e) "Creator" means a person with a creator account on the service. Creators must be 18 or older.

1.2. We run the service. Our details:

  • (a)

    Detail

    Company name
    [COMPANY LEGAL NAME]
  • (b)

    Detail

    Legal form
    [LEGAL FORM, for example SIA]
  • (c)

    Detail

    Registration number
    [REGISTRATION NUMBER]
  • (d)

    Detail

    Registered in
    Commercial Register of the Register of Enterprises of the Republic of Latvia
  • (e)

    Detail

    VAT number
    [VAT NUMBER, or "Not registered for VAT"]
  • (f)

    Detail

    Registered address
    [REGISTERED ADDRESS], Latvia
  • (g)

    Detail

    Email
    [CONTACT EMAIL]
  • (h)

    Detail

    Board member
    [NAME] [KEEP ONLY IF THE COMPANY WANTS THIS ROW]
  • (i)

    Detail

    Contact point for authorities under the Digital Services Act (an EU law for online services)
    [NAME / EMAIL]. Languages: Latvian and English [CONFIRM]
  • (j)

    Detail

    Contact point for users under the Digital Services Act
    [CONTACT EMAIL]. A person reads and answers every message. We do not rely only on automated tools. Languages: Latvian and English [CONFIRM]

1.3. Emails from the service are sent from hello@nexfluence.eu. Replies to these emails go to [SUPPORT ADDRESS], and a person reads them, so you can reply. Every email from the service shows our company name, legal form, registration number and registered address. [BUILD ITEM B2: the emails do not include these details yet.]

1.4. [DATA PROTECTION OFFICER: if one is appointed, give the name or role and contact details here. If the lawyer confirms none is needed, delete this clause and keep the decision on file. See Q2.]

2. What the service does

What the service is for, and who the deal is between.

2.1. Business users use the service to manage the creators they work with, run campaigns, and work out what each creator is owed for their results. The business user pays the creator itself, by bank transfer, and records the payment in the service. We plan to pay creators through a payout provider later (see 5.3).

2.2. Creators use the service to receive offers, share content and see what they are owed.

2.3. A creator can choose to have a public profile page on the service. Anyone with the link can see it. Anyone can also use the "Work with me" form on that page to email the creator. They do not need to sign in.

2.4. When a creator accepts a business user's offer, the accepted offer becomes a deal. The accepted offer is the written record of the deal. It sets out how and how much the creator is paid, which results count, any cap, the campaign brief, when money is released and how long the holding period is. The service stores it, and both sides can see it. When the creator accepts, the service reserves the agreed amount in the business user's wallet (see 5.4).

2.5. A deal is a contract between the business user and the creator. We run the service, but we do not sign the deal and we are not a party to it. [INTENDED POSITION. LAWYER TO CONFIRM. See Q3.]

2.6. The full rules are in our Terms of Service and our Privacy Policy.

3. Public authorities that oversee us

Public authorities check that we follow the law. You can contact them directly.

3.1. These public authorities check that services like ours follow the law:

  • (a)

    Area

    Personal data protection

    Authority

    Data State Inspectorate (Datu valsts inspekcija)

    Website

    www.dvi.gov.lv
  • (b)

    Area

    Consumer rights and advertising, including how paid partnerships must be marked

    Authority

    Consumer Rights Protection Centre (Patērētāju tiesību aizsardzības centrs)

    Website

    www.ptac.gov.lv
  • (c)

    Area

    Company registration

    Authority

    Register of Enterprises of the Republic of Latvia (Uzņēmumu reģistrs)

    Website

    www.ur.gov.lv
  • (d)

    Area

    Rules for online services under the Digital Services Act (Latvia's Digital Services Coordinator)

    Authority

    [AUTHORITY. LAWYER TO CONFIRM. See Q6.]

    Website

    [WEBSITE]
  • (e)

    Area

    Rules for online platforms used by business users (EU Regulation 2019/1150)

    Authority

    [AUTHORITY. LAWYER TO CONFIRM, or delete this row. See Q7.]

    Website

    [WEBSITE]
  • (f)

    Area

    Handling money for other people (only if we need a licence for this)

    Authority

    [Latvijas Banka, ONLY IF THE LAWYER CONFIRMS THAT A LICENCE OR REGISTRATION APPLIES. Otherwise delete this row. See Q4.]

    Website

    [WEBSITE]
  • (g)

    Area

    Reporting sellers' income to the tax office under the EU DAC7 rules (only if they apply to us)

    Authority

    [State Revenue Service (Valsts ieņēmumu dienests), ONLY IF THE LAWYER CONFIRMS. Otherwise delete this row. See Q5.]

    Website

    [WEBSITE]

3.2. You can complain to the Data State Inspectorate at any time about how we handle personal data. You can also complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. Examples are the Estonian Data Protection Inspectorate and the Lithuanian State Data Protection Inspectorate. You do not have to contact us first. If you do contact us, we will try to fix the problem (see 6.6).

4. Cookies and browser storage

4.1. The short version

4.1.1. A cookie is a small file that a website saves in your browser. Browser storage is a similar place where a website can keep small notes.

4.1.2. We use no cookies for advertising or analytics.

4.1.3. We only use cookies that the service needs to work. They:

  • (a) keep you signed in;
  • (b) keep the sign-in step secure;
  • (c) remember your language;
  • (d) carry your sign-up answers to the next screen.

4.1.4. You will not see a cookie banner. A banner is needed only for optional cookies, and every cookie we use is needed for the service to work.

4.1.5. All our cookies come from nexus.nexfluence.eu itself. No other company sets cookies through our pages.

4.2. The full list of cookies

  • #

    1

    Cookie name

    sb-iwjwxbgsccgblqinwhnr-auth-token

    What it does

    Keeps you signed in. It holds a sign-in pass from Supabase, the company that runs our sign-in system. (A long pass is split into several cookies ending in .0, .1 and so on.)

    When it is set

    When you enter a correct six-digit sign-in code

    How long it lasts

    The cookie can stay in your browser for up to 400 days and is renewed while you use the service. It is deleted when you sign out.

    Contains personal data?

    Yes: your user ID and email address, inside the pass

  • #

    2

    Cookie name

    sb-iwjwxbgsccgblqinwhnr-auth-token-code-verifier, and other names ending in -code-verifier

    What it does

    A random one-time value that protects the sign-in step.

    When it is set

    When you ask for a sign-in code

    How long it lasts

    [DURATION]

    Contains personal data?

    No: a random value

  • #

    3

    Cookie name

    lang

    What it does

    Remembers whether you chose English (en) or Latvian (lv).

    When it is set

    When you choose a language with the EN / LV switch, or open a link that includes a language choice

    How long it lasts

    1 year

    Contains personal data?

    No

  • #

    4

    Cookie name

    nx_signup

    What it does

    Carries the business name and roster size (how many creators you work with) that you typed on the business sign-up form to the next screen.

    When it is set

    When you sign up as a business

    How long it lasts

    Up to 1 hour. Deleted sooner, as soon as the next screen has used it.

    Contains personal data?

    Possibly: the business name can be personal data if it includes a person's name

  • #

    5

    Cookie name

    nx_creator_signup

    What it does

    Holds your creator application answers until you confirm your email address. The answers are: email, name, Instagram and TikTok handles, follower range, niche, and your choice about marketing emails.

    When it is set

    When you apply as a creator

    How long it lasts

    Up to 1 hour. Deleted sooner, as soon as your account is created.

    Contains personal data?

    Yes: the answers listed

4.2.1. Code running on the page cannot read cookies 4 and 5. They are only sent over an encrypted (https) connection.

4.2.2. Code running on the page can read cookie 1. Our own pages do not need to read it. The sign-in software we use sets the cookie this way unless told otherwise.

4.2.3. When you ask for a sign-in code while signing up, Supabase (which runs our sign-in system) also stores your email address and your sign-up answers, so that your sign-up can be finished. For creators, these are the answers listed for cookie 5. For businesses, they are the business name and roster size. Once your creator account is created, your answers are removed from Supabase. If you do not confirm your email address within [X] days, we delete your email address and your answers. [BUILD ITEM B3: this deletion does not exist yet. Until it is built, this sentence is not true and must not be published. See Q17.]

4.3. Other browser storage

4.3.1. We also keep one small note in your browser tab. It is deleted when you close the tab.

  • Name

    nx.creator.connectBanner.dismissed

    Type

    Tab storage

    What it does

    Remembers that a creator closed the "Connect Instagram and TikTok" notice, so that it stays closed while that tab is open. (Connecting these accounts is not available yet. The notice links to your profile.)

    How long it lasts

    Until you close the tab

4.3.2. Apart from the cookies in 4.2 and the note in 4.3.1, we store nothing in your browser.

4.4. Short links and visit counts

4.4.1. When someone opens a short link on go.nexfluence.eu, we set no cookie and store nothing in their browser. We send them straight on to the business user's website.

4.4.2. To count visits, we record:

  • (a) the time of the visit;
  • (b) the website the visitor came from (its name only, not the full address);
  • (c) a scrambled code made from a shortened copy of the visitor's IP address (the internet address of their device);
  • (d) a scrambled code made from the visitor's browser details.

4.4.3. The codes in (c) and (d) are made with a secret key that changes every day. This means a visit cannot be linked to the same person's visits on other days.

4.4.4. We count each visitor once per link in any 24 hours. We do not count known bots.

4.4.5. We keep these records for [RETENTION PERIOD. DEVELOPER TO CONFIRM]. We use them to count the visits that a business user pays a creator for. Our legal basis is [LEGAL BASIS]. Details are in our Privacy Policy.

4.5. How to remove cookies

4.5.1. You can delete cookies in your browser settings at any time. If you delete cookie 1 (sign-in), you will be signed out. If you delete cookie 3 (language), the service will switch to English.

5. Companies that handle personal data for us

A few companies help us run the service and handle personal data for us. One more, Abillio, is planned for creator payouts and would use creators' data for its own purposes.

5.1. We use a few other companies to run the service. They store or handle personal data for us. The law calls them "[processors / sub-processors. LAWYER TO CONFIRM. See Q8]". Each one works under a written contract with us about how it must handle personal data (a "data processing agreement"). [KEEP THIS LAST SENTENCE ONLY WHEN EVERY ROW BELOW HAS A CONFIRMED AGREEMENT. See Q16.]

  • (a)

    Company

    Supabase (legal name: [FROM SIGNED DPA])

    What it does for us

    Database; file storage (for example logos, profile photos and screenshots); sign-in codes; keeping you signed in

    Where the data is kept and handled

    Ireland (EU), in an Amazon Web Services data centre. [CONFIRM FROM THE DPA whether Supabase staff can reach the data from outside the EU, for example to give support.]

    Data processing agreement

    supabase.com/legal/dpa [CONFIRM SIGNED OR ACCEPTED ON [DATE], WITH WHICH COMPANY]

    Companies they use in turn

  • (b)

    Company

    Vercel (legal name: [FROM SIGNED DPA])

    What it does for us

    Hosts the website and runs our server code. Also runs scheduled jobs. Every night at 06:00 UTC, one job marks amounts as released once their holding period ends and counts short-link visits as results. Every day at 11:00 Riga time, another sends reminder emails and the daily digest for business users. These jobs do not move money.

    Where the data is kept and handled

    Our server code runs in Dublin, Ireland (EU). Pages reach you through Vercel's worldwide network, so your request may pass through a Vercel server near you, which can be outside the EU. Public creator profile pages (with the creator's name, photo, handles, follower counts and bio) are kept in Vercel's worldwide cache for up to about an hour.

    Data processing agreement

    vercel.com/legal/dpa [CONFIRM SIGNED OR ACCEPTED ON [DATE], WITH WHICH COMPANY]

    Companies they use in turn

  • (c)

    Company

    Resend (legal name: Plus Five Five, Inc.)

    What it does for us

    Sends email from hello@nexfluence.eu: sign-in codes, invitations, reminders, the daily digest, notifications about offers, deals and payments, and messages sent through the "Work with me" form.

    Where the data is kept and handled

    [SENDING REGION. Check the domain's region in Resend, and choose the EU region if it is available.]

    Data processing agreement

    resend.com/legal/dpa [CONFIRM SIGNED OR ACCEPTED ON [DATE]]

    Companies they use in turn

  • (d)

    Company

    [MAILBOX PROVIDER FOR nexfluence.eu] (legal name: [CONFIRM])

    What it does for us

    Hosts our email accounts, including [CONTACT EMAIL] and the address that receives support requests

    Where the data is kept and handled

    [CONFIRM]

    Data processing agreement

    [LINK] [CONFIRM SIGNED OR ACCEPTED ON [DATE]]

    Companies they use in turn

    [LINK]
  • (e)

    Company

    Google (Gmail) (legal name: [CONFIRM])

    What it does for us

    Today, replies to our emails and business approvals go to a Gmail account. [COMPANY DECISION BEFORE PUBLISHING: move these to a business mailbox that has a data processing agreement. Then delete this row, or name that provider in row (d). See B1.]

    Where the data is kept and handled

    [CONFIRM]

    Data processing agreement

    None. A consumer Gmail account has no data processing agreement.

    Companies they use in turn

    —

5.2. Where data may leave the European Economic Area

5.2.1. Supabase, Vercel and Resend are US companies [CONFIRM, AND CONFIRM FOR ROW (d)]. This means personal data may leave the European Economic Area (the EU plus Iceland, Liechtenstein and Norway). This can happen when their staff give support, when Vercel delivers or caches pages near you, or [IF RESEND SENDS FROM THE US] when we send you an email.

5.2.2. When it does, one of these safeguards protects it:

  • (a) Supabase: [EU-US Data Privacy Framework (check the company's listing) and/or the EU's standard contract clauses (Commission Decision 2021/914)];
  • (b) Vercel: [AS ABOVE. CONFIRM];
  • (c) Resend: [AS ABOVE. CONFIRM];
  • (d) [MAILBOX PROVIDER]: [CONFIRM].

5.2.3. You can ask us for a copy of these safeguards at [CONTACT EMAIL]. See also our Privacy Policy.

5.3. Planned: Abillio (a partner that would use creators' data for its own purposes)

5.3.1. Abillio is not in use yet. On 24 September 2026 we chose Abillio as the way to pay creators in the future. We have no contract with Abillio yet.

5.3.2. The plan: a creator who chooses to be paid through Abillio becomes a member of Abillio's cooperative society in Riga. [CONFIRM: one plain line on what membership means for the creator.] Abillio sends the invoice to [WHOM. CONFIRM] and handles the creator's Latvian tax.

5.3.3. Abillio would use the creator's details for its own purposes, under its own privacy notice and membership terms: [ABILLIO PRIVACY NOTICE LINK]. It would not be a company that handles data for us.

5.3.4. We would pass a creator's details to Abillio only after the creator chooses to be paid through Abillio. Abillio would handle the data in Latvia [CONFIRM].

5.3.5. Before Abillio is used, we will update this page and give notice under 5.5.

5.4. Payments and bank details

5.4.1. Today, business users pay creators themselves, by bank transfer. The service works out the amounts and keeps a record. We do not send money to creators.

5.4.2. [ONE OF THESE, ONCE THE COMPANY AND THE LAWYER CONFIRM. See Q4.Option A: "We do not receive or hold money for deals. The wallet is a record in the service of the amounts the business user has committed."Option B: "Money that business users load into the wallet is paid into [ACCOUNT HOLDER AND BANK]. We hold it under [LICENCE, REGISTRATION OR EXEMPTION]." If this option is chosen, also fill in row 3.1(f).]

5.4.3. The service has no place for bank details and never asks for them. The business user gets them from the creator directly. Please do not send bank details in messages on the service.

5.5. Changes to this list

5.5.1. [LAWYER TO CHOOSE ONE, depending on our role for each kind of data. See Q8.Option A, if we handle some data for business users as their processor: "We will email business users at least [NUMBER] days before we add or replace a company in 5.1. Starting to use a company that this page lists as planned counts as adding it. We will update this page at the same time. A business user may object within that time. If it does, [WHAT HAPPENS, for example: it may close its account before the change applies]."Option B, if we decide how all the data is used: "When we add or replace a company in 5.1, we update this page before any personal data reaches the new company."Make [NUMBER] match the 15 days in 8.2, or explain the difference.]

5.5.2. We also tell creators when this list changes, by [CONFIRM WHETHER AND HOW, for example a notice in the service].

5.6. We do not use advertising or analytics services. Our hosting providers keep technical logs of requests, including IP addresses, for security. See our Privacy Policy. If we start using another company that handles personal data, we will add it to this page under 5.5 before any data reaches it.

6. Help, complaints and disputes

Tell us about any problem by email. If your business account is approved, you can also use Get help. Anyone can report illegal content. Business users and creators also have a formal complaint process and can ask for mediation.

6.1. Ways to reach us

6.1.1. By email: [CONTACT EMAIL]. Anyone can use it. That includes creators, business users whose account is waiting for approval or was declined, and people who are not signed in.

6.1.2. In the service: if your business account has been approved, use Get help in the top bar. It creates a support request, and you can see its status there. We reply by email.

6.1.3. By post: [REGISTERED ADDRESS], Latvia.

6.1.4. Tell us who you are, what happened, and what you would like us to do. Screenshots help.

6.1.5. A person reads every message.

6.2. Report illegal content

6.2.1. Anyone can tell us about content on the service that they believe is illegal, for example on a public creator profile page. You do not need an account.

6.2.2. Email [CONTACT EMAIL] with "Illegal content" in the subject line. Include:

  • (a) where the content is (the web address);
  • (b) why you believe it is illegal;
  • (c) your name and email address (you may leave these out if you are reporting child sexual abuse material);
  • (d) a statement that you believe your report is accurate and complete.

6.2.3. We confirm that we received your report. A person looks at it. We then tell you what we decided and how you can challenge the decision.

6.2.4. If we remove content or restrict an account because of a report, we tell the person who posted the content our reasons at that time, and how they can challenge the decision.

6.3. Disputes about a deal

6.3.1. If you disagree with the other side of a deal, use Raise a dispute on that deal.

6.3.2. For example, you may disagree about whether a result was met, or whether a payment should be released.

6.3.3. While a dispute is open, nothing on that deal can be released or marked paid until our support team decides. We decide whether to release the amount, release part of it, or cancel, and we explain the decision in writing. The full process is in the Terms of Service, section [X].

6.3.4. Our decision settles how the amount reserved on that deal is handled in the service. It does not stop either side from taking the matter to court.

6.3.5. You cannot open a dispute once a deal has been marked paid. If you are a creator and a deal is marked paid but you have not received the money, email [CONTACT EMAIL].

6.4. Formal complaints

6.4.1. This section is for business users. Creators can use it too. [ONE OF THESE, ONCE THE LAWYER CONFIRMS. See Q7. "An EU law, Regulation 2019/1150, says online platforms must give business users a free way to complain." or "We follow the complaint standards of EU Regulation 2019/1150 voluntarily."] This section and 6.5 are part of our Terms of Service. [LAWYER TO DECIDE whether to move 6.4 and 6.5 into the Terms and keep only a short summary and link here.]

6.4.2. What you can complain about:

  • (a) a case where you believe we did not follow the EU law named in 6.4.1;
  • (b) a technical problem with the service that affects you;
  • (c) something we did or decided that directly affects you. For example: declining your business account, or how we handled a dispute on your deal.

6.4.3. A complaint about how we handled a dispute is not an appeal. It does not reopen or reverse the payment decision on that deal.

6.4.4. How: if your business account has been approved, send your complaint through Get help. Otherwise, email [CONTACT EMAIL] with the word "Complaint" in the subject line. Creators, and business users whose account is waiting for approval or was declined, must use email.

6.4.5. Cost: complaining is free.

6.4.6. Timing:

  • (a) Within [NUMBER] working days of receiving your complaint, we confirm that we have it.
  • (b) Within [NUMBER] working days of receiving it, we give you our decision.
  • (c) If we need more time, we tell you why and when you will get an answer.

Working days are Monday to Friday, except Latvian public holidays.

6.4.7. How we decide: a person at Nexfluence reads your complaint, looks at the facts, and replies in writing in plain language.

6.4.8. [HOLD. DO NOT PUBLISH UNTIL BUILD ITEM B4 IS DONE. Proposed text: "When we decline, restrict, suspend or end a business account, we tell the business the reasons at that time. Before ending access, we give the notice set out in the Terms of Service, section [X]. If you complain, a person reviews the decision and replies in writing."]

6.4.9. Once a year, we publish on this page how many complaints we received, what they were mainly about, how long they took and what we decided. [CONFIRM. IF THE SMALL-ENTERPRISE EXEMPTION APPLIES, ADD "We do this voluntarily." OR DELETE THIS CLAUSE. See Q7.]

6.5. Mediation

6.5.1. In mediation, an independent person helps both sides reach an agreement. The mediator does not decide for you.

6.5.2. If our answer under 6.4 does not solve your complaint, you can ask for mediation. We will take part with either of these mediators:

  • (a) [MEDIATOR 1: name, address, website];
  • (b) [MEDIATOR 2: name, address, website].

6.5.3. We will take part honestly and try to reach an agreement. We pay [PERCENTAGE, for example at least half] of the mediator's costs.

6.5.4. Mediation is voluntary. It does not stop either side from going to court.

6.5.5. [IF THE SMALL-ENTERPRISE EXEMPTION APPLIES: "We offer mediation voluntarily." See Q7.]

6.6. Complaints about personal data

6.6.1. Write to [CONTACT EMAIL] about how we handle your personal data. You can also go straight to a data protection authority (see 3.2).

6.7. If you are a consumer

7. Accessibility

7.1. We want everyone to be able to use the service, in English and Latvian, on a phone or a computer.

7.2. This statement is voluntary.

7.3. [TARGET, for example: "We aim to meet the common international standard for accessible websites (WCAG 2.1, level AA)."] The service has not yet been checked against this standard, so we do not claim that it meets it.

7.4. Problems we knew about on 24 September 2026:

  • (a) A native speaker has not yet checked the Latvian text.
  • (b) Some categories and niches appear in English on Latvian pages.
  • (c) The creator pages have not yet been tested by hand on a phone.
  • (d) The creator pages look empty on wide laptop screens.

[WHEN WE PLAN TO FIX EACH ONE.]

7.5. Tell us about anything that makes the service hard to use. Email [CONTACT EMAIL], or use Get help if your business account has been approved. We reply within [NUMBER] working days.

8. Changes to this page

8.1. We will update this page when our company details, the cookie list or the list of companies in section 5 change. Each update gets a new version number and date. Changes to the list of companies in section 5 follow 5.5.

8.2. If a change to this page affects business users' rights under the Terms of Service, we will tell business users at least 15 days before it applies. The Terms of Service, section [X], explain how.

  • Version

    0.1

    Date

    24 September 2026

    What changed

    First draft for legal review

  • Version

    0.2

    Date

    24 September 2026

    What changed

    Revised after legal and plain-language review. Corrected the facts on sign-up storage, Get help, email replies and scheduled jobs. Added definitions, illegal-content reporting, Digital Services Act contact points, transfer safeguards, mailbox providers and public-profile caching. Moved Abillio out of the processor list and removed the DAC7 claim. Held the reasons clause until the product can give reasons. Added the open questions and build items.