Nexfluence Privacy Policy

DRAFT — prepared for review by a Latvian lawyer. Not yet in force.

Version: [VERSION — must match the version label the app records when you confirm this policy (19.3)]In force from: [EFFECTIVE DATE]Last updated: [DATE]

The short version

• [COMPANY LEGAL NAME], a Latvian company, runs Nexfluence. We are responsible for the personal data described here.
• We collect what we need to run accounts, and to run deals between businesses and creators. We ask a creator for a shipping address and phone number only for a deal where the business sends them a product.
• A business sees a creator's profile. It sees the creator's content and results only for its own deals. Nexfluence does not show a business the creator's email address, bank details or earnings from other businesses. (A business that invited a creator already has the email address it used for the invitation.)
• Our database and files are stored in the EU (Ireland). Some of our providers are US companies. Section 8 explains how we protect transfers.
• We use no advertising cookies, no tracking cookies and no analytics scripts. We do not sell personal data.
• You can get a copy of your data or delete it. Business users can do this in settings. Anyone can do it by email.
• You can object to some of the ways we use your data (see the box below). You can complain to the Latvian Data State Inspectorate.

Your right to object

Some of the ways we use your data rely on our "legitimate interest". Section 5 shows which ones. You can object to any of them at any time, for reasons to do with your own situation. We will then stop, unless we have compelling reasons that override yours, or we need the data to make or answer a legal claim.

You can object to marketing email at any time, for any reason, and we will stop.

To object, write to [CONTACT EMAIL]. (Art. 21 GDPR)

1. Who we are

1.1 Nexfluence is run by [COMPANY LEGAL NAME, including its legal form, for example "SIA"], a company registered in Latvia. Registration number: [REGISTRATION NUMBER]. Registered address: [REGISTERED ADDRESS]. VAT number: [VAT NUMBER]. In this policy it is called "Nexfluence", "we" or "us".

1.2 We are the "controller" of the personal data in this policy. This means we decide why and how it is used, and we are responsible for it. The rules come from the EU General Data Protection Regulation (the "GDPR", Regulation (EU) 2016/679) and from Latvian law.

1.3 For any privacy question or request, write to [CONTACT EMAIL] or to our registered address. [BEFORE PUBLICATION: Nexfluence shows two support addresses today. The help page shows one, and approval emails come from another. Choose one, use it everywhere in the product, and put it here.]

1.4 Data protection officer (a person who checks how we use personal data): [NAME AND EMAIL — or: "We have not appointed a data protection officer, because the law does not require one for what we do. Please write to [CONTACT EMAIL]."] [LAWYER: is a data protection officer required? Annex A, question 14.]

1.5 Nexfluence is at nexus.nexfluence.eu. Tracked links use go.nexfluence.eu. Our emails come from hello@nexfluence.eu.

1.6 Our company details are also on our legal notice page at [LINK], which is linked from every page. [BEFORE PUBLICATION: create this page. Annex A, question 16.]

1.7 This policy is available in English and Latvian. [LAWYER: say which version prevails if the two differ. Annex A, question 15.] [BEFORE PUBLICATION: publish an equally complete Latvian version, checked by a native speaker or by the lawyer.]

2. Words we use

2.1 In this policy, these words have the meanings below. We use each word only in this sense.

1. Personal data: information about a person who can be identified, such as a name, email address or photo.
2. Business: a company that uses Nexfluence to work with creators. Nexfluence approves each business before it can start.
3. Business user: a person who uses Nexfluence for a business.
4. Brand: [CONFIRM: a name a business sells under. One business can have several brands.]
5. Creator: a person who posts on their own social media accounts and works with businesses through Nexfluence. Under our Terms, a creator must be 18 or older.
6. Social media platform: a service such as Instagram or TikTok, where creators post.
7. Roster: a business's list of the creators it works with.
8. Offer: what a business proposes to a creator. It covers how the creator is paid and how much, what is measured, any cap, the campaign brief, the release condition and the holding period.
9. Deal: the contract between a business and a creator, made when the creator accepts an offer. The accepted offer is the written record of the deal.
10. Promo code: a discount code given to a creator for a deal. The business uses it to find the creator's sales in its sales report.
11. Wallet: the record on Nexfluence of the money a business has set aside for its deals. Today the business makes a bank transfer and records it on Nexfluence, with its bank reference. [CONFIRM: who receives the transfer. See 4.2.2.]
12. Reserved: when a creator accepts an offer, the amount is set aside in the business's wallet.
13. Verified: a deal is verified when its first result is recorded.
14. Holding period: a wait of 0 to 30 days, set for each campaign. It starts when a deal is verified. It leaves time for problems such as refunds.
15. Released: when the holding period ends, or earlier if the business chooses, the reserved money becomes due to the creator. Released does not mean paid.
16. Payout: a payment to a creator for a deal.
17. Tracked link: the short go.nexfluence.eu web address for a deal, which counts visits (section 10).
18. Public profile: a creator's page at an address like nexus.nexfluence.eu/c/your-name, which anyone with the link can open (6.5).
19. Matches: the screen in the creator app that suggests live campaigns from approved businesses (5.5).
20. Nexfluence support: Nexfluence staff who approve businesses, answer requests and decide disputes.
21. Sign-in code: the six-digit code we email you so that you can sign in.
22. European Economic Area (EEA): the EU countries, plus Iceland, Liechtenstein and Norway.
23. Terms: our [TERMS NAME] at [LINK]. They are the contract between you and Nexfluence.

3. Who this policy covers, and who is responsible

3.1 This policy covers:

1. people who use Nexfluence for a business ("business users");
2. creators, whether a business invited them or they applied themselves;
3. people who start signing up but do not finish, and people who filled in our earlier request-access form;
4. people who view a creator's public profile, or send an enquiry through it;
5. people who click a tracked link;
6. anyone who writes to us.

3.2 Who contracts with whom. A deal is a contract between a business and a creator. We are not one of the two sides, except as set out in 3.5. We run Nexfluence, and we keep the record of each deal's money steps: what is reserved, released and paid. The accepted offer is the written record of the deal. Both sides can see it. [LAWYER: our product plans call Nexfluence the "payment agent". Add that term here, with a one-line explanation, only if it is accurate. Align this clause with the Terms. Annex A, question 5.]

3.3 Creators a business adds to its roster. When a business adds a creator to its roster, it gives us the creator's name, email address, handles and follower counts.

1. The business decides to add the creator. It is responsible for having a lawful reason to share those details with us. [BEFORE PUBLICATION: add to the Terms a promise from each business that it may lawfully give us the contact details of the creators it adds.]
2. We use those details for our own purposes in section 5 (5.4, row 3): mainly to send the invitation, and to keep the roster on Nexfluence. For that use, we are responsible.
3. You can ask either us or the business about these details.

[LAWYER: this clause treats the business and Nexfluence as separate controllers. The other options are that we act for the business (Art. 28 GDPR), or that we are joint controllers (Art. 26 GDPR). If joint control is chosen, add the essence of the arrangement here, and say that you can use your rights against either of us. Annex A, question 1.]

3.4 Your data in the other side's hands. A business or creator may use information it received through Nexfluence for its own purposes outside Nexfluence. For example, a business sends a product to a creator's shipping address, or reposts a creator's content. For that use, the business or creator decides how to handle your data and is responsible for it, not Nexfluence. Please ask them directly (16.8).

3.5 When Nexfluence is the business. At launch, Nexfluence also runs campaigns itself, for brands we represent. [CONFIRM: whether to name them.] In those deals, we are the business side of the deal. We are then also responsible for how we use the creator's data as a business does, for example to send a product or to repost content. [LAWYER: align with the Terms. Annex A, question 20.]

3.6 This policy does not cover brands' websites that you reach through a tracked link, or the social media platforms where creators post. Their own policies apply.

4. What we collect and where it comes from

We collect what you type in, what a business tells us about you, and a few things Nexfluence creates. We ask a creator for a shipping address and phone number only when a business sends them a product.

4.1 Everyone with an account

4.1.1 Email address. You give it to us. If a business invited you, the business gave it to us first.

4.1.2 Basic account details: whether you are a business user or a creator, your language (English or Latvian), and your display name.

4.1.3 Sign-in logs. We sign you in with a sign-in code sent to your email. There are no passwords. Our database provider keeps a log of each sign-in, including your IP address. [CONFIRM: how long sign-in logs are kept.]

4.1.4 Unfinished sign-ups. When you ask for a sign-in code, our sign-in provider creates an account record for your email address before you enter the code.

1. For a creator application, that record also holds your application: name, handles, follower range, niche, and your choice about campaign-match emails.
2. For a business sign-up, it holds your email address and language.

If you never enter the code, the record stays. [BEFORE PUBLICATION: nothing removes these records today. Build a cleanup, and set the period in 9.10.]

4.1.5 Confirmation records. For creators, we record:

1. that you ticked the box about our Terms and this policy, when you ticked it, and which version label was recorded;
2. whether you ticked "Send me campaign matches by email", and when.

Business users are not asked to confirm our Terms or this policy today. [BEFORE PUBLICATION: add a confirmation step for business users, or keep this sentence. The creator box also links to no text today, and every record carries the version label "2026-05-01", which matches no published text. See 19.3.] [PLANNED — decided 23 September 2026, not built: your confirmation that you are 18 or older.]

4.1.6 Email settings: whether you turned off reminder emails and, for businesses, whether you chose a daily summary.

4.1.7 Support requests: what you write to us, and our replies. This includes what a business types into the "What are you looking for?" box on the Find creators page. We keep those answers as support requests.

4.2 Business users

4.2.1 From you:

1. At sign-up: your work email, your business name, and roughly how many creators you work with.
2. When you set up your business profile: your business name, country, website, one-line pitch, where you sell, product categories and logo. You also give a contact person's name, an email address for notifications, and whether you want a daily summary.
3. Website suggestions. You can ask us to fill in your profile from your website. We then read that one public page, once. We suggest a business name, a one-line pitch and a logo. We save nothing from the page unless you keep a suggestion.
4. Your work on Nexfluence: brands, campaigns and briefs, offers, messages, feedback on drafts, shipping notes and parcel tracking numbers, results you type in, and disputes.
5. Wallet and payouts: (a) the amounts you record as loaded into your wallet, and the bank reference you give; (b) the amounts reserved, released and paid; (c) the bank reference you record when you mark a payout as paid.
6. Sales reports. When you add a sales report, it is read inside your own browser. For each line, we save only the date, promo code, discount description, quantity and value, plus the file name. We do not keep the file itself. We do not keep any details about your shoppers.

4.2.2 From others. [CONFIRM: does any wallet transfer reach a Nexfluence bank account today? If yes, keep this clause: "When you pay into your wallet by bank transfer, our bank shows us the payer's name, account number, amount and reference." If no, delete this clause and 7.2(2). Annex A, question 5.]

4.2.3 Created by Nexfluence. Nexfluence support approves each new business before it can use Nexfluence. We record the decision and when it was made.

4.2.4 Earlier request-access form. Businesses used to ask for access through a form, which we no longer use. If you used it, we hold your business name, email address, roughly how many creators you work with, your note, and the creator who referred you, if any. We keep these for the period in 9.11.

4.3 Creators

4.3.1 From you:

1. If you apply: your name, email address, Instagram and TikTok handles, a follower range, your niche, and whether you want campaign matches by email.
2. Your profile: photo, display name, bio, niche, country, Instagram, TikTok and LinkedIn handles, and follower counts. You type in follower numbers yourself, and they are shown as "self-reported". We do not connect to your social media accounts. If you set a monthly earnings goal, we keep that too. [BEFORE PUBLICATION: some screens in the creator app talk about "connecting" your accounts. Change them, because nothing is connected.]
3. Shipping address and phone number, only when you accept a deal where the business sends you a product. We keep them on your profile, and copy them onto that deal.
4. Your deals:
   • (a) your answers to offers, and your counter-offers;
   • (b) messages and cancellation reasons;
   • (c) links to your drafts (we keep only the link; the draft stays wherever you stored it), and links to your live posts;
   • (d) the caption, the kind of post (content type) and the social media platform of each post;
   • (e) screenshots of post statistics;
   • (f) disputes;
   • (g) [PROPOSED — not decided] your confirmation that the post is marked as a paid partnership.
5. Matches: whether you said yes or no to each campaign we suggested (5.5).
6. Deals you record with businesses outside Nexfluence: the business's name, amounts and dates. [CONFIRM: only you and Nexfluence support can see these.]
7. Profile choices: whether your public profile is on, and whether your results are shown on it.

4.3.2 From a business:

1. If a business invites you: your name, email address, handles and follower counts, as they appear on the business's list. We also keep the email address the invitation was sent to.
2. During a deal: results the business types in, or reads from its sales report using your promo code; your promo code; feedback on your drafts; shipping notes and parcel tracking numbers.

4.3.3 Created by Nexfluence: the web address of your public profile; the tracked link for each deal and its visit count; the status of each deal; the amounts owed, reserved, released and paid; and, in matches, how well each campaign may fit you and what you might earn (5.5).

4.3.4 Payouts today. We give the business a list of what it owes, with your name and the amount. The business pays you by bank transfer itself. It then marks the payout as paid on Nexfluence. We do not hold your bank details. You give them to the business directly, outside Nexfluence. [CONFIRM.]

4.3.5 [PLANNED — decided 12 September 2026, reconfirmed 24 September 2026] Payouts through Abillio. Abillio is a Latvian company that pays creators, issues invoices and handles tax reporting. Once payouts run through Abillio, Abillio will collect your identity, tax and bank details directly from you. We will receive only whether your payout set-up is complete, and the status of each payment.

4.3.6 Tax reporting details. [LAWYER: the EU rules on platform reporting (DAC7, Council Directive (EU) 2021/514) may make Nexfluence a "reporting platform operator" today, even while businesses pay creators themselves. Annex A, question 4. If so, add: "The law requires us to collect from each creator their full name, main address, tax identification number and date of birth (more for a company). We check them, and we report them with your payouts to the State Revenue Service. We will tell you before we report. You must give these details to be paid through Nexfluence." Then add these details to 4.5, the recipients to 7.2(4), and the period to 9.21.]

4.3.7 Sensitive information. We do not ask for sensitive information, such as details of your health, religion, sex life or sexual orientation. If you put it in your bio, niche or photo, it is shown where you choose to show it. [LAWYER: the legal basis, Art. 9(2)(a) or 9(2)(e) GDPR. Annex A, question 9.] Please do not include details or images of children. We do not use photos to recognise faces or to identify people.

4.4 Visitors, enquirers and people who click links

4.4.1 Public profile visitors. We place nothing on your device. If you use the "Work with me" form, we email your name, email address and message to the creator. We do not keep the message in our database. We keep only a record that an enquiry was sent to that creator, so that we can allow no more than five enquiries for each creator each hour. Our email provider keeps a copy of sent emails for [N] days, for delivery and troubleshooting. [CONFIRM: Resend's retention on our plan.]

4.4.2 People who click a tracked link: see section 10.

4.4.3 Technical data. When you open a page, our hosting provider handles your IP address (the number that identifies your internet connection), your browser details and the page you asked for. It needs these to show you the page and to protect Nexfluence. We also use IP addresses for a short time to stop too many requests coming from one place, for example to the website-suggestion feature. [CONFIRM: how long server logs are kept.]

4.5 What you must give us, and what happens if you do not

4.5.1 You need an email address to have an account.

4.5.2 A creator must give their name. A shipping address and phone number are needed only for a deal where the business sends a product. Without them, you cannot accept that deal.

4.5.3 A business must give the details we ask for at sign-up and when it sets up its profile. [CONFIRM: which fields are required.] We need them to decide whether to approve the business.

4.5.4 Everything else is optional. [LAWYER: tax reporting details may be required (4.3.6).]

5. Why we use your data, and our legal grounds

We use your data only for the reasons in the table below, and each reason rests on a legal ground. Where the ground is our legitimate interest, you can object.

5.1 The law lets us use personal data only for a clear reason, and only on one of a few legal grounds. We use four:

1. Contract: we need the data to provide Nexfluence under our Terms with you.
2. Legitimate interest: we, or someone else, have a fair reason, and we have weighed it against your rights. You can object to it.
3. Legal obligation: a law requires it.
4. Consent: you said yes, and you can change your mind at any time.

5.2 What "Contract" means. In the table, "Contract" means our Terms with you. It does not mean the deal between a business and a creator, which we are not part of. [LAWYER: confirm. Annex A, question 3.]

5.3 Business users. If you use Nexfluence for a business that is a company, our contract is with that business, not with you personally. So for you, wherever the table says "Contract", the ground is our legitimate interest in performing our contract with the business you represent (Art. 6(1)(f) GDPR). If you are a sole trader, the contract is with you (Art. 6(1)(b) GDPR).

5.4 The table shows each reason and its ground.

• #

  1

  Why

  Create your account and sign you in

  What data

  Email address, role, language, sign-in logs

  Legal ground

  Contract (Art. 6(1)(b) GDPR)

• #

  2

  Why

  Check a new business before it can use Nexfluence

  What data

  Sign-up and business details

  Legal ground

  Legitimate interest in protecting creators and Nexfluence from fake or abusive accounts (Art. 6(1)(f) GDPR)

• #

  3

  Why

  Let a business invite creators and keep its roster (3.3)

  What data

  Name, email address, handles and follower counts the business gives us; the email address the invitation was sent to

  Legal ground

  Legitimate interest of the business and of Nexfluence in managing the creators the business already works with (Art. 6(1)(f) GDPR). Once you accept the invitation: Contract (Art. 6(1)(b) GDPR)

• #

  4

  Why

  Run deals: offers, the accepted offer as the written record, messages, content review, shipping, results, verification, holding period, release and payouts. Show creators their earnings and monthly goal

  What data

  Deal, content, results and messages; shipping address and phone number for deals where a product is sent

  Legal ground

  Contract: our Terms with you (Art. 6(1)(b) GDPR)

• #

  5

  Why

  Keep the wallet and payout record on Nexfluence, and keep our own accounting records of fees and invoices for businesses and creators

  What data

  Wallet record, payouts, bank references, business details

  Legal ground

  Contract (Art. 6(1)(b) GDPR). Legal obligation to keep accounting records (Art. 6(1)(c) GDPR)

• #

  6

  Why

  Count visits on tracked links (section 10)

  What data

  Scrambled codes made from part of the visitor's IP address and browser details (10.2), the referring site's name, the time

  Legal ground

  Legitimate interest in measuring the results a deal pays on, with as little data as possible (Art. 6(1)(f) GDPR)

• #

  7

  Why

  Publish a creator's public profile (6.5)

  What data

  Photo, display name, niche, country, handles and follower counts, bio; one result only if you switch results on

  Legal ground

  Legitimate interest, once you have chosen to have a public profile (Art. 6(1)(f) GDPR). [LAWYER: today the profile is on by default (6.6). Annex A, question 2]

• #

  8

  Why

  Suggest live campaigns that may fit a creator (matches), and tell the business when the creator says yes (5.5)

  What data

  Niche, follower counts, your yes or no; the brand's product categories

  Legal ground

  Legitimate interest in helping creators find work, and businesses find creators (Art. 6(1)(f) GDPR)

• #

  9

  Why

  Pass on "Work with me" enquiries

  What data

  The sender's name, email address and message

  Legal ground

  Legitimate interest in letting people contact a creator who has a public profile, at the sender's own request (Art. 6(1)(f) GDPR)

• #

  10

  Why

  Send service emails (13.1)

  What data

  Email address, name, language, deal details

  Legal ground

  Contract (Art. 6(1)(b) GDPR). For invitations to people without an account: legitimate interest (Art. 6(1)(f) GDPR)

• #

  11

  Why

  Send campaign-match emails and other marketing email (13.5). We send none yet

  What data

  Email address, name, language

  Legal ground

  Consent (Art. 6(1)(a) GDPR), given in a separate box that is not ticked in advance

• #

  12

  Why

  Answer support requests and resolve disputes

  What data

  Messages, evidence, deal records, support's notes

  Legal ground

  Contract (Art. 6(1)(b) GDPR). Legitimate interest in being able to prove what happened if there is a legal claim (Art. 6(1)(f) GDPR)

• #

  13

  Why

  Keep the event log (section 11)

  What data

  Internal reference numbers, action types, numbers, times

  Legal ground

  Legitimate interest in security, an audit trail, evidence in disputes, and understanding use as totals (Art. 6(1)(f) GDPR)

• #

  14

  Why

  Improve Nexfluence, and learn which kinds of campaigns and content work, as totals across many creators

  What data

  Content type, caption, social media platform, results, event log

  Legal ground

  Legitimate interest in improving Nexfluence (Art. 6(1)(f) GDPR). We work only with combined data, and every result is about many creators, never one. You can object (see the box at the top). [LAWYER: Annex A, question 10]

• #

  15

  Why

  Protect Nexfluence: limit repeated requests, ignore visits from bots, and prevent abuse and spam

  What data

  IP address (used briefly, and never stored for tracked links), browser details, counts

  Legal ground

  Legitimate interest in security (Art. 6(1)(f) GDPR)

• #

  16

  Why

  Keep proof of your campaign-match email choice

  What data

  The choice, and when you made it

  Legal ground

  Legal obligation to be able to show consent (Art. 6(1)(c) and Art. 7(1) GDPR). [LAWYER: or legitimate interest. Annex A, question 18]

• #

  17

  Why

  Keep a record of which version of our Terms and this policy you were shown and confirmed

  What data

  Version label, time

  Legal ground

  Contract, for the Terms (Art. 6(1)(b) GDPR). Legitimate interest in proving what you were shown if there is a legal claim (Art. 6(1)(f) GDPR)

• #

  18

  Why

  Tax reporting, including DAC7 (Council Directive (EU) 2021/514)

  What data

  Payout records; name, address, tax identification number and date of birth

  Legal ground

  Legal obligation (Art. 6(1)(c) GDPR). [LAWYER: this may apply today, not only once payouts run through Abillio (4.3.6). Annex A, question 4]

• #

  19

  Why

  [PLANNED — decided 23 September 2026] Show a creator's cancellations to businesses (6.8)

  What data

  The fact and date of each cancellation

  Legal ground

  Legitimate interest in giving businesses reliable information before they make an offer (Art. 6(1)(f) GDPR). [LAWYER: Annex A, question 23]

• #

  20

  Why

  Answer lawful requests from authorities and courts

  What data

  Whatever the request lawfully requires

  Legal ground

  Legal obligation (Art. 6(1)(c) GDPR)

[LAWYER: if wallet money reaches a Nexfluence bank account, add rows for checks on businesses and their owners under the Latvian anti-money-laundering law. Annex A, question 5.]

5.5 Matches. The matches screen shows a creator live campaigns from approved businesses, including businesses the creator has never worked with. To choose which campaigns to show, Nexfluence compares the words in the creator's niche with the product categories the brand chose. From this it works out how well each campaign may fit. It also estimates what the creator might earn, from their follower counts. This is a simple form of profiling. We use it only to suggest campaigns. It does not decide whether you get a deal: you and the business decide that. When you say yes to a campaign, we email your display name to that business.

5.6 Where we rely on legitimate interest, you can object (see the box at the top, and 16.1(6)). You can ask us for a summary of how we weighed our interests against yours.

5.7 We do not sell personal data. We do not use it for advertising, and we do not show advertising on Nexfluence.

6. Who can see what on Nexfluence

A business sees a creator's profile, and only its own deals with that creator. Only Nexfluence support sees every account.

6.1 What a business sees about a creator today

• About the creator

  Display name, handles, follower counts, bio, and whether the numbers are self-reported

  Does the business see it?

  Yes

  When

  While the creator is on its roster (including the "removed" list, 6.7), and in every deal and message with that creator

• About the creator

  Photo

  Does the business see it?

  No

  When

  The roster shows the creator's initials. [PLANNED — decided 23 September 2026: the photo on the roster, in deals and in messages]

• About the creator

  Public profile page

  Does the business see it?

  Yes, and so can anyone with the link

  When

  While the profile is switched on (6.6)

• About the creator

  Email address

  Does the business see it?

  Not shown

  When

  Nexfluence never shows it. The business writes in the deal's message thread, and we email the creator. A business that invited the creator already has the email address it used for the invitation. That address stays in the business's roster record and in its data export

• About the creator

  Shipping address and phone number

  Does the business see it?

  Only on that deal

  When

  From when the creator gives them on a deal where the business sends a product. Today they stay visible to that business on that deal, also after delivery. They are never shown on the roster. [PLANNED — decided 23 September 2026: hidden once the product is delivered]

• About the creator

  Bank and tax details

  Does the business see it?

  Not through Nexfluence

  When

  We do not hold them. Today the creator gives bank details to the business directly (4.3.4). [PLANNED — decided 12 September 2026: Abillio will hold them (4.3.5)]

• About the creator

  Earnings from other businesses

  Does the business see it?

  Never

  When

  A business sees only its own deals

• About the creator

  Content and results

  Does the business see it?

  Only for its own deals

  When

  From when the draft is submitted

• About the creator

  That a creator said yes to one of its live campaigns in matches

  Does the business see it?

  The creator's display name

  When

  By email to the business's notification address, even if the creator is not on its roster. [CONFIRM: whether it is also shown on Nexfluence]

6.2 What a creator sees about a business today

• About the business

  Brand name

  Does the creator see it?

  Yes

  When

  From the invitation email onwards, and in every deal

• About the business

  Brand logo, one-line pitch, product categories, and a live campaign's summary and standard offer

  Does the creator see it?

  Yes

  When

  In matches, for live campaigns of approved businesses, even if the creator has never worked with them

• About the business

  Campaign brief

  Does the creator see it?

  In part

  When

  A summary before the creator accepts; the full brief once they accept

• About the business

  Email addresses of the business's users, including its notification email

  Does the creator see it?

  Never

  When

  The creator writes in the deal's message thread

• About the business

  Wallet balance, budgets, fees, other creators' deals

  Does the creator see it?

  Never

  When

  The creator sees only their own deal's terms and payouts. [PLANNED — decided 24 September 2026: a Nexfluence fee deducted from creator payouts, which the creator will see on their own payout]

[PLANNED — decided 23 September 2026, not built: the creator will also see the brand logo, website and pitch throughout; the business's legal name and country on an accepted deal; and the first name of the business's contact person, as the sender's name in messages.]

6.3 What both sides of a deal see:

1. the accepted offer: pay model, amounts, what is measured, any cap, the campaign brief, the release condition and the holding period;
2. the messages in the deal's thread;
3. in a dispute: the reason, details and evidence links, and Nexfluence support's written decision.

6.4 Nothing from one deal is shown in another deal.

6.5 Public profile. (6.5 and 6.6 speak to creators.) Your public profile is at an address like nexus.nexfluence.eu/c/your-name. Anyone with the link can see:

1. your photo, display name, niche and country;
2. your Instagram, TikTok and LinkedIn handles, and your follower counts;
3. a short bio;
4. your best result, but only if you choose to show it. Results are hidden unless you switch them on. They never include sales amounts.

Search engines are asked not to index your profile.

6.6 Switching your public profile on and off. Your public profile is switched on when you join. You can switch it off at any time in [CONFIRM: where]. When it is off, only your display name and a note that the profile is private remain, and you stop receiving "Work with me" enquiries. A change can take up to five minutes to show.

[BEFORE PUBLICATION: (1) Data protection by default (Art. 25(2) GDPR) says personal data should not be made public by default. Either make the profile start switched off, or ask each creator a yes-or-no question at set-up with no answer chosen in advance. If you change it, replace the first sentence with "Your public profile is off until you switch it on." Annex A, question 2. (2) Fix the bug where saving the profile set-up again resets both privacy switches (STATUS section 4). Until it is fixed, "you can switch it off at any time" is not reliable.]

6.7 Removing a creator from a roster. Today, if a business removes a creator, the creator stays visible to that business in a "removed" list, with the same details, so that the business can invite them again. The records of past deals stay, because both sides need them. [PLANNED — decided 23 September 2026: after removal, the business stops seeing the creator's photo and handles; and a creator can leave a roster when they have no open deal.]

6.8 [PLANNED — decided 23 September 2026] Cancellations. A creator may cancel a deal before submitting a draft. [CONFIRM: once for each deal, or once in total.] If they do, businesses on Nexfluence will see the cancellation on the creator's profile for [N] months. This may affect whether businesses offer them deals. The cancel screen will warn the creator before they confirm. If the mark is wrong, the creator can ask support to correct it, and can object (16.1(6)). [CONFIRM: whether the public profile shows it too.]

6.9 Nexfluence support. Only Nexfluence support can see all accounts. Support uses this access to approve businesses, answer requests and resolve disputes.

6.10 For business users. Our Terms describe the data that business users and creators can access on Nexfluence. Sections 6.1 to 6.9 give the same information. Your live campaigns are shown to creators in matches, including creators who are not on your roster (6.2). [LAWYER: whether Regulation (EU) 2019/1150 applies at all. Annex A, question 7.]

7. Service providers and other recipients

7.1 Service providers. These companies handle personal data for us, only on our instructions, under written agreements. [BEFORE PUBLICATION: confirm that each agreement (a data processing agreement) has been accepted or signed. This sentence cannot be published for a provider that has none.]

• Provider

  Supabase [LEGAL ENTITY]

  What it does for us

  Database, file storage (photos, logos, screenshots) and sign-in

  Where the data is

  EEA: Ireland. The company is part of a US group

  Protection for any transfer outside the EEA

  [CONFIRM: EU–US Data Privacy Framework, or Standard Contractual Clauses]

• Provider

  Vercel [LEGAL ENTITY]

  What it does for us

  Hosting the website, and running our server functions and scheduled jobs

  Where the data is

  Functions run in Dublin, Ireland. Vercel also has servers around the world that help pages load faster. Your request may pass through the one nearest to you, which can be outside the EEA. That server sees your IP address and the page you asked for

  Protection for any transfer outside the EEA

  [CONFIRM]

• Provider

  Resend [LEGAL ENTITY]

  What it does for us

  Sending our emails, including sign-in codes. It keeps copies of sent emails for [N] days

  Where the data is

  Sending region: Ireland [CONFIRM]

  Protection for any transfer outside the EEA

  [CONFIRM]

• Provider

  [PROVIDER LEGAL ENTITY]

  What it does for us

  The mailbox that receives replies to our emails, and support mail

  Where the data is

  [LOCATION]

  Protection for any transfer outside the EEA

  [PROTECTION]

• Provider

  [PLANNED — decided 12 September 2026, reconfirmed 24 September 2026] Abillio [LEGAL ENTITY], Riga

  What it does for us

  Payout set-up for creators, identity checks, invoices, payouts, and Latvian tax and DAC7 reporting. The creator becomes a member of Abillio, which is a cooperative society (a company owned by its members). Abillio issues the invoice

  Where the data is

  EEA: Latvia

  Protection for any transfer outside the EEA

  Not needed

[BEFORE PUBLICATION: replies and support mail go today to a consumer Gmail account, which comes with no data processing agreement. Move them to a business mailbox that offers one (for example Google Workspace). Then fill in the mailbox row. Until then, the mailbox cannot be listed under the words "under written agreements".]

[LAWYER: Abillio may be a separate controller rather than our service provider. If so, move it to 7.2, and say that Abillio will give creators its own privacy notice. Annex A, question 21.]

7.2 Other recipients:

1. The other side of a deal, and the public, as described in section 6.
2. Our bank, [BANK NAME], receives businesses' transfers into their wallets. The bank decides for itself how it uses this data, under its own privacy policy. [CONFIRM: delete this item if no wallet money reaches a Nexfluence account (4.2.2).]
3. Our professional advisers (accountants, auditors, lawyers), who must keep it confidential.
4. Authorities, such as the State Revenue Service (Valsts ieņēmumu dienests), courts, the police or the Data State Inspectorate, when the law requires it. [LAWYER: if DAC7 applies, add that the State Revenue Service shares reports with tax authorities in other EU countries. If anti-money-laundering law applies, add the Financial Intelligence Unit.]
5. A buyer or successor, if our business is sold or reorganised. The data would stay under the protections in this policy. [LAWYER: keep or remove. Annex A, question 22.]

7.3 Before a new service provider receives personal data, we will update this policy and give notice as set out in 19.2. Examples would be a card payment provider, or a service that reads creators' social media statistics with their permission. We use neither today.

8. Transfers outside the European Economic Area

8.1 We keep our database and files in the EEA (Ireland).

8.2 Some of our providers belong to companies based outside the EEA, mainly in the United States. Those companies, and their support staff, may be able to reach data from outside the EEA. When you open a page, your request may also pass through one of our hosting provider's servers outside the EEA (7.1).

8.3 When personal data leaves the EEA, we use one of these protections [CONFIRM for each provider]:

1. a decision by the European Commission that the country protects data well enough. For US companies, this covers those certified under the EU–US Data Privacy Framework;
2. a standard contract approved by the European Commission (the "Standard Contractual Clauses").

8.4 You can ask us for a copy of these protections at [CONTACT EMAIL].

9. How long we keep data

We keep data only as long as we need it. Some deal and payment records must be kept for the period Latvian law sets, even after you delete your account.

9.1 The table below shows how long we keep each kind of data.

[BEFORE PUBLICATION: several deletions in this table, and elsewhere in this policy, are decided but not built. Nothing deletes shipping addresses and phone numbers, statistics screenshots, sign-in accounts after an account is deleted, unfinished sign-ups or invitations that were never accepted. Build these jobs before the effective date, or say in each row how and how often we delete by hand.]

• #

  9.2

  Data

  Account and profile data

  How long

  While your account is open. For what happens when you delete it, see 16.3 to 16.5

• #

  9.3

  Data

  Shipping address and phone number, on your profile and on the deal

  How long

  [PLANNED — decided in PRD section 15, 12 September 2026, not built]: deleted 90 days after delivery. [BEFORE PUBLICATION: nothing deletes them today]

• #

  9.4

  Data

  Screenshots of post statistics

  How long

  [PLANNED — decided in PRD section 15, 12 September 2026, not built]: deleted 12 months after the campaign ends. [BEFORE PUBLICATION: nothing deletes them today]

• #

  9.5

  Data

  Deal and money records: accepted offers, results, payouts, wallet record, fee records, invoices

  How long

  [PERIOD] from the end of the year of the transaction. [LAWYER: proposed sources, to check: the Latvian Accounting Law (source documents, commonly 5 years) and the Law on Taxes and Fees. Annex A, question 12]

• #

  9.6

  Data

  Messages, content links, captions, disputes, support's notes

  How long

  [PERIOD]. [LAWYER: proposed: as long as the deal record, or until the limitation period for claims under the Civil Law ends. Check. Annex A, question 12]

• #

  9.7

  Data

  Event log

  How long

  [N] years after the related deal or account is closed. Then deleted, or turned into totals with no reference numbers (11.5)

• #

  9.8

  Data

  Tracked-link visit records

  How long

  [PERIOD]

• #

  9.9

  Data

  Creator details from an invitation that was never accepted

  How long

  [PROPOSED — not decided]: deleted [N] days after the invitation link expires, unless the business keeps the creator on its roster. The invitation link itself expires after 14 days. [BEFORE PUBLICATION: nothing deletes them today]

• #

  9.10

  Data

  Unfinished sign-ups (4.1.4)

  How long

  [PERIOD]. [BEFORE PUBLICATION: nothing deletes them today]

• #

  9.11

  Data

  Business sign-ups never approved, and earlier request-access forms

  How long

  [PERIOD]. [PROPOSED — not decided: unanswered sign-ups removed after 30 days]

• #

  9.12

  Data

  Support requests, including "Find creators" answers

  How long

  [PERIOD]

• #

  9.13

  Data

  Confirmation records (4.1.5)

  How long

  While your account exists, and [PERIOD] after it is deleted, without your name, so we can show what you agreed to. [CONFIRM: must match 16.5(d)] [LAWYER: proposed source: the limitation period for claims. Check]

• #

  9.14

  Data

  Record that a "Work with me" enquiry was sent

  How long

  [PERIOD]. The message itself is not kept in our database

• #

  9.15

  Data

  Copies of emails kept by our email provider

  How long

  [N] days. [CONFIRM: Resend's retention on our plan]

• #

  9.16

  Data

  Photos

  How long

  Until you replace them or delete your account. [CONFIRM: whether deleting an account removes the file from storage today.] For business logos, see 16.3(2)

• #

  9.17

  Data

  Monthly goal, matches answers, profile choices and email settings

  How long

  While your account is open

• #

  9.18

  Data

  Sign-in logs and server logs

  How long

  [PERIOD — from the Supabase and Vercel settings]

• #

  9.19

  Data

  Database backups

  How long

  Up to [NUMBER] days, then overwritten. [CONFIRM: the Supabase plan in use, and the backup period it gives]

• #

  9.20

  Data

  [PLANNED — decided 23 September 2026] Cancellation marks (6.8)

  How long

  [N] months

• #

  9.21

  Data

  [LAWYER — only if DAC7 applies (4.3.6)] Tax reporting details and reports

  How long

  [PERIOD — DAC7 requires 5 to 10 years. Check the Latvian law]

• #

  9.22

  Data

  [LAWYER — only if anti-money-laundering law applies] Checks on businesses and their owners

  How long

  [PERIOD — at least 5 years. Check]

9.23 Where a period comes from law, we keep the records with your identity, but only the people who need them can see them. We delete them when the period ends.

10. Tracked links

A tracked link counts visits without cookies and without storing IP addresses. We keep only scrambled codes, made with a value that changes every day.

10.1 Each deal can have one tracked link. This is a short web address, such as go.nexfluence.eu/k3x9. The creator shares it so that visits can be counted.

10.2 When someone opens the link, we do three things:

1. We shorten the visitor's IP address. For an IPv4 address, we keep the first three of its four blocks. For an IPv6 address, we keep the first three of its eight groups. We combine the result with a value that changes every day, and turn it into a one-way code (a "hash").
2. We do the same with the browser's identification string.
3. We note the name of the website the click came from (the site name only, never the full address), and the time.

10.3 We store only the two codes, the site name, the time and which link was opened. We never store the IP address itself. The daily value is made from the date and a secret key that only our server holds. Only someone with that key could work back from a code to a shortened address. We do not do this.

[BEFORE PUBLICATION, optional: if you want to promise that codes from different days can never be matched, change the daily value to a random one that is deleted at the end of each day. Annex A, question 6.]

10.4 Purpose. We count a visit at most once in any 24 hours from the same shortened address and browser, and we ignore known bots. That way a creator paid for each click is paid fairly, and a business is not charged for fake clicks. The business and the creator see visit counts, never the codes.

10.5 Nothing on your device. We place nothing on the visitor's device: no cookie, and no similar storage. [LAWYER: Annex A, question 6.]

10.6 We then send the visitor on to the web address the business gave for the deal. We add nothing to it, although it may contain the business's own tags. From that point, the brand's own privacy policy applies.

10.7 Legal ground: legitimate interest (5.4, row 6). Kept for: the period in 9.8.

10.8 You can object by writing to us. The codes do not tell us who you are, so we may not be able to find your visits (Art. 11 GDPR).

11. The event log

11.1 Most important actions on Nexfluence add one line to an internal record, the event log. Examples: an offer sent, a deal accepted, content approved, a result recorded, a payout marked paid, an account deleted. [BEFORE PUBLICATION: some actions write no line today (STATUS section 4). Fix them, or keep the word "most".]

11.2 Each line holds only:

1. the internal reference number of the account that acted;
2. the type of action, from a fixed list;
3. the type and internal reference number of the record concerned;
4. numbers, such as amounts;
5. the time.

We write only these. The system also refuses any field named as an email, name, address, phone or IP address.

11.3 The log is not shown on any Nexfluence page. Nexfluence support may look at it to resolve disputes and investigate problems.

11.4 We use it for security, as an audit trail, as evidence in disputes, and to understand how Nexfluence is used, as totals rather than about individual people.

11.5 How long. We keep each line for [N] years after the related deal or account is closed. Then we delete it, or turn it into totals with no reference numbers. Until then, the lines are "pseudonymised". This means they hold no name, but they can still be linked to you through the reference numbers, because the deal records are kept too (9.5). [PLANNED — decided in PRD section 15, 12 September 2026, not built: when your account is deleted, the link from each line to your account is removed within 30 days. Today that link is removed only when your sign-in account is deleted, and nothing does that yet (16.3(3)).]

11.6 The export file in settings does not include the event log. You can ask us for the lines about your account (16.1(1)).

12. Cookies and similar storage

12.1 A cookie is a small file a website stores in your browser. We use only the cookies Nexfluence needs to work, and one that remembers your language. We use no analytics, advertising or social media cookies, and we load no third-party tracking scripts. Our fonts are served from our own site. Tracked links store nothing on your device.

• Name

  sb-…-auth-token (may be split into several parts)

  What it does

  Keeps you signed in

  How long it lasts

  Until you sign out, or up to [CONFIRM: maximum lifetime]

• Name

  lang

  What it does

  Remembers whether you chose English or Latvian. It is set only when you choose a language

  How long it lasts

  1 year

• Name

  nx_signup

  What it does

  Carries the business name, and roughly how many creators you work with, as you typed them at sign-up, to the next screen

  How long it lasts

  Up to 1 hour; deleted once used

• Name

  nx_creator_signup

  What it does

  Holds your creator application (email address, name, handles, follower range, niche and campaign-match email choice) until you enter your sign-in code. Until then, our sign-in provider also holds the application on an unconfirmed account (4.1.4)

  How long it lasts

  Up to 1 hour

• Name

  nx.creator.connectBanner.dismissed (browser session storage, not a cookie)

  What it does

  Remembers that you closed a banner on the creator home screen

  How long it lasts

  Until you close the tab

12.2 Only our server can read the two sign-up cookies, and they are sent only over secure connections. Our server checks every value again when it reads them. [CONFIRM: consider signing or encrypting nx_creator_signup, because it holds an email address, name and handles (Art. 32 GDPR).]

12.3 Because we use only these, we do not show a cookie banner. [LAWYER: confirm that all of them fall within the exemption for storage that is strictly necessary or that you asked for, under Latvian law, especially the language cookie. Annex A, question 13.]

13. Emails we send

13.1 Service emails. We send these from hello@nexfluence.eu, in your language:

1. sign-in codes;
2. invitations (13.3);
3. deal updates, such as offers, acceptances, funds reserved, drafts, approvals and payouts;
4. reminders, sent at 11:00 Riga time;
5. a daily summary, for businesses that chose one;
6. to a business: a note when a creator says yes to one of its live campaigns in matches.

You cannot switch off 1, 2, 3 and 6 while you have an account. [CONFIRM.]

13.2 Switching emails off.

1. Reminders: use the link at the foot of any reminder. Nothing on screen turns them back on today, so write to us if you want them again.
2. Daily summary: you choose it when you set up your business profile. To change it later, write to us.

[CONFIRM: whether to add an email section to settings.]

13.3 Invitations. When a business invites you, we send you an invitation email. The business may send it again, for example when it adds you back after removing you. The invitation says which business gave us your details, and which details. It links to this policy. It contains only the business's invitation, and no advertising for Nexfluence. The invitation link expires after 14 days. [BEFORE PUBLICATION: the invitation email today has no link to this policy, and does not say where your details came from. Add both (Art. 14 GDPR), and one line about the right to object. LAWYER: Annex A, question 11.]

13.4 Replies. Replies to our emails go to our support mailbox (7.1).

13.5 Campaign-match and marketing email. We do not send marketing email today.

1. When creators apply or set up their profile, they can tick a box: "Send me campaign matches by email". The box is not ticked in advance. We record the choice (4.1.5). We do not send these emails yet.
2. Business users are not asked, and we send them no marketing email.
3. When we start, every such email will have an unsubscribe link. Until then, write to [CONTACT EMAIL] to change your choice.
4. Your choice applies from the moment you make it. Emails we sent before then were still sent lawfully.

13.6 No tracking. We do not use tracking pixels, and we do not track whether you open our emails or click their links. [CONFIRM: open and click tracking are switched off in Resend.]

14. Automatic decisions

A few deal rules run automatically. You can always ask a person to review the result.

14.1 A computer does not make important decisions about you on its own, except in the cases in 14.2. "Important" means a decision with a legal effect on you, or a similarly large effect.

14.2 Nexfluence applies these rules automatically, because they are needed to carry out the deal (Art. 22(2)(a) GDPR). Some come from the accepted offer. Others come from our Terms. [CONFIRM. LAWYER: Annex A, question 8.]

1. The first result recorded on a deal verifies it, and starts the holding period (0 to 30 days, set for each campaign).
2. Once the holding period ends, the money is released overnight. This means it becomes due to the creator. The business can release it earlier. Today the business then pays the creator itself (4.3.4).
3. Visits from known bots, and repeat visits from the same shortened address and browser within 24 hours, are not counted. This affects deals paid for each click.
4. [PLANNED — decided 23 September 2026] An offer nobody answers expires after 7 days.
5. [PLANNED — decided 23 September 2026] A draft the business does not review within 7 days counts as approved, and the creator may post.
6. [PLANNED — decided 23 September 2026] If a creator accepts a deal and then does not respond for 14 days, the deal may be cancelled. [CONFIRM: by whom.]

14.3 You can challenge any of these results by raising a dispute on the deal, or by writing to support. A person will review it, and you can explain your side.

14.4 A person, not a computer, decides whether to approve a new business. Matches suggestions are made automatically, but they do not decide anything about you (5.5).

15. Security

15.1 Rules in the database itself make sure that each business sees only its own data, and each creator only theirs.

15.2 You sign in with a sign-in code. We store no passwords.

15.3 For invitation links, we store only a one-way code (a hash) of the secret part of the link, never the link itself.

15.4 For tracked links, IP addresses are never stored (section 10). The event log refuses fields named as personal details (11.2).

15.5 Only Nexfluence support staff can see all accounts. [CONFIRM: who has support access.]

15.6 A personal data breach is a security problem that lets personal data be lost, changed or seen by someone who should not see it. If one happens, we will tell the Data State Inspectorate without undue delay, and where possible within 72 hours, when the law requires it. If it is likely to put you at high risk, we will also tell you without undue delay.

16. Your rights and how to use them

You can see, correct, delete and take a copy of your data, and object to some uses. Business users can do some of this in settings. Anyone can write to us.

16.1 Your rights:

• #

  (1)

  Your right

  Access

  What it means

  Get a copy of the personal data we hold about you

  How to use it

  Business users: Settings → Export my data. The file holds your account and business details, brands, roster, campaigns, deals, sales reports, payouts, wallet record and support requests. It does not hold messages, content and review notes, results, disputes, tracked links or shipping details. Write to [CONTACT EMAIL] for those. Creators: write to [CONTACT EMAIL]. [PLANNED — decided in PRD section 15, 12 September 2026: in settings.] Anyone: ask by email for the event log lines about your account

• #

  (2)

  Your right

  Correction

  What it means

  Have wrong data fixed

  How to use it

  Edit your profile in Nexfluence, or write to us. If a result the other side entered is wrong, raise it in the deal's thread or open a dispute

• #

  (3)

  Your right

  Deletion

  What it means

  Have your data deleted

  How to use it

  Business users: Settings → Delete account (16.3). Creators: write to [CONTACT EMAIL] (16.4). [PLANNED — decided in PRD section 15, 12 September 2026: in settings]

• #

  (4)

  Your right

  Restriction

  What it means

  Have us pause use of your data while a question is settled

  How to use it

  Write to us

• #

  (5)

  Your right

  Portability

  What it means

  Receive your data in a common file format that a computer can read, so you can take it elsewhere

  How to use it

  Business users: the export file in settings. Creators: write to [CONTACT EMAIL]. [PLANNED — decided in PRD section 15, 12 September 2026: in settings]

• #

  (6)

  Your right

  Objection

  What it means

  Object to uses based on legitimate interest. You can object to marketing at any time, and we will then stop

  How to use it

  Write to us (see the box at the top)

• #

  (7)

  Your right

  Withdraw consent

  What it means

  Stop campaign-match or marketing email

  How to use it

  Write to [CONTACT EMAIL]. Once we send such emails, you can also use the unsubscribe link in each one

• #

  (8)

  Your right

  Complain

  What it means

  Complain to a data protection authority

  How to use it

  Section 17

16.2 Timing and cost. We answer within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why. Using your rights is free.

16.3 Deleting a business user account today (Settings → Delete account):

1. Your user profile is cleared at once, and your link to the business is removed.
2. Your business account is closed (archived). The business record keeps its name, contact person's name, notification email address, website and logo. [BEFORE PUBLICATION: decide whether to remove these details or keep them for a stated period, and build it.]
3. Your sign-in account, which holds your email address, is not removed yet. [PLANNED — decided in PRD section 15, 12 September 2026, not built: removed within 30 days by a scheduled cleanup.] Until then, the event log still links to it (11.5).
4. Deletion goes ahead today even if a deal is open, or money is reserved or owed. [PROPOSED — not decided: we may need to settle open deals and money before we delete an account.]

16.4 Deleting a creator account today. Write to [CONTACT EMAIL], and we delete your account by hand. [CONFIRM: what is removed, and how quickly.]

16.5 What we delete and what we keep, for everyone:

• (a) What we delete: your contact details, photo, bio and shipping address, subject to 9.3 and to (b) to (d) below.
• (b) What we keep with your identity, seen only by people who need it: records the law requires us to keep, such as accounting and tax records (Art. 6(1)(c) and Art. 17(3)(b) GDPR), and evidence we need for a legal claim, such as dispute records (Art. 17(3)(e) GDPR). We keep them for the periods in section 9, then delete them.
• (c) What we keep without your name: captions and content types, for the analysis in 5.4, row 14. Links to live posts, and handles inside captions, point to your public posts, so these records can still be linked to you. [CONFIRM: either remove live-post links and handles on deletion, or keep this sentence.]
• (d) Confirmation records: kept without your name, for the period in 9.13. [CONFIRM: must match 9.13.]

We do not call this "anonymised", because some of what we keep could still be linked to you.

16.6 Identity check. We may ask you to confirm your identity, usually by sending a code to the email address on your account.

16.7 Limits. We may keep data that the law requires us to keep, or that we need to make or answer a legal claim. We will tell you what we kept and why.

16.8 Data the other side holds. If the other side of a deal copied your data out of Nexfluence, they are responsible for that copy. For example, a business that sent you a product has your shipping address in its own systems. Please ask them directly. For roster details that a business gave us, you can ask either of us (3.3).

17. Complaints

17.1 Please write to us first at [CONTACT EMAIL]. We will try to put things right.

17.2 You have the right to complain to the Latvian data protection authority:

Datu valsts inspekcija (Data State Inspectorate)Elijas iela 17, Rīga, LV-1050, Latviawww.dvi.gov.lv · pasts@dvi.gov.lv[CONFIRM: current contact details]

17.3 You can also complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. You can go to court as well.

18. Children

18.1 Nexfluence is for adults. Under our Terms, creators must be 18 or older. [PLANNED — decided 23 September 2026, not built: creators confirm they are 18 or older when they join.] People using a business account must be adults acting for that business.

18.2 We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close their account. We will delete their personal data, except what the law requires us to keep.

18.3 If you believe someone under 18 is using Nexfluence, write to [CONTACT EMAIL].

19. Changes to this policy

19.1 Each version of this policy has a version label and a date. Earlier versions are available [at LINK / on request].

19.2 Important changes. We will tell you about an important change by email and on Nexfluence at least 15 days before it takes effect. Important changes include:

1. a new purpose;
2. a new kind of company or person who receives your data;
3. a new service provider outside the EEA;
4. keeping data for longer;
5. letting search engines index public profiles. We will also ask each creator to choose again;
6. showing creators to businesses that do not have them on their roster, for example in a "Find creators" search. Being findable will be the creator's choice. [This waits for data from social media platforms, which was put on hold on 24 September 2026];
7. sharing with businesses what we learn from the analysis in 5.4, row 14.

[LAWYER: 15 days mirrors Regulation (EU) 2019/1150 for business users. Confirm it for creators. Annex A, questions 7 and 17.]

19.3 Confirming a new version. Nexfluence records which version of this policy you were shown. When the version changes, we show you the new one the next time you sign in. We ask you to confirm that you have read it. [BEFORE PUBLICATION — not built: today nobody is asked again when the version changes. The box says "I agree" and links to nothing, and business users are not asked at all. Suggested box wording: "I agree to the Terms, and I have read the Privacy Policy." Set the app's version label to this policy's label. Ask again every creator whose record says "2026-05-01", because that label refers to no text.]

19.4 If a change requires your consent, we will ask for it separately. We will not apply that change to you until you give it.

19.5 We may correct small errors, such as typos or contact details, without notice. When we do, we update the version label.

20. Version

• Version

  [VERSION]

  Date

  [DATE]

  What changed

  First version

[COMPANY LEGAL NAME] · [REGISTERED ADDRESS] · [CONTACT EMAIL]

DRAFT — prepared for review by a Latvian lawyer. Not yet in force.