Version 2 · 18 October 2026. Nexfluence is a young company. These terms are in force and we keep refining them with our lawyer; where something is still being settled, we say so in the text. Questions: info@nexfluence.eu.

Nexfluence Privacy Policy

Version: 2 · 18 October 2026In force from: 18 October 2026Earlier versions: on request at info@nexfluence.eu

The short version

• SIA "Nexfluence", a Latvian company, runs Nexfluence. We are responsible for the personal data described here.
• We collect what we need to run accounts, and to run deals between businesses and creators. We ask a creator for a shipping address and phone number only for a deal where the business sends them a product.
• A business sees a creator's profile. It sees the creator's content and results only for its own deals. Nexfluence does not show a business the creator's email address or earnings from other businesses. A creator's bank details go to our payment partner Abillio, which makes the payouts, not to us or to the business. (A business that invited a creator already has the email address it used for the invitation.)
• Our database and files are stored in the EU (Ireland). Some of our providers are US companies. Section 8 explains how we protect transfers.
• A creator can connect their Instagram, TikTok or YouTube account. We then read their follower count, the numbers of their newest posts and their audience (countries, cities, ages and genders, as shares). We only read: we never post, comment or send messages. Disconnecting, and asking us to delete what we read, takes one press or one email (4.3.8, 16.9).
• We use no advertising cookies. If you say yes in the cookie bar, we count visits to our pages with Google Analytics, which sets cookies. If you say no, nothing is sent to Google (sections 7 and 12). We do not sell personal data.
• You can get a copy of your data or delete it. Business users can do this in settings, and creators in their profile under "Your data". Anyone can do it by email.
• You can object to some of the ways we use your data (see the box below). You can complain to the Latvian Data State Inspectorate.

Your right to object

Some of the ways we use your data rely on our "legitimate interest". Section 5 shows which ones. You can object to any of them at any time, for reasons to do with your own situation. We will then stop, unless we have compelling reasons that override yours, or we need the data to make or answer a legal claim.

You can object to marketing email at any time, for any reason, and we will stop.

To object, write to info@nexfluence.eu. (Art. 21 GDPR)

1. Who we are

1.1 Nexfluence is run by SIA "Nexfluence", a limited liability company registered in the Register of Enterprises of the Republic of Latvia. Registration number: 40203709513. Registered address: Brīvības gatve 300-9, Rīga, LV-1006, Latvia. VAT number: LV40203709513. In this policy it is called "Nexfluence", "we" or "us".

1.2 We are the "controller" of the personal data in this policy. This means we decide why and how it is used, and we are responsible for it. The rules come from the EU General Data Protection Regulation (the "GDPR", Regulation (EU) 2016/679) and from Latvian law.

1.3 For any privacy question or request, write to info@nexfluence.eu or to our registered address.

1.4 Data protection officer (a person who checks how we use personal data): we have not appointed one, because the law does not require one for what we do. Please write to info@nexfluence.eu.

1.5 Nexfluence is at nexfluence.eu. Tracked links use go.nexfluence.eu. Our emails come from no-reply@nexfluence.eu. Replies to them go to info@nexfluence.eu.

1.6 Our company details are also on our legal notice page at https://nexfluence.eu/legal/imprint, which is linked from the footer of our home page and from every legal page.

1.7 This policy is available in English and Latvian. If the English and Latvian versions differ, the English version counts, unless the law requires otherwise.

2. Words we use

2.1 In this policy, these words have the meanings below. We use each word only in this sense.

1. Personal data: information about a person who can be identified, such as a name, email address or photo.
2. Business: a company that uses Nexfluence to work with creators. Nexfluence approves each business before it can start.
3. Business user: a person who uses Nexfluence for a business.
4. Brand: a name a business sells under. One business can have several brands.
5. Creator: a person who posts on their own social media accounts and works with businesses through Nexfluence. Under our Terms, a creator must be 18 or older.
6. Social media platform: a service such as Instagram or TikTok, where creators post.
7. Roster: a business's list of the creators it works with.
8. Offer: what a business proposes to a creator. It covers how the creator is paid and how much, any bonuses, what is measured, any cap, the campaign brief, the release condition and the holding period.
9. Deal: the contract between a business and a creator. It is made when the creator accepts an offer. The money for it is set aside in escrow at Abillio, from the business's wallet balance, in the same step or, if the wallet is short, as soon as the business tops up. The accepted offer is the written record of the deal.
10. Promo code: a discount code given to a creator for a deal. The business uses it to find the creator's sales in its sales report.
11. Wallet: the business's record on Nexfluence of the money it has paid in for its deals. A business tops up by bank transfer to Nexfluence's bank account, with its own reference, and we record the money when it arrives. We do not keep the money as a deposit: we pass it on to our payment partner Abillio, which holds it in escrow for the business's deals. For campaigns Nexfluence runs itself (3.5), the wallet is a record only: Nexfluence funds the deal itself, and the payout goes through Abillio the same way.
12. Reserved (set aside): the money set aside in escrow at Abillio, from the business's wallet balance, for a deal when the creator accepts it: the deal amount (or its cap, or, for a share of sales, a reserve), one full round of any bonuses, and the business's fee. It is released under the deal, or comes back to the business's free balance when the deal ends without it being paid.
13. Verified: a deal is verified when its first result is recorded.
14. Holding period: a wait set for each campaign: none by default, and 30 days for sales goals. It starts when a deal is verified. It leaves time for problems such as refunds.
15. Released: when the holding period ends, or earlier if the business chooses, the reserved money becomes due to the creator, and Abillio then pays it out. Released does not mean paid yet.
16. Payout: a payment to a creator for a deal. Payouts are made through our payment partner Abillio, which issues the invoice in the creator's name and takes care of the creator's tax (4.3.4).
17. Tracked link: the short go.nexfluence.eu web address for a deal, which counts visits (section 10).
18. Public profile: a creator's page at an address like nexfluence.eu/c/your-name, which anyone with the link can open (6.5).
19. Matches: the screen in the creator app that suggests live campaigns from approved businesses (5.5).
20. Nexfluence support: Nexfluence staff who approve businesses, answer requests and decide disputes.
21. Sign-in code: the six-digit code we email you so that you can sign in.
22. European Economic Area (EEA): the EU countries, plus Iceland, Liechtenstein and Norway.
23. Terms: our Terms of Service for Businesses (https://nexfluence.eu/legal/business-terms) or our Terms of Service for Creators (https://nexfluence.eu/legal/creator-terms), whichever applies to you. They are the contract between you and Nexfluence.

3. Who this policy covers, and who is responsible

3.1 This policy covers:

1. people who use Nexfluence for a business ("business users");
2. creators, whether a business invited them or they applied themselves;
3. people who start signing up but do not finish, and people who filled in our earlier request-access form;
4. people who view a creator's public profile, or send an enquiry through it;
5. people who click a tracked link;
6. anyone who writes to us.

3.2 Who contracts with whom. A deal is a contract between a business and a creator. We are not one of the two sides, except as set out in 3.5. We run Nexfluence. We receive the money a business pays into its wallet and pass it on to our payment partner Abillio, which holds it in escrow and makes the payouts. We keep the record of each deal's money steps: what is reserved, released and paid. The accepted offer is the written record of the deal. Both sides can see it.

3.3 Creators a business adds to its roster. When a business adds a creator to its roster, it gives us the creator's name, email address, handles and follower counts.

1. The business decides to add the creator. It is responsible for having a lawful reason to share those details with us.
2. We use those details for our own purposes in section 5 (5.4, row 3): mainly to send the invitation, and to keep the roster on Nexfluence. For that use, we are responsible.
3. You can ask either us or the business about these details. The business and Nexfluence are each responsible for their own use of them.

3.4 Your data in the other side's hands. A business or creator may use information it received through Nexfluence for its own purposes outside Nexfluence. For example, a business sends a product to a creator's shipping address, or reposts a creator's content. For that use, the business or creator decides how to handle your data and is responsible for it, not Nexfluence. Please ask them directly (16.8).

3.5 When Nexfluence is the business. Nexfluence also runs campaigns itself, for brands we represent. In those deals, we are the business side of the deal, and we fund the deal ourselves; the payout goes through Abillio the same way. We are then also responsible for how we use the creator's data as a business does, for example to send a product or to repost content.

3.6 This policy does not cover brands' websites that you reach through a tracked link, the social media platforms where creators post, or Nexfluence's own pages on Instagram and LinkedIn, which our home page links to. Their own policies apply.

4. What we collect and where it comes from

We collect what you type in, what a business tells us about you, and a few things Nexfluence creates. We ask a creator for a shipping address and phone number only when a business sends them a product.

4.1 Everyone with an account

4.1.1 Email address. You give it to us. If a business invited you, the business gave it to us first.

4.1.2 Basic account details: whether you are a business user or a creator, your language (English or Latvian), and your display name.

4.1.3 Sign-in logs. We sign you in with a sign-in code sent to your email. There are no passwords. Our database provider keeps a log of each sign-in, including your IP address. Sign-in logs are kept for 30 days (9.18).

4.1.4 Unfinished sign-ups. When you ask for a sign-in code, our sign-in provider creates an account record for your email address before you enter the code.

1. For a creator application, that record also holds your application: name, handles, follower range, niche, and your choice about campaign-match emails.
2. For a business sign-up, it holds your email address and language.

If you never enter the code, the record stays until we remove it by hand, after the period in 9.10. So that your answers are still there if you open the code email in another browser, we also keep a copy of them, with your email address, for one hour (9.22).

4.1.5 Confirmation records. For creators, we record:

1. that you ticked the box about our Terms and this policy, when you ticked it, and which version label was recorded;
2. whether you ticked "Send me campaign matches by email", and when;
3. that you confirmed you are 18 or older.

For business users, we record which version of our Terms and this policy they agreed to at sign-up, and when. The sign-up form says that by clicking you agree to them, and we record it when you confirm the code sent to your email.

4.1.6 Email settings: whether you turned off reminder emails and, for businesses, whether you chose a daily summary.

4.1.7 Support requests: what you write to us, and our replies. This includes what a business types into the "What are you looking for?" box on the Find creators page. We keep those answers as support requests.

4.2 Business users

4.2.1 From you:

1. At sign-up: your work email, your business name, and roughly how many creators you work with.
2. When you set up your business profile: your business name, country, website, one-line pitch, where you sell, product categories and logo. You also give a contact person's name, an email address for notifications, and whether you want a daily summary.
3. Website suggestions. You can ask us to fill in your profile from your website. We then read that one public page, once. We suggest a business name, a one-line pitch and a logo. We save nothing from the page unless you keep a suggestion.
4. Your work on Nexfluence: brands, campaigns and briefs, offers, messages, feedback on content submitted for review, shipping notes and parcel tracking numbers, results you type in, and disputes.
5. Wallet and payouts: (a) your top-ups, with your top-up reference, as we record them when the money arrives in our account, before we pass it on to Abillio; (b) the amounts reserved, released and paid.
6. Sales reports. When you add a sales report, it is read inside your own browser. For each line, we save only the date, promo code, discount description, quantity and value, plus the file name. We do not keep the file itself. We do not keep any details about your shoppers.

4.2.2 From others. When you pay into your wallet by bank transfer, our bank shows us the payer's name, account number, amount and reference.

4.2.3 Created by Nexfluence. Nexfluence support approves each new business before it can use Nexfluence. We record the decision and when it was made.

4.2.4 Earlier request-access form. Businesses used to ask for access through a form, which we no longer use. If you used it, we hold your business name, email address, roughly how many creators you work with, your note, and the creator who referred you, if any. We keep these for the period in 9.11.

4.3 Creators

4.3.1 From you:

1. If you apply: your name, email address, Instagram, TikTok and LinkedIn handles, a follower range, your niche, and whether you want campaign matches by email.
2. Your profile: photo, display name, bio, niche, country, Instagram, TikTok and LinkedIn handles, and follower counts. Follower numbers you type in yourself are shown as "self-reported". If you connect an account (4.3.8), the number read from it is shown as "verified" instead. If you set a monthly earnings goal, we keep that too.
3. Shipping address and phone number, only when you accept a deal where the business sends you a product. We keep them on your profile, and copy them onto that deal.
4. Your deals:
   • (a) your answers to offers, and your counter-offers;
   • (b) messages and cancellation reasons;
   • (c) links to the content you submit for review (we keep only the link; the content stays wherever you stored it), and links to your live posts;
   • (d) the caption, the kind of post (content type) and the social media platform of each post;
   • (e) screenshots of post statistics;
   • (f) disputes.
5. Matches: whether you said yes or no to each campaign we suggested (5.5).
6. Deals you record with businesses outside Nexfluence: the business's name, amounts and dates. Only you and Nexfluence support can see these.
7. Profile choices: whether your public profile is on, and whether your results are shown on it.

4.3.2 From a business:

1. If a business invites you: your name, email address, handles and follower counts, as they appear on the business's list. We also keep the email address the invitation was sent to.
2. During a deal: results the business types in, or reads from its sales report using your promo code; your promo code; feedback on the content you submit for review; shipping notes and parcel tracking numbers.

4.3.3 Created by Nexfluence: if you applied yourself, the fact that you are on our waiting list until we decide, our decision on your application and when we made it; the web address of your public profile; the tracked link for each deal and its visit count; the status of each deal; the amounts owed, reserved, released and paid; and, in matches, how well each campaign may fit you and what you might earn (5.5). While you are on the waiting list, you can finish your profile, but businesses cannot see you and your public profile stays private.

4.3.4 Payouts. Payouts are made through our payment partner Abillio, which issues the invoice in the creator's name and takes care of the creator's tax. Once money is released, Abillio pays it to you, and we keep the record of each payout in the app. To be paid, you set up payouts with Abillio in the app (identity check and bank account, 4.3.5); the bank details go to Abillio, not to us or to the business. Please do not put bank details in a deal's message thread: if you do, they are stored with your messages.

4.3.5 Setting up payouts with Abillio. Abillio is a Latvian company that pays creators, issues invoices and handles tax reporting. You set up your payouts on Nexfluence, in one form ("Set up payouts"): your legal first and last name, date of birth, country, personal code, address and bank account number (IBAN), with the email address you sign in with. When you press "Create my payout account", our server sends these details to Abillio over an encrypted connection, at your request and in that same moment, so that Abillio can open your payout account. We do not store them, write them to any log or keep a copy: they exist on our side only while your request is being handled. Abillio then checks your identity through its identity partner Veriff: you show your ID document and your face to Veriff in a window on our page, and the document and photos go to Veriff and Abillio only; we never see them. Abillio uses all of this as a separate controller, under its own privacy policy, as the regulated company that pays you, checks your identity and the origin of payments (anti-money-laundering rules), issues invoices and reports tax (7.2(6)). From Abillio we receive and keep only its number for your account, whether your identity and bank account are verified, and the status of each payment. We show you the last four characters of your IBAN once, from Abillio's answer, and do not keep them.

4.3.6 Tax reporting details. The EU rules on platform reporting (DAC7, Council Directive (EU) 2021/514) may require us to collect from each creator their full name, main address, tax identification number and date of birth (more for a company), to check them, and to report them with your payouts to the State Revenue Service. We are confirming with our lawyer and accountant whether these rules apply to us. We do not collect these details today. When they apply, we collect and report what the law requires, and we will tell you before we ask for anything.

4.3.7 Sensitive information. We do not ask for sensitive information, such as details of your health, religion, sex life or sexual orientation. If you put it in your bio, niche or photo, it is shown where you choose to show it, because you made it public yourself (Art. 9(2)(e) GDPR). Please do not include details or images of children. We do not use photos to recognise faces or to identify people.

4.3.8 Connected accounts (optional). On your profile, under "Connected accounts", you can connect your Instagram, TikTok or YouTube account. You log in on the platform's own screen, and we never see your password. We only read: we never post, comment, send messages or change anything on your account. You can disconnect at any time (16.9).

1. Instagram, through Meta. When you press "Connect Instagram" and allow it on Instagram's own screen, Meta Platforms Ireland Limited ("Meta") gives us a key (an "access token") for your professional Instagram account (Creator or Business), with two permissions only: reading your profile and posts (instagram_business_basic) and reading their insights (instagram_business_manage_insights). With them we read:
   • (a) your Instagram account number, as Meta gives it to our app, your username, the account type, your follower count and how many posts you have;
   • (b) for your newest 20 posts: the type and date of each, and its views, reach, likes, comments, saves and shares;
   • (c) your audience as Instagram reports it: how many of your followers are in each country and city, and in each age range and gender. Instagram gives this only for accounts with 100 followers or more, and never says who the followers are.

We do not read your name, profile picture, captions, comments, messages, or anything about another account. What we keep: your username, the follower count, the average views and likes of those 20 posts, how many posts were read, and the audience as shares in percent (the top 5 countries, the top 3 cities, women, men and other, and the age ranges), each with the date it was read. The other post numbers are used for the averages and not stored. The key is stored encrypted, and only our server can read it. Why: so that businesses can see numbers that come from Instagram itself, marked "verified", instead of numbers you typed (5.4, row 22). How often: once when you connect, then every night for the follower count and the posts, and about once a week for the audience. Each night we also renew a key that is close to running out (Instagram's keys last about 60 days). A key that has stopped working is deleted, and we email you to connect again.

2. TikTok, through Phyllo. Phyllo opens TikTok's own login screen in a window on our page and reads for us your username, follower count, the views, likes and comments of your posts, and the audience TikTok reports (countries, cities, gender and age, as shares). We keep the same summary as for Instagram.
3. YouTube, through Phyllo, or by your handle. If you connect YouTube through Phyllo, we read and keep the same kind of summary for your channel. If you only type your YouTube handle and press "Read my numbers", we read your channel's public numbers (subscribers, total views, number of videos, and the views and likes of the newest 20 videos) from YouTube's public Data API. These are shown as "read from YouTube", not as verified. YouTube's Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (https://policies.google.com/privacy) apply to YouTube's part.
4. Instagram through Phyllo. Until Meta has approved our app for everyone, an Instagram account may also be connected through Phyllo. The card on your profile says which way it is connected.

4.4 Visitors, enquirers and people who click links

4.4.1 Public profile visitors. We place nothing on your device. If you use the "Work with me" form, we email your name, email address and message to the creator. We do not keep the message in our database. We keep only a record that an enquiry was sent to that creator, so that we can allow no more than five enquiries for each creator each hour. Our email provider keeps a copy of sent emails for 30 days, for delivery and troubleshooting.

4.4.2 People who click a tracked link: see section 10.

4.4.3 Technical data. When you open a page, our hosting provider handles your IP address (the number that identifies your internet connection), your browser details and the page you asked for. It needs these to show you the page and to protect Nexfluence. We also use IP addresses for a short time to stop too many requests coming from one place, for example to the website-suggestion feature. Server logs are kept for 30 days (9.18).

4.5 What you must give us, and what happens if you do not

4.5.1 You need an email address to have an account.

4.5.2 A creator must give their name. A shipping address and phone number are needed only for a deal where the business sends a product. Without them, you cannot accept that deal.

4.5.3 A business must give the details we ask for at sign-up and when it sets up its profile. We need them to decide whether to approve the business.

4.5.4 Everything else is optional, except the tax reporting details the law may require before you can be paid (4.3.6).

5. Why we use your data, and our legal grounds

We use your data only for the reasons in the table below, and each reason rests on a legal ground. Where the ground is our legitimate interest, you can object.

5.1 The law lets us use personal data only for a clear reason, and only on one of a few legal grounds. We use four:

1. Contract: we need the data to provide Nexfluence under our Terms with you.
2. Legitimate interest: we, or someone else, have a fair reason, and we have weighed it against your rights. You can object to it.
3. Legal obligation: a law requires it.
4. Consent: you said yes, and you can change your mind at any time.

5.2 What "Contract" means. In the table, "Contract" means our Terms with you. It does not mean the deal between a business and a creator, which we are not part of (except as set out in 3.5).

5.3 Business users. If you use Nexfluence for a business that is a company, our contract is with that business, not with you personally. So for you, wherever the table says "Contract", the ground is our legitimate interest in performing our contract with the business you represent (Art. 6(1)(f) GDPR). If you are a sole trader, the contract is with you (Art. 6(1)(b) GDPR).

5.4 The table shows each reason and its ground.

• #

  1

  Why

  Create your account and sign you in

  What data

  Email address, role, language, sign-in logs

  Legal ground

  Contract (Art. 6(1)(b) GDPR)

• #

  2

  Why

  Check a new business, or a creator who applied on their own, before they can use Nexfluence (the waiting list)

  What data

  Sign-up and business details; the creator's application and profile

  Legal ground

  Legitimate interest in protecting creators and Nexfluence from fake or abusive accounts (Art. 6(1)(f) GDPR)

• #

  3

  Why

  Let a business invite creators and keep its roster (3.3)

  What data

  Name, email address, handles and follower counts the business gives us; the email address the invitation was sent to

  Legal ground

  Legitimate interest of the business and of Nexfluence in managing the creators the business already works with (Art. 6(1)(f) GDPR). Once you accept the invitation: Contract (Art. 6(1)(b) GDPR)

• #

  4

  Why

  Run deals: offers, the accepted offer as the written record, messages, content review, shipping, results, verification, holding period, release and payouts. Show creators their earnings and monthly goal

  What data

  Deal, content, results and messages; shipping address and phone number for deals where a product is sent

  Legal ground

  Contract: our Terms with you (Art. 6(1)(b) GDPR)

• #

  5

  Why

  Keep the wallet and payout record on Nexfluence, and keep our own accounting records of fees and invoices for businesses and creators

  What data

  Wallet record, payouts, bank references, business details

  Legal ground

  Contract (Art. 6(1)(b) GDPR). Legal obligation to keep accounting records (Art. 6(1)(c) GDPR)

• #

  6

  Why

  Count visits on tracked links (section 10)

  What data

  Scrambled codes made from part of the visitor's IP address and browser details (10.2), the referring site's name, the time

  Legal ground

  Legitimate interest in measuring the results a deal pays on, with as little data as possible (Art. 6(1)(f) GDPR)

• #

  7

  Why

  Publish a creator's public profile (6.5)

  What data

  Photo, display name, niche, country, handles and follower counts, bio; one result only if you switch results on

  Legal ground

  Legitimate interest in helping creators be found for paid work (Art. 6(1)(f) GDPR). The profile is on when you join, and you can switch it off at any time (6.6)

• #

  8

  Why

  Suggest live campaigns that may fit a creator (matches), and tell the business when the creator says yes (5.5)

  What data

  Niche, follower counts, your yes or no; the brand's product categories

  Legal ground

  Legitimate interest in helping creators find work, and businesses find creators (Art. 6(1)(f) GDPR)

• #

  9

  Why

  Pass on "Work with me" enquiries

  What data

  The sender's name, email address and message

  Legal ground

  Legitimate interest in letting people contact a creator who has a public profile, at the sender's own request (Art. 6(1)(f) GDPR)

• #

  10

  Why

  Send service emails (13.1)

  What data

  Email address, name, language, deal details

  Legal ground

  Contract (Art. 6(1)(b) GDPR). For invitations to people without an account: legitimate interest (Art. 6(1)(f) GDPR)

• #

  11

  Why

  Send campaign-match emails and other marketing email (13.5). We send none yet

  What data

  Email address, name, language

  Legal ground

  Consent (Art. 6(1)(a) GDPR), given in a separate box that is not ticked in advance

• #

  12

  Why

  Answer support requests and other messages, including those sent to info@nexfluence.eu, and resolve disputes

  What data

  Messages, the sender's name and email address, evidence, deal records, support's notes

  Legal ground

  Contract (Art. 6(1)(b) GDPR). For people without an account who write to us: legitimate interest in answering them (Art. 6(1)(f) GDPR). Legitimate interest in being able to prove what happened if there is a legal claim (Art. 6(1)(f) GDPR)

• #

  13

  Why

  Keep the event log (section 11)

  What data

  Internal reference numbers, action types, numbers, times

  Legal ground

  Legitimate interest in security, an audit trail, evidence in disputes, and understanding use as totals (Art. 6(1)(f) GDPR)

• #

  14

  Why

  Improve Nexfluence, and learn which kinds of campaigns and content work, as totals across many creators

  What data

  Content type, caption, social media platform, results, event log

  Legal ground

  Legitimate interest in improving Nexfluence (Art. 6(1)(f) GDPR). We work only with combined data, and every result is about many creators, never one. You can object (see the box at the top)

• #

  15

  Why

  Protect Nexfluence: limit repeated requests, ignore visits from bots, and prevent abuse and spam

  What data

  IP address (used briefly, and never stored for tracked links), browser details, counts

  Legal ground

  Legitimate interest in security (Art. 6(1)(f) GDPR)

• #

  16

  Why

  Keep proof of your campaign-match email choice

  What data

  The choice, and when you made it

  Legal ground

  Legal obligation to be able to show consent (Art. 6(1)(c) and Art. 7(1) GDPR)

• #

  17

  Why

  Keep a record of which version of our Terms and this policy you were shown and confirmed

  What data

  Version label, time

  Legal ground

  Contract, for the Terms (Art. 6(1)(b) GDPR). Legitimate interest in proving what you were shown if there is a legal claim (Art. 6(1)(f) GDPR)

• #

  18

  Why

  Tax reporting, including DAC7 (Council Directive (EU) 2021/514), where it applies to us (4.3.6)

  What data

  Payout records; name, address, tax identification number and date of birth

  Legal ground

  Legal obligation (Art. 6(1)(c) GDPR)

• #

  19

  Why

  Not used

• #

  20

  Why

  Answer lawful requests from authorities and courts

  What data

  Whatever the request lawfully requires

  Legal ground

  Legal obligation (Art. 6(1)(c) GDPR)

• #

  21

  Why

  Count visits to our pages, and a few moments on them, with Google Analytics (7.1, 12.1)

  What data

  The page address without anything after the "?", the page you came from, the identifier in the _ga cookies, approximate location, device and browser type

  Legal ground

  Consent (Art. 6(1)(a) GDPR), given in the cookie bar. Storing and reading the cookies: consent under Art. 5(3) of the ePrivacy Directive. You can withdraw it at any time with the "Cookies" link

• #

  22

  Why

  Read the numbers of an account a creator connects, show them as "verified", and use them in matches and on the profile (4.3.8)

  What data

  Username, follower count, average views and likes of the newest posts, the audience as shares, the dates they were read; the encrypted key

  Legal ground

  Contract: you ask for it by connecting the account (Art. 6(1)(b) GDPR)

5.5 Matches. The matches screen shows a creator live campaigns from approved businesses, including businesses the creator has never worked with. To choose which campaigns to show, Nexfluence compares the words in the creator's niche with the product categories the brand chose. From this it works out how well each campaign may fit. It also estimates what the creator might earn, from their follower counts. This is a simple form of profiling. We use it only to suggest campaigns. It does not decide whether you get a deal: you and the business decide that. When you say yes to a campaign, we email your display name to that business.

5.6 Where we rely on legitimate interest, you can object (see the box at the top, and 16.1(6)). You can ask us for a summary of how we weighed our interests against yours.

5.7 We do not sell personal data. We do not use it for advertising, and we do not show advertising on Nexfluence.

6. Who can see what on Nexfluence

A business sees a creator's profile, and only its own deals with that creator. Only Nexfluence support sees every account.

6.1 What a business sees about a creator today

• About the creator

  Display name, handles, follower counts, bio, and whether the numbers are self-reported

  Does the business see it?

  Yes

  When

  While the creator is on its roster (including the "removed" list, 6.7), and in every deal and message with that creator

• About the creator

  From a connected account (4.3.8): the verified follower count, the average views and likes, and the audience as shares

  Does the business see it?

  Yes

  When

  Where the follower counts are shown. Never the key, never each post's own numbers, never who the followers are

• About the creator

  Photo

  Does the business see it?

  Yes

  When

  On the roster, in deals and in messages. Once the business removes the creator from its roster, it sees the creator's initials instead (6.7)

• About the creator

  Public profile page

  Does the business see it?

  Yes, and so can anyone with the link

  When

  While the profile is switched on (6.6)

• About the creator

  Email address

  Does the business see it?

  Not shown

  When

  Nexfluence never shows it. The business writes in the deal's message thread, and we email the creator. A business that invited the creator already has the email address it used for the invitation. That address stays in the business's roster record and in its data export

• About the creator

  Shipping address and phone number

  Does the business see it?

  Only on that deal

  When

  From when the creator gives them on a deal where the business sends a product. Today they stay visible to that business on that deal, also after delivery, until they are deleted (9.3). They are never shown on the roster

• About the creator

  Bank and tax details

  Does the business see it?

  Never

  When

  The creator's bank details go to Abillio when the creator sets up payouts, not to us or to the business (4.3.4, 4.3.5). A business never sees them

• About the creator

  Earnings from other businesses

  Does the business see it?

  Never

  When

  A business sees only its own deals

• About the creator

  Content and results

  Does the business see it?

  Only for its own deals

  When

  From when the content is submitted for review

• About the creator

  That a creator said yes to one of its live campaigns in matches

  Does the business see it?

  The creator's display name

  When

  By email to the business's notification address, even if the creator is not on its roster. It is not shown on Nexfluence's screens

6.2 What a creator sees about a business today

• About the business

  Brand name, logo and website

  Does the creator see it?

  Yes

  When

  The name from the invitation email onwards; the name, the logo and any website the business gave, in every deal

• About the business

  Brand logo, one-line pitch, product categories, and a live campaign's summary and standard offer

  Does the creator see it?

  Yes

  When

  In matches, for live campaigns of approved businesses, even if the creator has never worked with them

• About the business

  Campaign brief

  Does the creator see it?

  In part

  When

  A summary before the creator accepts; the full brief once they accept

• About the business

  Email addresses of the business's users, including its notification email

  Does the creator see it?

  Never

  When

  The creator writes in the deal's message thread

• About the business

  Wallet balance, budgets, the business's fees, other creators' deals

  Does the creator see it?

  Never

  When

  The creator sees only their own deal's terms and payouts, including the Nexfluence fee taken from their own payout

6.3 What both sides of a deal see:

1. the accepted offer: pay model, amounts, what is measured, any cap, the campaign brief, the release condition and the holding period;
2. the messages in the deal's thread;
3. in a dispute: the reason, details and evidence links, and Nexfluence support's written decision.

6.4 Nothing from one deal is shown in another deal.

6.5 Public profile. (6.5 and 6.6 speak to creators.) Your public profile is at an address like nexfluence.eu/c/your-name. Anyone with the link can see:

1. your photo, display name, niche and country;
2. your Instagram, TikTok and LinkedIn handles, and your follower counts, marked "verified" when they come from a connected account (4.3.8), and then one line about your audience, for example "Audience: 62% Latvia · 71% women · mostly 25–34", with its breakdown;
3. a short bio;
4. your best result, but only if you choose to show it. Results are hidden unless you switch them on. They never include sales amounts.

While your profile is on, search engines may list it, unless you switch off "Let search engines find my profile" (6.6). A private profile is never listed.

6.6 Switching your public profile on and off. Your public profile is switched on when you join. If you applied yourself, it stays private until we approve you. You can switch it off at any time in your profile, with "Show my profile to brands". When it is off, only your display name and a note that the profile is private remain, and you stop receiving "Work with me" enquiries. A second switch, "Let search engines find my profile", is also on when you join. When you switch it off, we ask search engines not to list your page; the link still works for anyone who has it. A change can take up to five minutes to show. We are confirming with our lawyer whether profiles should start switched off; until then, they start on, and switching off takes one press.

6.7 Removing a creator from a roster. Today, if a business removes a creator, the creator stays visible to that business in a "removed" list, with initials instead of the photo, so that the business can invite them again. The records of past deals stay, because both sides need them. A creator cannot yet leave a roster from the app. Until they can, write to info@nexfluence.eu and we remove you from that roster by hand, once you have no open deal with that business.

6.8 Not used.

6.9 Nexfluence support. Only Nexfluence support can see all accounts. Support uses this access to approve businesses, answer requests and resolve disputes.

6.10 For business users. Our Terms describe the data that business users and creators can access on Nexfluence. Sections 6.1 to 6.9 give the same information. Your live campaigns are shown to creators in matches, including creators who are not on your roster (6.2).

7. Service providers and other recipients

7.1 Service providers. These companies handle personal data for us, only on our instructions, under written agreements (data processing agreements).

• Provider

  Supabase, Inc. (Delaware, USA)

  What it does for us

  Database, file storage (photos, logos, screenshots) and sign-in

  Where the data is

  EEA: Ireland (EU region). Supabase, Inc. is a US company, so its staff may reach the data from outside the EEA, for example to give support

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

• Provider

  Vercel Inc. (Delaware, USA)

  What it does for us

  Hosting the website, and running our server functions and scheduled jobs

  Where the data is

  Functions run in Dublin, Ireland. Vercel also has servers around the world that help pages load faster. Your request may pass through the one nearest to you, which can be outside the EEA. That server sees your IP address and the page you asked for

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

• Provider

  Google Ireland Limited (Dublin, Ireland): Google Analytics 4

  What it does for us

  Counting visits to our pages, and a few moments on them (for example a form sent, or the switch between business and creator on the home page), so we know what is used. Only if you accept analytics cookies in the cookie bar (12.1). Advertising features, Google signals and data sharing for advertising are off

  Where the data is

  For each visit: the page address without anything after the "?", the page you came from, a random identifier kept in the cookies _ga and _ga_… (12.1), your approximate location (country and city, which Google works out from your IP address; Google says it does not keep the IP address itself), and your type of device, browser, operating system and screen. The moments we count carry no names, emails or other details about you. Nothing is sent from sign-in, invitation or short-link pages. Google keeps the data for 2 months. Google Ireland works for us; its parent Google LLC (USA) processes the data for it as a sub-processor

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

• Provider

  Resend (Plus Five Five, Inc., San Francisco, USA)

  What it does for us

  Sending our emails, including sign-in codes. It keeps copies of sent emails for 30 days

  Where the data is

  Sending region: the EU, where configured

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

• Provider

  Spacemail (Namecheap, Inc., Phoenix, Arizona, USA)

  What it does for us

  The mailbox info@nexfluence.eu, which receives support mail and replies to our emails

  Where the data is

  Namecheap's data centres, which can be outside the EEA

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

• Provider

  Phyllo (also called InsightIQ), USA

  What it does for us

  Connecting a creator's TikTok, YouTube or Instagram account on the platform's own screen, and reading its numbers and audience for us (4.3.8)

  Where the data is

  Outside the EEA (USA). Phyllo passes the numbers to us; we keep only the summary described in 4.3.8

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

• Provider

  Anthropic, PBC (San Francisco, USA)

  What it does for us

  Two helpers for businesses: one on the new-campaign page, which turns a few lines a business types into a filled-in campaign form, and one in the "Add creators" box, which suggests which column of a pasted list is which. Email addresses, phone numbers, handles and links are masked before anything is sent; for a pasted list, only the column headings and masked samples are sent, never a creator's name or email address

  Where the data is

  USA

  Protection for any transfer outside the EEA

  The EU–US Data Privacy Framework where the provider is certified, otherwise the EU Standard Contractual Clauses

7.2 Other recipients:

1. The other side of a deal, and the public, as described in section 6.
2. Our bank, which receives businesses' top-ups and sends them on to Abillio (2.1(11)). The bank decides for itself how it uses this data, under its own privacy policy.
3. Our professional advisers (accountants, auditors, lawyers), who must keep it confidential.
4. Authorities, such as the State Revenue Service (Valsts ieņēmumu dienests), courts, the police or the Data State Inspectorate, when the law requires it. Where the DAC7 rules apply to us (4.3.6), the State Revenue Service shares our reports with the tax authorities of other EU countries.
5. A buyer or successor, if our business is sold or reorganised. The data would stay under the protections in this policy.
6. Abillio (Kooperatīvā sabiedrība "Abillio Services", Rīga, Latvia, and abillio OÜ, Estonia; both in the EEA), our payment partner, as a separate controller (4.3.4, 4.3.5). We pass businesses' top-ups on to Abillio, which holds them in escrow for the businesses' deals and makes the payouts. When you fill in "Set up payouts" and press "Create my payout account", we pass your legal name, date of birth, country, personal code, address, bank account number and sign-in email to Abillio, at your request, so that Abillio can open your payout account (Art. 6(1)(b) GDPR: steps you ask for so that you can be paid). From then on Abillio decides how it uses them, under its own privacy policy and the law that applies to it as the company that pays you: identity checks through its partner Veriff, anti-money-laundering checks, invoices and tax reporting, and how long it must keep them. We keep none of these details (4.3.5). For each payout, we tell Abillio the amount and the deal it is for, so that it can pay you and issue the invoice in your name.
7. Meta (Meta Platforms Ireland Limited, Dublin, Ireland), Instagram's company, as a separate controller, when you connect Instagram directly (4.3.8(1)). Every read sends Meta the key you gave us, so Meta knows that Nexfluence reads your account. Meta tells us when you remove Nexfluence in Instagram's settings or ask for your data to be deleted (16.9). Meta's own privacy policy applies to what Meta does. We send Meta nothing else about you.
8. Google, for YouTube's public numbers (4.3.8(3)): the handle you typed is sent to YouTube's Data API. Google's Privacy Policy applies to Google's part.

7.3 Before a new service provider receives personal data, we will update this policy and give notice as set out in 19.2. An example would be a card payment provider, which we do not use today.

7.4 Translation. We use Google's Gemini service to machine-translate the fixed text of Nexfluence's screens from English into Latvian, Lithuanian, Estonian and Russian. We send it only the interface text we write ourselves, never personal data or anything you type.

8. Transfers outside the European Economic Area

8.1 We keep our database and files in the EEA (Ireland).

8.2 Some of our providers belong to companies based outside the EEA, mainly in the United States. Those companies, and their support staff, may be able to reach data from outside the EEA. When you open a page, your request may also pass through one of our hosting provider's servers outside the EEA (7.1).

8.3 When personal data leaves the EEA, we use one of these protections. For Supabase, Vercel, Resend, Google, Spacemail, Phyllo and Anthropic, we rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses:

1. a decision by the European Commission that the country protects data well enough. For US companies, this covers those certified under the EU–US Data Privacy Framework;
2. a standard contract approved by the European Commission (the "Standard Contractual Clauses").

8.4 You can ask us for a copy of these protections at info@nexfluence.eu.

9. How long we keep data

We keep data only as long as we need it. Some deal and payment records must be kept for the period Latvian law sets, even after you delete your account.

9.1 The table below shows how long we keep each kind of data. Where a period ends, we delete the data by hand: we have not yet automated these deletions, and we check for data that is due at least once a month. Where a row says "on request", write to info@nexfluence.eu and we delete it within one month (16.2).

• #

  9.2

  Data

  Account and profile data

  How long

  While your account is open. For what happens when you delete it, see 16.3 to 16.5

• #

  9.3

  Data

  Shipping address and phone number

  How long

  On the deal: 90 days after the product is delivered. On your profile: until you change them or delete your account, or earlier on request

• #

  9.4

  Data

  Screenshots of post statistics

  How long

  12 months after the campaign ends

• #

  9.5

  Data

  Deal and money records: accepted offers, results, payouts, wallet record, fee records, invoices

  How long

  5 years from the end of the year of the transaction, as the Latvian Accounting Law requires, or longer where a tax law requires it

• #

  9.6

  Data

  Messages, content links, captions, disputes, support's notes

  How long

  5 years from the end of the year in which the deal ended, the same as the deal record, so that either side can prove what was agreed and delivered

• #

  9.7

  Data

  Event log

  How long

  5 years after the related deal or account is closed. Then deleted, or turned into totals with no reference numbers (11.5)

• #

  9.8

  Data

  Tracked-link visit records

  How long

  12 months after the deal ends. The visit counts that became results stay with the deal record (9.5)

• #

  9.9

  Data

  Creator details from an invitation that was never accepted

  How long

  While the business keeps the creator on its roster. The invitation link itself expires after 14 days. The creator can ask us to delete the details at any time; we then delete them and tell the business

• #

  9.10

  Data

  Unfinished sign-ups (4.1.4)

  How long

  30 days

• #

  9.11

  Data

  Business sign-ups never approved, creator applications we decline, and earlier request-access forms

  How long

  12 months after our decision or your last message

• #

  9.12

  Data

  Support requests, including "Find creators" answers

  How long

  2 years after the request is closed. A request that is part of a dispute is kept as long as the dispute (9.6)

• #

  9.13

  Data

  Confirmation records (4.1.5)

  How long

  While your account exists, and 5 years after it is deleted, without your name, so we can show what you agreed to (16.5(d))

• #

  9.14

  Data

  Record that a "Work with me" enquiry was sent

  How long

  30 days. The message itself is not kept in our database

• #

  9.15

  Data

  Copies of emails kept by our email provider

  How long

  30 days

• #

  9.16

  Data

  Photos

  How long

  Until you replace them or delete your account. Deleting a creator account removes the photo file from storage. For business logos, see 16.3(2)

• #

  9.17

  Data

  Monthly goal, matches answers, profile choices and email settings

  How long

  While your account is open

• #

  9.18

  Data

  Sign-in logs and server logs

  How long

  30 days

• #

  9.19

  Data

  Database backups

  How long

  Up to 7 days, then overwritten

• #

  9.20

  Data

  Payout set-up details (4.3.5)

  How long

  We do not keep them: they go to Abillio when you press "Create my payout account". Abillio's number for your payout account and the status of each payment stay with the payout records (9.5)

• #

  9.21

  Data

  Tax reporting details and reports, where the DAC7 rules apply to us (4.3.6)

  How long

  The period Latvian law sets for these records, which is at least 5 years

• #

  9.22

  Data

  The copy of your sign-up answers kept for the code email (4.1.4)

  How long

  1 hour, then deleted automatically

• #

  9.24

  Data

  The key (access token) of a connected account (4.3.8)

  How long

  Until you disconnect, remove Nexfluence in the platform's settings, delete your account, or the key stops working. Then it is deleted at once

• #

  9.25

  Data

  Numbers and audience read from a connected account

  How long

  While connected, renewed each night. After you disconnect, the last numbers stay on your profile with the date they were read, until you ask us to delete them, ask Instagram to have them deleted, or delete your account (16.9). Then they are deleted at once

9.23 Where a period comes from law, we keep the records with your identity, but only the people who need them can see them. We delete them when the period ends.

10. Tracked links

A tracked link counts visits without cookies and without storing IP addresses. We keep only scrambled codes, made with a value that changes every day.

10.1 Each deal can have one tracked link. This is a short web address, such as go.nexfluence.eu/k3x9. The creator shares it so that visits can be counted.

10.2 When someone opens the link, we do three things:

1. We shorten the visitor's IP address. For an IPv4 address, we keep the first three of its four blocks. For an IPv6 address, we keep the first three of its eight groups. We combine the result with a value that changes every day, and turn it into a one-way code (a "hash").
2. We do the same with the browser's identification string.
3. We note the name of the website the click came from (the site name only, never the full address), and the time.

10.3 We store only the two codes, the site name, the time and which link was opened. We never store the IP address itself. The daily value is made from the date and a secret key that only our server holds. Only someone with that key could work back from a code to a shortened address. We do not do this.

10.4 Purpose. We count a visit at most once in any 24 hours from the same shortened address and browser, and we ignore known bots. That way a creator paid for each click is paid fairly, and a business is not charged for fake clicks. The business and the creator see visit counts, never the codes.

10.5 Nothing on your device. We place nothing on the visitor's device: no cookie, and no similar storage.

10.6 We then send the visitor on to the web address the business gave for the deal. We add nothing to it, although it may contain the business's own tags. From that point, the brand's own privacy policy applies.

10.7 Legal ground: legitimate interest (5.4, row 6). Kept for: the period in 9.8.

10.8 You can object by writing to us. The codes do not tell us who you are, so we may not be able to find your visits (Art. 11 GDPR).

11. The event log

11.1 Most important actions on Nexfluence add one line to an internal record, the event log. Examples: an offer sent, a deal accepted, content approved, a result recorded, a payout marked paid, an account deleted.

11.2 Each line holds only:

1. the internal reference number of the account that acted;
2. the type of action, from a fixed list;
3. the type and internal reference number of the record concerned;
4. numbers, such as amounts;
5. the time.

We write only these. The system also refuses any field named as an email, name, address, phone or IP address.

11.3 The log is not shown on any Nexfluence page. Nexfluence support may look at it to resolve disputes and investigate problems.

11.4 We use it for security, as an audit trail, as evidence in disputes, and to understand how Nexfluence is used, as totals rather than about individual people.

11.5 How long. We keep each line for 5 years after the related deal or account is closed. Then we delete it, or turn it into totals with no reference numbers. Until then, the lines are "pseudonymised". This means they hold no name, but they can still be linked to you through the reference numbers, because the deal records are kept too (9.5). When your account is deleted, the link from each line to your account is removed when your sign-in account is removed, which we do by hand within 30 days (16.3(3), 16.4(4)).

11.6 The export file in settings does not include the event log. You can ask us for the lines about your account (16.1(1)).

12. Cookies and similar storage

12.1 A cookie is a small file a website stores in your browser. We use the cookies Nexfluence needs to work, one that remembers your language, and, only if you say yes, the Google Analytics cookies that count visits (7.1). We use no advertising or social media cookies, and we load no advertising or social media tracking scripts. The first time you open Nexfluence, a bar at the bottom of the screen asks whether we may use analytics cookies. "Accept" and "Decline" are side by side and equally easy. Until you accept, the Google Analytics script is not loaded and nothing is sent to Google. If you decline, nothing is sent. We remember your choice in your browser for 6 months, then ask again. You can change your mind at any time with the "Cookies" link at the bottom of our home page and of every legal page. If you withdraw consent, we stop counting and delete the Google Analytics cookies. Nothing is sent to Google from the sign-in, invitation or short-link pages, and no page address is sent with anything after the "?". Our fonts are served from our own site. Tracked links store nothing on your device.

• Name

  sb-…-auth-token (may be split into several parts)

  What it does

  Keeps you signed in

  How long it lasts

  Until you sign out, or up to 400 days, the longest a browser keeps a cookie

• Name

  lang

  What it does

  Remembers whether you chose English or Latvian. It is set only when you choose a language

  How long it lasts

  1 year

• Name

  nx_signup

  What it does

  Carries the business name, and roughly how many creators you work with, as you typed them at sign-up, to the next screen

  How long it lasts

  Up to 1 hour; deleted once used

• Name

  nx_creator_signup

  What it does

  Holds your creator application (email address, name, handles, follower range, niche and campaign-match email choice) until you enter your sign-in code. Until then, our sign-in provider also holds the application on an unconfirmed account (4.1.4)

  How long it lasts

  Up to 1 hour

• Name

  nx.apply.draft (browser session storage, not a cookie)

  What it does

  Keeps what you typed into the creator application (name, email address, handles and niche) if you change the language of the page. Tick boxes are never kept

  How long it lasts

  Until you close the tab, or until you send the application

• Name

  nx_campaign_kept and nx_campaign_suggested

  What it does

  For business users: keep what you typed into a campaign form, and what the campaign helper suggested, if saving is refused, so that you do not have to type it again. They hold campaign fields only

  How long it lasts

  Up to 10 minutes; deleted when the form is saved

• Name

  _ga

  What it does

  Google Analytics: tells one browser's visits apart, with a random number. Set only after you accept

  How long it lasts

  13 months

• Name

  _ga_… (ends with our Google Analytics id)

  What it does

  Google Analytics: keeps track of the current visit. Set only after you accept

  How long it lasts

  13 months

• Name

  nx.analytics.consent (browser local storage, not a cookie)

  What it does

  Remembers whether you accepted or declined analytics cookies, and when

  How long it lasts

  6 months, then we ask again

12.2 Only our server can read the two sign-up cookies and the two campaign-form cookies, and they are sent only over secure connections. Our server checks every value again when it reads them.

12.3 We ask for consent only for the Google Analytics cookies. All the others are needed for Nexfluence to work, or you asked for them, so the cookie bar does not ask about them.

13. Emails we send

13.1 Service emails. We send these from no-reply@nexfluence.eu, in your language:

1. sign-in codes;
2. invitations (13.3);
3. deal updates, such as offers, acceptances, funds reserved, content submitted for review, approvals and payouts;
4. reminders, sent at 11:00 Riga time;
5. a daily summary, for businesses that chose one;
6. to a business: a note when a creator says yes to one of its live campaigns in matches.

You cannot switch off 1, 2, 3 and 6 while you have an account.

13.2 Switching emails off.

1. Reminders: use the link at the foot of any reminder. Nothing on screen turns them back on today, so write to us if you want them again.
2. Daily summary: you choose it when you set up your business profile. To change it later, write to us.

There is no email section in settings yet.

13.3 Invitations. When a business invites you, we send you an invitation email. The business may send it again, for example when it adds you back after removing you. The invitation names the business that added you. The screen where you then set up your account links to this policy before you agree to anything. This policy says which details a business gives us (3.3, 4.3.2), how you can object (16.1(6)) and how to have them deleted (9.9). The invitation contains only the business's invitation, and no advertising for Nexfluence. The invitation link expires after 14 days.

13.4 Replies. Replies to our emails go to our support mailbox (7.1).

13.5 Campaign-match and marketing email. We do not send marketing email today.

1. When creators apply or set up their profile, they can tick a box: "Send me campaign matches by email". The box is not ticked in advance. We record the choice (4.1.5). We do not send these emails yet.
2. Business users are not asked, and we send them no marketing email.
3. When we start, every such email will have an unsubscribe link. Until then, write to info@nexfluence.eu to change your choice.
4. Your choice applies from the moment you make it. Emails we sent before then were still sent lawfully.

13.6 No tracking. We do not use tracking pixels, and we do not track whether you open our emails or click their links.

14. Automatic decisions

A few deal rules run automatically. You can always ask a person to review the result.

14.1 A computer does not make important decisions about you on its own, except in the cases in 14.2. "Important" means a decision with a legal effect on you, or a similarly large effect.

14.2 Nexfluence applies these rules automatically, because they are needed to carry out the deal (Art. 22(2)(a) GDPR). Some come from the accepted offer. Others come from our Terms.

1. The first result recorded on a deal verifies it, and starts the holding period (0 to 30 days, set for each campaign).
2. Once the holding period ends, the money is released overnight. This means it becomes due to the creator. The business can release it earlier. Abillio then pays it out to the creator (4.3.4).
3. Visits from known bots, and repeat visits from the same shortened address and browser within 24 hours, are not counted. This affects deals paid for each click.
4. If a business has not set the money aside 7 days after a creator accepts its offer, the acceptance lapses, and the creator is told.

14.3 You can challenge any of these results by raising a dispute on the deal, or by writing to support. A person will review it, and you can explain your side.

14.4 A person, not a computer, decides whether to approve a new business, or a creator who applied on their own. Matches suggestions are made automatically, but they do not decide anything about you (5.5).

15. Security

15.1 Rules in the database itself make sure that each business sees only its own data, and each creator only theirs.

15.2 You sign in with a sign-in code. We store no passwords.

15.3 For invitation links, we store only a one-way code (a hash) of the secret part of the link, never the link itself.

15.4 For tracked links, IP addresses are never stored (section 10). The event log refuses fields named as personal details (11.2).

15.5 Only Nexfluence support staff can see all accounts. Support access is given by name, only to the people who need it; today that is our founder.

15.6 A personal data breach is a security problem that lets personal data be lost, changed or seen by someone who should not see it. If one happens, we will tell the Data State Inspectorate without undue delay, and where possible within 72 hours, when the law requires it. If it is likely to put you at high risk, we will also tell you without undue delay.

16. Your rights and how to use them

You can see, correct, delete and take a copy of your data, and object to some uses. Business users can do some of this in settings, and creators in their profile. Anyone can write to us.

16.1 Your rights:

• #

  (1)

  Your right

  Access

  What it means

  Get a copy of the personal data we hold about you

  How to use it

  Business users: Settings → Export my data. The file holds your account and business details, brands, roster, campaigns, deals, sales reports, payouts, wallet record and support requests. It does not hold messages, content and review notes, results, disputes, tracked links or shipping details. Write to info@nexfluence.eu for those. Creators: in your profile, "Your data" → "Download my data". The file (JSON) holds your creator record, profile, roster entries, deals, payouts, campaign answers and support requests. For anything else, such as messages, write to info@nexfluence.eu. Anyone: ask by email for the event log lines about your account

• #

  (2)

  Your right

  Correction

  What it means

  Have wrong data fixed

  How to use it

  Edit your profile in Nexfluence, or write to us. If a result the other side entered is wrong, raise it in the deal's thread or open a dispute

• #

  (3)

  Your right

  Deletion

  What it means

  Have your data deleted

  How to use it

  Business users: Settings → Delete account (16.3). Creators: in your profile, "Your data" → "Delete my account" (16.4)

• #

  (4)

  Your right

  Restriction

  What it means

  Have us pause use of your data while a question is settled

  How to use it

  Write to us

• #

  (5)

  Your right

  Portability

  What it means

  Receive your data in a common file format that a computer can read, so you can take it elsewhere

  How to use it

  Business users: the export file in settings. Creators: the "Download my data" file in your profile, in JSON

• #

  (6)

  Your right

  Objection

  What it means

  Object to uses based on legitimate interest. You can object to marketing at any time, and we will then stop

  How to use it

  Write to us (see the box at the top)

• #

  (7)

  Your right

  Withdraw consent

  What it means

  Stop campaign-match or marketing email

  How to use it

  Write to info@nexfluence.eu. Once we send such emails, you can also use the unsubscribe link in each one

• #

  (8)

  Your right

  Complain

  What it means

  Complain to a data protection authority

  How to use it

  Section 17

16.2 Timing and cost. We answer within one month. If a request is complex, we may extend this by up to two further months, and we will tell you why. Using your rights is free.

16.3 Deleting a business user account today (Settings → Delete account):

1. Your user profile is cleared at once, and your link to the business is removed.
2. Your business account is closed (archived). The business record keeps its name, website and logo, and the contact person's name and notification email address, for the period in 9.5, because the deal and money records refer to it. You can ask us to remove the contact person's name and email address sooner; we do it by hand within one month, unless a record we must keep needs them.
3. Your sign-in account, which holds your email address, is removed by hand within 30 days. Until then, the event log still links to it (11.5).
4. Deletion is refused while a business you would close still has creator money set aside, or owes creators money. Settle those deals first, or write to us.

16.4 Deleting a creator account today (your profile → "Your data" → "Delete my account"):

1. Deletion is refused while money is set aside for you or owed to you on a deal.
2. We remove at once your photo file, name, bio, niche, country, handles, follower counts, address, phone number and promo code. Your public profile becomes private. An Instagram you connected directly is disconnected first: its key and every number read from it are deleted (16.9). An account connected through Phyllo is not yet disconnected automatically when you delete your account: we end that connection, and delete what was read from it, by hand within one month. To end it at once, press "Disconnect" before you delete (16.9).
3. Your deal, payout, roster and message records stay, with your name taken off (16.5).
4. Your sign-in account, which holds your email address, is removed by hand within 30 days. Until then, the event log still links to it (11.5).

16.5 What we delete and what we keep, for everyone:

• (a) What we delete: your contact details, photo, bio and shipping address, subject to 9.3 and to (b) to (d) below.
• (b) What we keep with your identity, seen only by people who need it: records the law requires us to keep, such as accounting and tax records (Art. 6(1)(c) and Art. 17(3)(b) GDPR), and evidence we need for a legal claim, such as dispute records (Art. 17(3)(e) GDPR). We keep them for the periods in section 9, then delete them.
• (c) What we keep without your name: captions and content types, for the analysis in 5.4, row 14. Links to live posts, and handles inside captions, point to your public posts, so these records can still be linked to you.
• (d) Confirmation records: kept without your name, for 5 years after your account is deleted (9.13).

We do not call this "anonymised", because some of what we keep could still be linked to you.

16.6 Identity check. We may ask you to confirm your identity, usually by sending a code to the email address on your account.

16.7 Limits. We may keep data that the law requires us to keep, or that we need to make or answer a legal claim. We will tell you what we kept and why.

16.8 Data the other side holds. If the other side of a deal copied your data out of Nexfluence, they are responsible for that copy. For example, a business that sent you a product has your shipping address in its own systems. Please ask them directly. For roster details that a business gave us, you can ask either of us (3.3).

16.9 Disconnecting a connected account, and deleting what we read (4.3.8):

1. Disconnect on Nexfluence. On your profile, under "Connected accounts", press "Disconnect". We stop reading at once and delete the key. The last numbers stay on your profile, marked with the date they were read, until you ask us to delete them (item 4).
2. Remove Nexfluence in Instagram. In Instagram's settings, under the apps and websites you allowed, remove Nexfluence. Meta tells us (at https://nexfluence.eu/api/connect/instagram/deauthorize), and we do the same as in item 1.
3. Ask Instagram to delete your data. If you also ask there for your data to be deleted, Meta tells us (at https://nexfluence.eu/api/connect/instagram/deletion). We then delete at once the key, your username, the follower count, the averages, the audience and the verified mark that came from Instagram, and give Meta a confirmation code. The page https://nexfluence.eu/privacy/data-deletion shows the code and what was deleted.
4. Write to us. Write to info@nexfluence.eu from the address you sign in with. We delete what we read from your connected accounts within one month (16.2) and tell you when it is done.

We keep only a note that an account was connected and when it was disconnected, without any numbers (section 11), and your deals and payouts, as section 9 says.

17. Complaints

17.1 Please write to us first at info@nexfluence.eu. We will try to put things right.

17.2 You have the right to complain to the Latvian data protection authority:

Datu valsts inspekcija (Data State Inspectorate)Elijas iela 17, Rīga, LV-1050, Latviawww.dvi.gov.lv · pasts@dvi.gov.lv

17.3 You can also complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. You can go to court as well.

18. Children

18.1 Nexfluence is for adults. Under our Terms, creators must be 18 or older. Creators confirm that they are 18 or older when they apply or when they join from an invitation. People using a business account must be adults acting for that business.

18.2 We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close their account. We will delete their personal data, except what the law requires us to keep.

18.3 If you believe someone under 18 is using Nexfluence, write to info@nexfluence.eu.

19. Changes to this policy

19.1 Each version of this policy has a version number and a date. Earlier versions are available on request at info@nexfluence.eu.

19.2 Important changes. We will tell you about an important change by email and on Nexfluence at least 15 days before it takes effect. Important changes include:

1. a new purpose;
2. a new kind of company or person who receives your data;
3. a new service provider outside the EEA;
4. keeping data for longer;
5. showing a new kind of information about creators on their public profiles;
6. showing creators to businesses that do not have them on their roster, for example in a "Find creators" search. Being findable will be the creator's choice;
7. sharing with businesses what we learn from the analysis in 5.4, row 14.

If a change needs time to adjust, we give 30 days' notice instead.

19.3 Recording which version you saw. Nexfluence records which version label you were shown when you agreed at sign-up. When this policy changes, we tell you as 19.2 says, and the new version applies from the date in that notice. Where a change needs your consent, we ask for it as 19.4 says.

19.4 If a change requires your consent, we will ask for it separately. We will not apply that change to you until you give it.

19.5 We may correct small errors, such as typos or contact details, without notice. When we do, we update the version label.

20. Version

• Version

  1

  Date

  24 September 2026

  What changed

  First version

• Version

  2

  Date

  18 October 2026

  What changed

  In force. Connected accounts: Instagram through Meta, TikTok and YouTube through Phyllo, YouTube's public numbers (4.3.8, 5.4 row 22, 6.1, 6.5, 7.1, 7.2(7) and (8), 9.24, 9.25, 16.4, 16.9). One contact address, info@nexfluence.eu. Payouts through Abillio and the money flow (2.1, 3.2, 4.3.4, 4.3.5, 7.2(2) and (6), 9.20), retention periods (section 9), service providers (7.1)

SIA "Nexfluence" · Brīvības gatve 300-9, Rīga, LV-1006, Latvia · info@nexfluence.eu