Privacy Policy

1. Data Controller

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, profile information, and authentication credentials.
• Usage data: pages visited, actions taken within the Platform, timestamps, and session information.
• Connected account data: when you connect third-party platforms (e.g., Meta, Google, TikTok), we receive access tokens and data from those platforms as authorized by you.
• Content data: creative assets, briefs, scripts, and other content you upload or create within the Platform.
• Communication data: messages and requests you send to us.
• Technical data: IP address, browser type, device identifiers, and log data.

3. How We Use Your Data

We use the data we collect to:

• Provide, operate, and improve the Platform and its features.
• Authenticate your identity and manage your account.
• Process and display your creative content and campaign data.
• Connect to and retrieve data from third-party advertising platforms on your behalf.
• Send transactional communications (e.g., notifications, account updates).
• Monitor and analyse usage to improve performance and user experience.
• Comply with legal obligations and enforce our Terms of Service.

4. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6):

• Contractual necessity: to provide the Platform services you have requested.
• Legitimate interests: to maintain security, improve our services, and prevent fraud.
• Legal obligation: to comply with applicable laws and regulations.
• Consent: where we have obtained your explicit consent (e.g., connecting third-party accounts).

5. Third-Party Services and Data Sharing

We integrate with the following third-party services to deliver Platform functionality. Your data may be shared with these services as necessary:

• Meta (Facebook/Instagram): for advertising account integration and campaign data retrieval.
• Google: for advertising and analytics integrations.
• TikTok: for advertising account integration.
• Klaviyo: for email marketing integrations.
• Supabase: for secure data storage and authentication.
• Vercel: for platform hosting and infrastructure.
• Stripe: for payment processing.

We do not sell your personal data to third parties. We may disclose your data when required by law or to protect the rights, property, or safety of Nordic Creatives, our users, or others.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide Platform services. We may retain certain data for longer periods where required by law or for legitimate business purposes such as dispute resolution and fraud prevention. When data is no longer needed, it is deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

8. International Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our third-party service providers operate. Where such transfers occur, we ensure appropriate safeguards are in place in accordance with GDPR requirements, such as Standard Contractual Clauses.

9. Your Rights

Under applicable data protection law (including GDPR), you have the following rights:

• Right of access: to obtain a copy of your personal data.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to restrict processing of your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: at any time where processing is based on consent.

To exercise any of these rights, contact us at info@nordcreatives.com. You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at datatilsynet.dk.

10. Cookies and Tracking

The Platform uses cookies and similar technologies for authentication, session management, and usage analytics. Essential cookies are required for the Platform to function. Analytics cookies help us understand how the Platform is used and improve it. You can manage cookie preferences through your browser settings, though disabling essential cookies may affect Platform functionality.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: