Privacy Policy

1. Introduction

Nixar, Lda. ("Nixar", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (nixar.ai), use our Shopify App, or use our web applications for Brands and Creators (collectively, the "Services").

We are a company registered in Portugal with the following details:
Entity Name: Nixar, Lda.
Address: Avenida da Liberdade UPTEC Mar s/n, Matosinhos e Leça da Palmeira, 4450-718 Matosinhos, Portugal.

2. Information We Collect

2.1. Information from Shopify Merchants

When you install our App via Shopify, we automatically collect certain information from your Shopify account, including:

• Shop Information: Shop name, email, domain, and settings.
• Product Data: Product titles, descriptions, images, and inventory levels.
• Order Data: Order details necessary for attribution and commission calculations.
• Customer Data: Limited customer details (e.g., location, order history) strictly for the purpose of campaign attribution and marketing, as authorized by your shop settings.

2.2. Information from Users (Brands & Creators)

We collect personal information that you voluntarily provide to us both when you register for the Services and when you contact us or request a demo through the forms on our website (for example, our lead-capture and demo-request forms, where only an email address is required and every other field is optional). This includes:

• Name, email address, and phone number.
• Business information and billing details.
• Information about your company and what you need help with (such as company stage and topics of interest).
• Social media handles and profile information.
• Payment or payout information (processed securely via Stripe).
• Content you submit for review or publication, including uploaded media (images and videos), captions, and links to your published posts on third-party platforms.
• When you request a demo or otherwise submit one of our website forms, we store the campaign attribution context of that visit on the same record as your request. This context covers the campaign parameters in the link you arrived through (UTM parameters), advertising click identifiers (for example Google and Meta click IDs), the website that referred you, and a site session identifier that lets us tie the request to the visit it came from.

2.3. Automatically Collected Information

When you access our Services, our servers automatically collect information, such as your IP address, browser type, operating system, access times, and the pages you have viewed. This data helps us ensure the security and performance of our Services.

2.4. Information from Connected Social Media Accounts

When a Creator connects their TikTok or Instagram account to Nixar through OAuth, we receive and store the following data, limited to the scopes the Creator authorizes at the time of connection:

From TikTok (via the user.info.basic, user.info.profile, user.info.stats, and video.list scopes):

• Profile fields: open ID, union ID, username, display name, avatar image, bio, profile links, and verification status.
• Account statistics: follower count, following count, total likes, and video count.
• Public video metadata: video ID, creation time, description, cover image, share URL, duration, dimensions, embed code, and engagement counts (views, likes, comments, shares).

From Instagram (via the instagram_business_basic and instagram_business_manage_insights scopes):

• Profile fields: Instagram user ID, username, profile picture, and account type.
• Public post and story metadata, plus aggregated insights (reach, impressions, engagement).

We use this data solely to (a) verify the Creator's ownership of the connected handle, (b) display profile and performance analytics inside the Creator's Nixar dashboard, and (c) attribute campaign content to the Creator. We do not post, upload, comment, like, follow, or otherwise modify content on TikTok or Instagram on the Creator's behalf.

Automated content analysis. To attribute campaign content we use an automated text-reading and classification step provided by Google (the Gemini API, an AI model service). Two things are sent to it: (i) still frames of your archived Instagram Stories, so that all text visible on the frame, including stickers, mentions, links, discount codes and text in the photo itself, can be transcribed, and the brand the Story appears to promote can be estimated; and (ii) when a Brand's discount code appears in a post or story caption or among the codes read from a Story, the caption (for a very long caption, the text around the code), or the transcription together with the handles and codes read from that Story, so the model can classify whether the code was used as a discount code rather than as an ordinary word, a name or a handle. Apart from the discount code being checked, we do not add your name, account identifiers or any Brand or agreement details to these requests (they reach the model only where they appear in the content itself, for example a handle shown on a Story frame), and we do not use this analysis to profile you or to identify people in images. We store only what the model returns — the transcription and the handles, links and codes read from it, the classification and the position of the text it relied on, and, for Stories, its guess (with a confidence score) of which brand the Story promotes, which is shown to Nixar staff and never to Brands — plus processing details such as which model ran and which frame each item came from; never a copy of the request. Where a caption or frame mentions other people (for example a tagged account), that text is processed in the same way. Google processes this data as our processor and does not use it to train or improve its models.

Retention and deletion: We retain this data for as long as the Creator's social account is connected to Nixar, plus up to 30 days after disconnection to allow recovery from accidental disconnects. When a Creator disconnects an account we immediately revoke the OAuth access token with the respective platform and begin the 30-day purge window. Posts and Stories that are or have been assigned to a Creator Agreement (by a person or automatically, see Section 6, and including where the assignment was later removed), or that have been submitted as campaign content (including where the submission was later deleted), are kept after that window, together with their performance metrics, the analysis results stored with them and the account's username and platform user IDs, because they form part of the campaign record. Creators may also request immediate deletion by contacting us at [email protected].

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Services.
• Process transactions and manage commissions.
• Improve, personalize, and expand our Services.
• Communicate with you, including for customer service, updates, and marketing (where you have opted in).
• Detect and prevent fraud and unauthorized access.
• Comply with legal obligations.

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service Providers: Third-party vendors who perform services for us, such as cloud hosting (Google Cloud), payment processing (Stripe), email delivery, and — for the automated content analysis described in Section 2.4 — Google's Gemini API, which reads and classifies Creator content on our instructions under Google's data-processing terms. Google may process that content on servers outside the EEA; those transfers are covered by the EU–U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses incorporated in Google's terms.
• Legal Requirements: If required to do so by law or in response to valid requests by public authorities.
• Business Transfers: In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. Data Processing Agreement (for Merchants)

Where a Brand connects its e-commerce store (for example, a Shopify store) to Nixar, Nixar processes the order and customer records read from that store on the Brand's behalf and on its documented instructions. For that processing the Brand is the data controller and Nixar acts as a data processor under Article 28 of the GDPR (and the equivalent "service provider" role under the California Consumer Privacy Act, as amended by the CPRA).

These processor terms are set out in the Nixar Data Processing Agreement (DPA), which is incorporated by reference into, and forms part of, the Nixar Brand Agreement that each Brand accepts (Brand Agreement §5.2). No separate signature is required for the DPA to apply; a counter-signed copy is available to merchants who require one. The DPA describes the categories of data processed, the security measures applied, Nixar's sub-processors, international-transfer safeguards, and how Nixar assists with data-subject requests.

To request a copy of the current Nixar Data Processing Agreement, or a counter-signed copy, contact us at [email protected].

6. Your Data Protection Rights (GDPR)

If you are located in the European Economic Area (EEA), you have certain data protection rights, including:

• The right to access, update, or delete the information we have on you.
• The right of rectification.
• The right to object.
• The right of restriction.
• The right to data portability.
• The right to withdraw consent.

To exercise any of these rights, please contact us at [email protected].

Automated attribution. Content is linked to a Creator Agreement automatically when it carries a signal such as the Brand's discount code, campaign link or @-mention, including one read from a Story frame by the analysis in Section 2.4; that analysis is also used to confirm that a discount code was used as one. Such a link is not a decision about your pay or your agreement: it never creates, changes or releases a fee or commission. Commissions come from orders placed with your discount code or link, fees follow the terms of your agreement, and every payment is released by a person at Nixar. Links are shown to Nixar operators for review. You may ask us to review, correct or remove any automatic link, or to have a person re-check the outcome, at [email protected].

7. Data Retention

We retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, or as needed to provide you with our Services, and to comply with our legal obligations, resolve disputes, and enforce our agreements.

Data collected from connected social media accounts (see Section 2.4) follows a specific retention rule: it is retained while the account remains connected and is purged within 30 days of the Creator disconnecting the account, except content kept as part of a campaign record and the account details kept with it (see Section 2.4), and within 30 days of the Creator requesting deletion.

Content and media you upload (see Section 2.2) are retained for the lifetime of your account and associated partnerships, and are deleted upon account deletion or upon request to [email protected].

Lead and prospect records (including the contact details you submit through our website forms, see Section 2.2) are retained for as long as they remain relevant to our sales relationship with you, and are deleted or anonymized on request to [email protected].

8. Age Restriction

Our Services are intended only for individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: [email protected]
• By mail: Nixar, Lda., Avenida da Liberdade UPTEC Mar s/n, Matosinhos e Leça da Palmeira, 4450-718 Matosinhos, Portugal