Nudgeo for Creators Privacy Policy

This policy explains what Nudgeo ("we", "us") collects in Nudgeo for Creators (the "App"), why, who sees it, how long we keep it, and what you can do about it. It covers three groups of people: creators who use the App, people who visit public pages on creators.nudgeo.com, and brands that send a booking request through a creator's page. It goes with our Terms of Service.

We don't sell your personal information. Our launch-list pages use analytics and advertising cookies, as section 11 explains; nothing else we run does.

1. Who we are

Nudgeo is a company based in the Republic of Korea, and it decides how this data is used. Questions or requests about your data go to our privacy team at privacy@nudgeo.com, which also acts as our privacy officer.

2. What we collect from creators

Your account

• Your email address. If you sign in with Apple or Google, we also get the name and email that service shares with us.
• A one-time sign-in code we email you. We store only a scrambled form of it (a hash), never the code itself, and it expires in 10 minutes.
• Your sign-in sessions, also stored only as hashes.
• Where you came from, if you joined through a link (for example another creator's page).

Your connected channels

When you connect Instagram, TikTok or YouTube, the platform asks you to allow access, and then we read:

• Your channel profile: handle, name, follower count, and for Instagram the account type.
• Your posts: caption (and for YouTube, title and description), link, date, type, and the address of the image or video still. We don't copy your videos.
• An access token from the platform, which we keep encrypted on our servers so we can read your posts again later.

The App uses YouTube API Services when you connect a YouTube channel. Google's handling of data is described in the Google Privacy Policy.

What you tell us

• Your work preferences: your minimum amount, formats, the brand categories you open, and your confirmation that you're 21 or older if you open 21+ categories.
• Your topics, including ones you add, change or turn off.
• Your page: About line, which sections show, and whether it's published.
• Your two permissions: whether your page is published on the web, and whether brands can see your profile.
• Your notification settings.

Answers and deals

• Your answers: the question, your three notes, how long you used the product, the text, up to four photos, and when each answer was published or unpublished.
• Offers you get and what you did with them. If you decline, the reason and any note you add (we never send them to the brand).
• Your deals: drafts and videos you upload, change requests, post links, our post checks, and dates.
• Your earnings, balance and payouts.
• AI citation records: the AI tool, the question, the day, the source link, and the text of the AI answer that cited you.
• Your booking links, and a daily count of views of your page.

Payouts

Before you withdraw, you set up a payout account and sign a U.S. tax form (W-9) in the App.

• Payout account: your name, bank name, routing and account numbers, address, email and phone. We pass them to our payout provider, which sends your payouts. We keep only your name, your address and the last 4 digits of the account.
• Tax form: your name (and business name, if any), your Social Security or Employer Identification number, your address, whether you're subject to backup withholding, and when you signed. We keep the number encrypted.

Messages

What you send us when you email support.

3. What we collect from visitors and brands

People who visit a public page

Creators' pages and answers on creators.nudgeo.com set no cookies and use no analytics tools. When a person (not a crawler) opens a creator's page or answer, we add one to that page's daily view count. The count is a number. It holds nothing about you. Like most websites, our servers keep short technical logs of requests, which include your IP address, the page you asked for, your browser type and the time.

People who join the launch list

Before the App launches, you can join our launch list on creators.nudgeo.com. We collect your email and the channel handles you enter, and use them only to email you when the App launches. The launch-list pages (the home page, sign-up, terms and this policy) also use analytics and advertising cookies (section 11). Those companies never receive your email or handles.

Brands that send a booking request

The booking form on a creator's page asks for your company, your work email, the product, and optionally your question. We also keep a keyed scramble (a hash) of your IP address, only to limit how many requests one address can send. We never store the address itself. We use your request to reply to you and to set up a deal with the creator. If a deal goes ahead, the creator sees your company name and question in the offer.

4. Why we use it

1. To run your account, sign you in and keep it secure.
2. To find the topics you're known for from your posts, and to match you with questions on those topics.
3. To publish your page and answers on the web when you choose to.
4. To show your profile to brands when you allow it.
5. To run offers and deals: send offers, carry drafts and approvals, and check that deal posts went live and say they're ads.
6. To check whether AI tools cite your answers, and to pay the AI citation bonus.
7. To pay you, keep payment records, and meet tax and legal duties.
8. To answer brand booking requests.
9. To send you emails about offers, deals, payments and your account. You can turn some of these off in the App.
10. To keep the App safe, stop fraud, and fix problems.

Our team can see creator accounts in our internal console so they can run deals and answer support. The changes our team makes there are recorded.

5. Who we share it with

Everyone, when you publish your page

A published page and its answers are public. Anyone can read them, including search engines and AI tools. Section 4 of our Terms lists what your page shows, and you can make it private at any time.

Brands, when you allow it

We show your profile to brands only with your separate permission, which you give in the App apart from these terms.

• Who receives it: brands on Nudgeo that can send you offers, and our team acting for them.
• Why: to see what you're known for before they send you an offer.
• What: your name, photo, handles and follower counts, the topics you turn on with a few of your public posts on each (image, caption, date, link), and how many deals you've completed.
• How long: brands view it only on Nudgeo and can't download it. A post stops showing when you turn its topic off or disconnect the channel, and your profile stops showing when you turn the permission off.
• If you say no: brands can't see your profile, so you won't get offers. You can still use the rest of the App.

Brands never see your minimum amount, formats, excluded categories, earnings, email, or topics you turned off.

Brands in a deal

When you accept an offer, the brand gets what the deal needs: your drafts, your answer, your post link, and the dates. After that, it may use your content only within the deal's usage rights.

Service providers that work for us

They process data only on our instructions and only to provide their service to us. We require each one to protect it at least as well as this policy does.

• Amazon Web Services: hosting, storage, encryption keys, sending email (Amazon SES), and Apple and Google sign-in (Amazon Cognito).
• A database provider (named in section 8): storing the launch list.
• A website host (named in section 8): serving the pages on creators.nudgeo.com.
• AI model providers: they process text for us to suggest your topics and to draft answers when you ask. Today we use Anthropic, PBC. Section 6 says exactly what they get.
• Our payout provider (named in section 8): payouts and payout accounts. It may also use your details for its own legal duties, under its own privacy policy.

The platforms you connect

When you disconnect a channel, we tell the platform to cancel our access. We don't send the platforms anything else about you.

When the law requires it

We may share data when the law requires it, to protect someone's safety, or to protect our rights. If we sell or merge our business, the data passes to the new owner under this policy.

6. AI processing

We use AI models in two places. We may change the provider. If we do, we'll update this policy before we send it any data.

1. Finding your topics. We send the captions of your newest posts (up to 120, each cut to 280 characters) and which platform each came from. We don't send your name, email, images or messages.
2. Draft my answer. Only when you ask, we send the question, the brand's name for a brand answer, and your three notes. We don't send your name, email or photos.

Under its terms with us, Anthropic acts for us, doesn't use this data to train its models, and deletes it within 30 days unless it must keep it longer to enforce its usage policy or the law.

The topics we suggest are suggestions. You can change them, add your own, or turn them off. Our team, not an AI model, decides which offers to send.

7. How long we keep it

• Your account and preferences: until your account is deleted. That's 30 days after you ask, or later if a deal the brand already approved is still open or a payout is on its way.
• Channel copies: we read them again within 30 days and delete any copy we can't refresh. We delete a channel's copies within 7 days after you disconnect it, and all of them within 7 days after you ask to delete your account.
• Channel access tokens: deleted right away when you disconnect a channel or ask to delete your account.
• Your page, answers, photos, booking links and view counts: until you delete them or your account is deleted.
• Records of offers, deals, payments and AI citations: 7 years, as Korean tax law requires for payments across borders. When your account is deleted, these records stay without your name or email.
• Tax forms (W-9): 4 years after the U.S. tax form for the year of your last payout is due (we count from March 1 of the next year), as U.S. tax rules require, even after your account is deleted. If you were never paid, 4 years after your account is deleted.
• Sign-in codes: they expire after 10 minutes and are deleted within a few hours.
• Sign-in sessions: they last up to 30 days and are deleted a week after they end.
• Brand booking requests: until the creator's page is deleted, or until you ask us to delete yours.
• Launch list: until we send the launch email, or until you ask us to remove you.
• Support emails: up to 3 years.
• Server logs: up to 90 days.
• Backups: our database backups may keep deleted data for up to 35 days before they expire.

When we delete electronic data, we delete it so it can't be recovered.

8. Where your data goes

We store data with Amazon Web Services in the Seoul region, in the Republic of Korea. If you live in the United States, your data moves from the United States to Korea when you use the App. Some of it then goes to the companies below, outside Korea, to provide the App under our agreement with you.

• Amazon Web Services, Inc. (United States, aws.amazon.com/contact-us): all the data in sections 2 and 3. Stored in the Seoul region, but AWS staff in the United States may reach it during support or an incident. Sent over encrypted connections as you use the App. Used for hosting, email and sign-in, and kept as section 7 says.
• Supabase Pte. Ltd. (Singapore, privacy@supabase.com): the launch list (email and channel handles). Stored in the Seoul region, sent over an encrypted connection when you join, and kept as section 7 says.
• Vercel Inc. (United States, privacy@vercel.com): the technical request logs in section 3 when you open a page on creators.nudgeo.com. Used to serve the pages, and kept under Vercel's own retention.
• Meta Platforms, Inc. (United States, facebook.com/privacy/policy), X Corp. (United States, x.com/privacy), LinkedIn Corporation (United States, linkedin.com/legal/privacy-policy), Reddit, Inc. (United States, reddit.com/policies/privacy-policy), TikTok Pte. Ltd. (Singapore, tiktok.com/legal/privacy-policy) and Google LLC (United States, policies.google.com/privacy): cookie and advertising identifiers, the launch-list pages you view and whether you finished signing up, from your browser. Sent over an encrypted connection by their tags when you open those pages, unless you decline (section 11). Used to measure our site and our ads and to show you ads, and kept under each company's own policy.
• Anthropic, PBC (United States, privacy@anthropic.com): the post captions and answer notes described in section 6. Sent over an encrypted connection when we read your channels or when you ask for a draft. Used to suggest topics and draft answers, and deleted within 30 days, as section 6 says.
• [payout provider] ([country], [contact]): your name, address, email, phone, bank details and payout amounts. Sent over an encrypted connection when you set up payouts or withdraw. Used to send your payouts, and kept as their law and their privacy policy require.

You can refuse these transfers by not using the feature that needs them: don't connect a channel, don't ask for a draft, don't set up payouts, or decline advertising cookies. Without them, that part of the App won't work for you. You can also delete your account.

9. How to delete your data

1. Delete your account in the App: Me, then Settings, then Delete account. When you ask, we disconnect all your channels right away and delete their copies within 7 days. Your account is deleted 30 days later, and signing in during that time cancels the request (connect your channels again if you do). On the deletion day we delete your account, your page and answers, and your sign-in, and we keep only the deal and payment records and your tax form, as section 7 says.
2. Disconnect a channel in the App to stop us reading it. We delete its copies within 7 days. One channel must stay connected while your account is open.
3. Remove our access in the platform's own settings: Google security settings for YouTube, and the apps and websites settings in Instagram or TikTok. We then stop reading that channel. Instagram tells us when you remove us: we disconnect the channel and delete its copies within 7 days. If you also ask Instagram to have us delete your data, we delete the copies right away and give you a confirmation code and a page that shows your request. For TikTok and YouTube, the copies we kept are deleted within 30 days.
4. Delete one answer of your own in the App at any time, or unpublish it.
5. Ask us at privacy@nudgeo.com to delete any of your data, including a brand booking request.

Deleting the copies we keep doesn't delete anything on Instagram, TikTok or YouTube.

10. Your choices and rights

You can ask us to show you the data we hold about you, give you a copy, correct it, stop using it, or delete it. Email privacy@nudgeo.com from the address on your account, and we'll reply within 10 days. Many of these you can also do yourself in the App: change your topics, preferences and page, turn your two permissions off, disconnect channels, and delete your account.

Some U.S. states, such as California, give residents privacy rights by law. We may not be covered by those laws today, but we honor these requests from anyone, wherever you live:

• To know what personal information we collect, use and disclose, and to get a copy.
• To correct it.
• To delete it.
• Not to be treated differently for using these rights.

We don't sell personal information, and we haven't in the past 12 months. The advertising cookies on our launch-list pages (section 11) may count as sharing for cross-context behavioral advertising, as California law defines it. To opt out, use Global Privacy Control (below) or block third-party cookies in your browser. Using California's names for the kinds of information: we collect identifiers (such as email and handles), customer records and commercial information (deals and payments), internet activity (pages viewed, server logs), audio and visual content (photos, videos), professional information (your channels and work record), and inferences (your topics). We use them only for the purposes in section 4. Someone you authorize can make a request for you; we'll confirm it with you by email first.

Creators' pages and answers don't track you across other websites. If your browser sends a Global Privacy Control signal, our launch-list pages treat it as your request to opt out, and the analytics and advertising cookies don't run. We don't respond to Do Not Track.

You can also complain to a data protection authority, such as Korea's Personal Information Protection Commission.

11. Cookies and similar technology

• Creators' pages and answers set no cookies and use no analytics tools.
• Our launch-list pages (the home page, sign-up, terms and this policy) load Google Tag Manager, which runs Google Analytics (cookies _ga and _ga_*, with Google's advertising features) and the advertising pixels of Meta (_fbp, _fbc), X (_twpid, _twsid), LinkedIn (li_fat_id), Reddit (_rdt_uuid) and TikTok (_ttp, ttcsid). Each company also uses its own cookies on its own sites. They measure how the pages are used and how our ads perform, and let these companies show you ads based on your visit. They don't receive your email or handles. In the EU, the EEA, the UK and Switzerland we ask first, in a banner. Elsewhere they run unless your browser sends Global Privacy Control; Google Analytics may then still count the visit, without cookies. You can also block them in your browser, or use each company's settings: facebook.com/adpreferences, x.com/settings/privacy_and_safety, linkedin.com/psettings/advertising, reddit.com/settings/privacy, adssettings.google.com and tools.google.com/dlpage/gaoptout. Your answer is kept in a cookie for 6 months.
• The App on the web keeps your sign-in token in your browser's local storage so you stay signed in. Signing out removes it.
• If you sign in with Apple or Google, those services may set their own cookies on their own sites.
• The App has no advertising or analytics tools, and it doesn't track you across other companies' apps or websites.

12. How we protect it

• Channel access tokens are encrypted with keys managed in AWS Key Management Service.
• Sign-in codes, session tokens and booking-form IP addresses are stored only as hashes.
• All connections use encryption in transit.
• Only our team can open the internal console, each person with their own access that expires, and the changes they make there are recorded.
• The images, videos and photos you upload are kept in private storage, and an answer photo is shown through a short-lived link.

13. Google user data

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

14. Children

The App is for people 18 and older. We don't knowingly collect data from anyone younger. If we learn we have, we delete it.

15. Changes to this policy

We'll tell you at least 7 days before a change takes effect, or 30 days before an important change. The date at the top shows the latest version.

16. Contact

• Privacy team and privacy officer: privacy@nudgeo.com
• Support: creators@nudgeo.com