Nexos Flow Privacy Policy

Last updated: October 7, 2026

This Policy explains how Nexos Flow collects, uses, shares, and protects personal data and advertising account data. It applies to the website nexosflow.app and the application app.nexosflow.app (together, "Nexos Flow" or the "Service").

1. Who we are

Nexos Flow is operated by NEXOS CREATIVE COMPANY LTDA, CNPJ 60.179.840/0001-95, with its registered office at Rua Paulo Moreno, 377, Barra da Tijuca, Rio de Janeiro, RJ, CEP 22793-690, Brazil ("we").

We are the controller of the data in your Nexos Flow account. For data from the advertising accounts you connect, we act on your behalf and according to your instructions.

Data Protection Officer (DPO): Luiz Gustavo Silva Contact: info@nexoscreative.com

2. Data we collect

2.1 Your account data

• Name, email, and password (the password is stored encrypted, never in plain text)
• Name of your company or agency and of your team users
• Subscribed plan and usage history

2.2 Data from the ad platforms you connect When you connect Google Ads or Meta Ads, we receive, with your authorization:

• Identification and names of ad accounts, manager accounts (MCC), and Business Managers
• Campaigns, ad sets, budgets, and status
• Performance metrics: spend, impressions, clicks, conversions, and cost per result
• Currency, time zone, and account balance or billing method
• Access tokens provided by Google and Meta, which we store encrypted

We do not access emails, files, contacts, or any other data from your Google or Meta account beyond what is necessary to manage ads.

2.3 Settings you define Spend caps, cost-per-result targets, alert rules, and rules to pause and resume campaigns.

2.4 Payment data Payments are processed by Stripe. We do not store your card number. We only receive payment confirmation, the last digits of the card, and the subscription status.

2.5 Technical data IP address, browser type, date and time of access, and error logs, used for security and to keep the Service running.

3. How we use the data

We use the data to:

• Provide the Service: sync accounts, show dashboards, calculate spend pacing, and generate reports
• Run the actions you configured: pause, resume, or adjust campaign budgets, only according to the rules you defined and authorized
• Send alerts and reports by email
• Generate artificial intelligence analyses from your campaign metrics
• Provide support, bill the subscription, ensure security, and comply with legal obligations

Legal bases (LGPD and GDPR): performance of a contract, compliance with a legal obligation, legitimate interest (security and improvement of the Service), and, where applicable, your consent.

4. Use of Google API data

Nexos Flow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means that Google Ads data:

• Is used only to provide and improve the Nexos Flow features you see and use
• Is never sold
• Is never used for advertising, to build profiles, or to train artificial intelligence models
• Is not read by humans, except with your consent, for security, to comply with the law, or when it is aggregated and anonymized

5. Who we share with

We do not sell personal data. We share data only with providers needed to operate the Service:

We may also share data when required by law or court order.

Our artificial intelligence providers do not use your data to train models.

6. International transfers

Service data is stored in the European Union (Paris, AWS eu-west-3). Some providers are located in the United States. For those transfers, we use the safeguards provided under the LGPD and the GDPR, such as standard contractual clauses.

7. How long we keep data

• While your account is active, we keep the data needed for the Service.
• If you delete your account, we erase the data within 30 days, except what the law requires us to keep (for example, tax records).
• If you disconnect an ad account, we revoke and delete the access tokens immediately.

8. Security

• Connections always encrypted (HTTPS)
• Access tokens stored encrypted
• Isolation between customers: each company only accesses its own data
• Internal access restricted to the minimum necessary

No system is 100% secure. If an incident affects your data, we will notify you and the competent authorities, as required by law.

9. Your rights

You may, at any time:

• Confirm whether we process your data and access it
• Correct incomplete or outdated data
• Request deletion, portability, or anonymization
• Withdraw consent and object to processing

To exercise any right, write to info@nexoscreative.com. We respond within 15 days.

You may also lodge a complaint with a data protection authority: the ANPD in Brazil or the CNPD in Portugal.

10. How to disconnect and delete your data

Disconnect a platform:

• In Nexos Flow: Settings, Integrations, Disconnect
• In Google: myaccount.google.com/permissions, remove access for Nexos Flow
• In Meta: Facebook Settings, Business Integrations, remove Nexos Flow

Delete all your data: send an email to info@nexoscreative.com with the subject "Data deletion", from your registered email address. We confirm deletion within 30 days.

11. Cookies

We use only essential cookies, needed to keep you signed in and the Service secure. We do not use advertising cookies.

12. Minors

Nexos Flow is intended for businesses and professionals. It is not directed at anyone under 18.

13. Changes

We may update this Policy. If a change is material, we will notify you by email or in the application before it takes effect.

14. Contact

NEXOS CREATIVE COMPANY LTDA info@nexoscreative.com Rua Paulo Moreno, 377, Barra da Tijuca, Rio de Janeiro, RJ, 22793-690, Brazil