Privacy Policy

Last updated October 2026.

Who this covers

This policy covers najmarketing.co (the public site), Nexus (NAJ’s internal operations tool), and Flow (the client portal) — one data layer behind three doors. It doesn’t cover a client’s own website, ad accounts, or other tools NAJ manages on their behalf; those are governed by the client’s own agreements and the platforms’ own policies.

What we collect

Depending on which door you’re using:

• Visiting najmarketing.co. Standard server logs (IP address, browser, pages requested) kept for security and troubleshooting. No advertising trackers or analytics pixels run on the public site.
• Submitting a form (contact, project brief, the startup readiness survey, a calculator result you choose to send). Whatever you type into it — name, email, company, and the specifics of the form itself.
• Applying for a job (najmarketing.co/careers). Your name, contact details, city, the role and experience you describe, expected salary and notice period, your CV and any work samples you upload or link, and the free-text answers you choose to write. When you upload a CV, our server reads it to fill in the form for you; where that leaves gaps, the CV’s text (not the file) is sent to our AI provider, Anthropic, to read out the same details. You can fill the form in yourself and skip the upload.
• Joining the creator roster (najmarketing.co/careers/creators). Your name and contact details, the social handles and follower counts you give us (we don’t verify or scrape them), your niches, rates, availability, photos, videos or links you upload as examples of your work, and what you write about yourself. You confirm you are 18 or older. Content you create as part of a collaboration may be used by the brand for advertising purposes, as set out in the collaboration agreement.
• Using Nexus (NAJ staff). Your account, role, and whatever business data you or a colleague enters — client records, tasks, proposals, time, and the rest of day-to-day agency operations.
• Using Flow (NAJ clients). Your account, and the slice of your own account’s data Nexus shares with you — briefs, content, approvals, invoices, and campaign performance for ad accounts you’ve connected.
• Paying an invoice. Payment is handled directly by Stripe; NAJ never receives or stores your card details, only the resulting payment status.

How it’s used

• To respond to an inquiry, deliver a proposal, or run a project you or your company has engaged us for.
• To review job applications and contact the people who applied, and to match creators to briefs and contact them about collaborations that fit. A creator’s profile and work samples are shown to a brand we are pitching only if the creator ticked the optional box saying we may.
• To operate Nexus and Flow — access control, notifications, and the records those tools are built around.
• To report on ad campaign performance, for a client who has connected a Meta (Facebook/Instagram) ad account — read directly from Meta’s own reporting API using that account’s own authorization, not collected by us independently and not routed through a third-party aggregator.
• To send transactional email — a proposal, an invoice reminder, a password reset — never marketing email without asking first.

Who else sees it

Only the processors that make the above possible, each bound to use it solely for that purpose:

• Supabase — the database and authentication behind Nexus and Flow.
• Stripe — payment processing for Flow’s Billing page.
• Resend — transactional email delivery.
• Anthropic — the AI provider behind the CV reader on the careers form and the AI features NAJ staff use inside Nexus (such as a summary of an application). It receives the text it is asked to work on, for that request only.
• Google Drive — internal file storage for NAJ staff; connected by NAJ, not by clients or site visitors.
• Google Ads — read-only reporting access to a client’s Google Ads account, once that client links it to NAJ’s own manager (MCC) account; connected by NAJ, not by clients or site visitors.
• Google Analytics 4 — read-only reporting access to a client’s GA4 property, once that client grants NAJ’s service account Viewer access on it.
• Meta — the platform itself, for a client who has connected a Facebook/Instagram ad account; no third-party aggregator sits in between.

We don’t sell data, and we don’t share it beyond what’s listed here.

Google API Services user data

Nexus’s use and transfer of information received from Google APIs (Google Drive, Google Ads, and Google Analytics 4) to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. That data is used only to operate the specific feature it was granted for — Drive file storage for NAJ staff, and ad/analytics reporting for a client who has explicitly connected their own account or property — and is never used for advertising, sold, or shared with anyone outside the processors listed above.

How long we keep it

• Job applications. Rejected applications are deleted automatically, with the files that came with them, after twelve months. Talent-waitlist entries nobody has followed up are deleted after twenty-four. If someone is hired, their application becomes part of their employment record.
• Creators. Profiles stay on the roster until you ask to be removed. A profile we have archived is deleted after twelve months.
• Everything else is kept for as long as the work or the legal and accounting rules that apply to it require.

You can ask for an application or creator profile to be deleted sooner, at any time, using the address below.

Cookies and local storage

Signing in to Nexus or Flow stores your session in your browser’s local storage so you stay signed in — the same mechanism, not a tracking cookie. A separate local preference remembers light or dark mode. Neither is used to track you across other sites.

Your choices

To see, correct, or delete the data we hold about you, or ask a question about any of this, email hello@najmarketing.co. A Nexus or Flow account can also be deactivated on request.

Changes

If this policy changes in a way that matters, we’ll update the date at the top of this page.