Privacy notice
Last updated 8 November 2026
This notice explains how Nexform Studio handles personal data when you use Nexform Growth AI (the “Service”), our AI-powered marketing platform, and our website. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
The Service is provided by Nexform Studio. You can contact us about privacy at nexformstudio.co.uk.
2. Controller and processor
- We are the controller for data about our customers and their users: account details, billing records, security logs and support correspondence.
- We act as a processor for data that customers bring into the Service about their own businesses — for example data from connected Google, Meta and TikTok accounts, content they create, and information about their team. The customer (the business) is the controller of that data and we process it only on their instructions, as set out in our Terms of Service.
3. What we collect
- Account data: your name, email address, password (stored only as a secure hash by our authentication provider) and two-factor authentication settings.
- Business information you enter: business name, website, industry, location, goals, brand voice, services, competitors and keywords.
- Connected platform data: when you connect Google Search Console, Google Analytics 4, Google Ads, Meta Ads or TikTok Ads, we receive the data those platforms make available for your accounts — such as search performance, website analytics, campaigns, spend, clicks, impressions and platform-reported conversions — together with authorisation tokens. These are mostly aggregated statistics; the Service does not collect information about individual visitors to your website.
- Content and AI conversations: drafts, reports, recommendations, approvals and your conversations with the AI Marketing Director.
- Billing data: your plan, subscription status and invoices. Payments are taken by Stripe; we never receive or store your full card details.
- Technical and security data: IP address (used for rate limiting and fraud prevention), sign-in events, and an audit log of significant actions in each business.
- Correspondence with us, for example support requests.
4. How we use it and why
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, providing the Service and its features, connecting your advertising and analytics accounts | Contract |
| Taking payment, sending invoices and keeping accounting records | Contract; legal obligation |
| Keeping the Service secure: authentication, rate limiting, audit logs, preventing fraud and abuse | Legitimate interests |
| Service messages: security alerts, trial and billing notices, important changes | Contract; legitimate interests |
| Improving the Service using aggregated, non-identifying usage information | Legitimate interests |
| Marketing emails about our own products | Consent (only if you opt in; you can unsubscribe at any time) |
| Complying with law and responding to lawful requests | Legal obligation |
We do not sell personal data, and we do not use your connected platform data to advertise to you or for any purpose other than providing the Service to you.
5. AI features
To answer questions, write content and produce recommendations, the Service sends relevant business information and aggregated marketing data to our AI provider (Anthropic, and — only if a business selects them — OpenAI or Google). We use these providers' business APIs under data processing terms. We instruct the AI not to use personal data about your customers, and we block personal contact details (other than your business's own) from being published or sent to advertising platforms. AI output can be inaccurate, so changes to campaigns and published content require a person's approval.
6. Who we share it with
We use carefully selected service providers (“sub-processors”) who process data on our behalf under written contracts:
| Provider | Purpose |
|---|---|
| Supabase | Database and authentication |
| Netlify | Hosting of the website and application |
| Anthropic (and optionally OpenAI or Google) | AI features |
| Stripe | Payments, subscriptions and invoices |
| Resend | Sending service emails |
| DataForSEO | Keyword and search data (business information only, such as keywords and website addresses) |
When you connect Google, Meta or TikTok, data is exchanged with those platforms on your instructions and their own privacy policies also apply. Google user data obtained through Google APIs is used only to provide the Service and complies with the Google API Services User Data Policy, including its Limited Use requirements. We may also disclose information to professional advisers, to a buyer of our business (under equivalent protections), or where required by law.
7. International transfers
Some providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
- Account and business data: while your account is active. After you close your account or ask us to delete it, we delete it within 30 days, except as below.
- Billing records: six years after the end of the financial year they relate to, as required by UK tax law.
- Security and audit logs: for as long as the business account exists (so changes and approvals can be traced), then deleted with it.
- Backups: overwritten within 30 days of deletion from the live system.
Disconnecting an advertising or analytics account deletes its stored authorisation tokens immediately.
9. How we protect it
- Encryption in transit (HTTPS) and encryption of platform tokens at rest (AES-256-GCM); tokens never reach your browser.
- Two-factor authentication, verified email addresses and role-based access within each business.
- Database-level separation between businesses, so one business's data can never be seen by another.
- Rate limiting, an append-only audit log and approval controls for any change made outside the Service.
No system is perfectly secure. If a personal data breach affects you, we will tell you and the ICO where the law requires.
10. Cookies
We use only strictly necessary cookies, which do not require consent:
- Sign-in session cookies set by our authentication provider (Supabase) to keep you signed in securely.
- Short-lived security cookies (up to 10 minutes) that protect connections to Google, Meta and TikTok.
- A preference cookie (
nx_theme) that remembers light or dark mode.
We do not use advertising or third-party analytics cookies, and our pages load no third-party tracking scripts.
11. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its use, to data portability, and to withdraw consent where we rely on it. To use these rights, contact us at nexformstudio.co.uk. We will respond within one month. If your data is held by a business that uses our Service (where we are its processor), we will pass your request to that business. You can also complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the chance to help first.
12. Children
The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect children's data.
13. Changes and contact
We may update this notice from time to time. We will show the date of the latest version at the top of this page and tell account holders about significant changes. Questions: nexformstudio.co.uk.