NOX INFLUENCER LLC Privacy Policy

NoxInfluencer Websites, Services, Platform Integrations, and TikTok Shop Integration

Effective date: 23 July 2026
Last updated: 23 July 2026
Version: 1.0
Controller: NOX INFLUENCER LLC
Privacy owner: Rodney Dean Marquez, Privacy and Security Owner
Contact: [email protected]

This policy supersedes the prior public privacy statement for the services and integrations described here. It should be read together with applicable service terms and any product-specific notice presented at collection.

SECTION 1

Who We Are and When This Policy Applies

NOX INFLUENCER LLC is a United States-based company that provides NoxInfluencer websites, software, data and analytics services, influencer marketing tools, platform integrations, and the TikTok Shop integration described in this policy. In this policy, "NoxInfluencer," "we," "us," and "our" refer to NOX INFLUENCER LLC when it determines how and why personal data is processed.

This policy applies to NoxInfluencer websites, applications, services, support interactions, business relationships, and integrations that link to or expressly adopt this policy. If another Nox-affiliated entity is the controller for a particular service or transaction, that entity should be identified at the point of collection or in the applicable service terms.

Key Terms

Term and Meaning

Personal Data: Information that identifies, relates to, describes, can reasonably be linked with, or could reasonably identify an individual or household, as defined by applicable law.

Protected Data: Data received from a platform, customer, seller, creator, or partner that is protected by law, contract, platform terms, or the sensitivity of the information.

Customer: A business, seller, agency, account administrator, or other organization that contracts for or uses a NoxInfluencer service.

User: An individual who visits a website, creates or uses an account, contacts us, authorizes an integration, or otherwise interacts with a service.

Service Provider: A vendor or processor that handles data on our behalf under instructions and appropriate contractual safeguards.

Scope Note: The TikTok Shop section identifies controls and data-location facts specific to that integration. Those facts should not be assumed to describe every other NoxInfluencer product or service.

SECTION 2

Personal Data We Collect and Where It Comes From

The data we collect depends on the service, the user's choices, account configuration, integrations, and applicable law. We seek to collect only information reasonably necessary for the documented purpose.

Categories, Examples, and Typical Sources

Account and contact: Name, business email, phone number, title, company, account identifiers, language, country, and communication preferences. Typically provided by the user, account administrator, customer, or business contact.

Authentication and authorization: Login records, authorization identifiers, API tokens, connected-account status, permission scope, and security events. Generated by the service or received through an authorized platform integration.

Subscription and transaction: Plan, order, invoice, entitlement, payment status, and billing metadata. Payment-card details may be handled by a payment provider rather than stored by us. Typically received from the user, customer, payment provider, or service records.

Usage and device: IP address, browser, device and operating-system information, referrer, pages viewed, feature activity, timestamps, cookies, diagnostics, and logs. Collected automatically when a service is used.

Support and communications: Requests, tickets, correspondence, feedback, survey responses, attachments voluntarily submitted, and complaint records. Typically received from a user, customer, seller, partner, or support interaction.

Public social-media data: Public profile, channel, content, engagement, audience, ranking, and related public metrics. Typically received from publicly available sources, platform APIs, data partners, or creator submissions.

Platform integration data: Data a user authorizes us to access through Google, YouTube, Gmail, TikTok Shop, or another supported platform. Received through an authorized API or connected platform.

Marketing and business relationship: Lead details, campaign communications, event participation, relationship history, and preferences. Typically received from the individual, employer, customer, public business source, or approved partner.

We may combine information from these sources where permitted and necessary to provide, secure, personalize, measure, or support the requested service. We do not treat anonymous or properly de-identified information as Personal Data where applicable law excludes it.

SECTION 3

How We Use Personal Data and Our Legal Bases

We process Personal Data for the purposes below. We do not use platform-protected data for materially unrelated purposes unless the user or customer gives valid authorization and the platform rules and applicable law permit it.

• Provide, configure, authenticate, maintain, and support accounts, subscriptions, websites, software, analytics, reports, collaboration tools, and integrations.
• Perform user-authorized actions, including data retrieval, analysis, communications, creator outreach, TikTok Shop invitation activity, and other requested workflows.
• Communicate about service operation, support, transactions, security, product changes, and relationship administration.
• Improve reliability, usability, relevance, measurement, and product performance using permitted operational and usage information.
• Protect accounts, users, customers, partners, and services; prevent fraud or abuse; investigate incidents; enforce terms; and maintain audit evidence.
• Comply with legal, tax, accounting, contractual, platform, and regulatory obligations and respond to lawful requests.
• Send marketing communications where permitted, subject to consent or opt-out requirements. Service and security communications may still be required.
• Establish, exercise, or defend legal claims and manage corporate transactions or service-provider relationships.

Legal Bases

Legal Basis and When It May Apply

Contract: Processing needed to provide a requested service, manage an account, fulfill an order, or perform an agreement with a customer or user.

Consent: Optional integrations, certain marketing, cookies where required, or other processing for which the user gives a revocable choice.

Legitimate interests: Secure and improve services, prevent abuse, support customers, manage business relationships, and conduct proportionate analytics, balanced against individual rights.

Legal obligation: Tax, accounting, sanctions, regulatory, litigation, security-notification, or other requirements imposed by applicable law.

Vital or public interests: Rare circumstances involving safety, fraud, security, or lawful public-authority requests where the relevant law recognizes such a basis.

No Automated Legal Decisions: Unless a product-specific notice states otherwise, we do not use solely automated processing to make decisions that produce legal or similarly significant effects about an individual.

SECTION 4

How We Disclose Personal Data

We do not sell Personal Data for monetary consideration. We may disclose data only as described below, subject to purpose limitation, minimum-necessary access, contracts, and applicable law.

Recipient, Purpose, and Limits

Service providers: Hosting, infrastructure, security, support, communications, analytics, payment, and professional services operating under instructions and appropriate safeguards.

Connected platforms: Google, YouTube, Gmail, TikTok Shop, social networks, or another platform when a user directs or authorizes an integration or action.

Customer or account administrator: Account, usage, team, campaign, or operational information made available within the applicable business account and role permissions.

Business partners: Only when needed for an approved service, jointly offered activity, or user-authorized purpose. A partner acting for its own purposes is responsible for its own privacy notice.

Professional advisers: Lawyers, accountants, auditors, insurers, and advisers under confidentiality obligations where reasonably necessary.

Authorities and protected parties: Where required by law, valid legal process, platform obligations, or reasonably necessary to protect rights, safety, systems, users, or the public.

Corporate transaction recipients: A potential or completed merger, financing, acquisition, restructuring, or transfer, subject to confidentiality and appropriate notice or choice where required.

U.S. State Notice: Some analytics or advertising technologies may be treated as a "sale" or "sharing" under certain U.S. state privacy laws even when no money is exchanged. Where required, we provide an applicable opt-out mechanism or honor a verified request sent to [email protected].

We do not disclose Gmail email content or TikTok Shop Protected Data to third parties for unrelated advertising, data brokerage, or resale.

SECTION 5

Cookies, Analytics, Advertising, and Public Social Data

Cookies and similar technologies may store or read identifiers on a device to maintain sessions, remember preferences, protect accounts, understand service use, measure performance, and support advertising where permitted.

Types of Technologies

Technology Type and Purpose

Strictly necessary: Authentication, session continuity, security, fraud prevention, load balancing, and core requested functions.

Preferences: Language, region, interface choices, and remembered settings.

Analytics: Traffic sources, pages, feature use, errors, and aggregated performance measurement, including tools such as Google Analytics where configured.

Advertising: Campaign measurement, frequency control, remarketing, or interest-based advertising where permitted and configured.

Users may manage cookies through available consent controls and browser settings. Blocking cookies may prevent some service functions from working. Where law requires consent, non-essential technologies should not be used until the required choice is obtained.

Public Social-Media Data

NoxInfluencer provides discovery, analytics, rankings, and related services based in part on public social-media information and derived metrics. Public data may include profile details, content, engagement, audience indicators, and channel or shop performance made available through public sources, authorized APIs, or approved data providers.

Derived measures such as NoxScore, estimated earnings, potential reach, audience insight, or trend indicators may be calculated by NoxInfluencer and should not be interpreted as information supplied or endorsed by the underlying platform unless expressly stated.

A creator or authorized representative may request review, correction, suppression, or deletion of eligible profile data by contacting [email protected]. We may verify identity or authority and may retain limited records necessary to document the request, prevent re-collection, satisfy legal obligations, or protect the service.

Third-Party Websites

Our services may link to third-party websites or services. Their privacy practices are governed by their own notices. A link or integration does not make us responsible for an independent third party's processing.

SECTION 6

Google, YouTube, and Gmail API Data

When a user connects a Google, YouTube, or Gmail account, we access only the permissions and data authorized by the user and required for the requested feature. Use and transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including the Limited Use requirements.

Google and YouTube

• Authorized account, channel, content, analytics, or related API data may be used to provide the connected feature, reporting, account management, or user-requested action.
• NoxInfluencer-derived scores, estimates, predictions, and trend indicators are calculated by NoxInfluencer and are not necessarily supplied by Google or YouTube.
• Users can revoke platform authorization through the applicable Google account controls. Revocation stops future API access, subject to technical completion and lawful retention of limited records.
• Google's own processing is governed by its privacy policy and applicable platform terms.

Gmail Data

Control and Commitment

Collection and use: Gmail Email Data is accessed only after user authorization and only to perform authorized actions, such as sending or managing email-related workflows requested by the user.

Limited use: Gmail Email Data is not used for unrelated advertising, data brokerage, or unrelated product profiling.

Sharing: Gmail email content is not disclosed or transferred to third parties except as necessary to provide the user-requested feature, comply with law, protect security, or as otherwise permitted by Google's Limited Use requirements.

AI tools: Gmail email content is not shared with third-party AI models for their independent training or unrelated purposes.

Security: Data is protected in transit, access is restricted, and stored data is protected according to its sensitivity and the connected feature.

Revocation and deletion: After authorization is revoked, we stop future Gmail API access and delete or de-identify data no longer required, subject to limited legal, security, or transaction records.

User Control: A user may disconnect an integration through available account controls or the underlying platform and may request access, correction, or deletion by contacting [email protected].

SECTION 7

TikTok Shop Integration Privacy Notice

This section applies specifically to the TikTok Shop integration operated by NOX INFLUENCER LLC.

Item and Current Practice

Operator and controller: NOX INFLUENCER LLC, a United States-based company.

Production Privacy and Security Owner: Rodney Dean Marquez operates, administers, maintains, and supports the production integration from the United States.

Human access: Rodney Dean Marquez is the sole individual authorized to access production TikTok Shop Protected Data. Other personnel, if involved in software development, work in segregated non-production environments without production Protected Data access.

Hosting and location: TikTok Shop API processing and application storage are hosted in AWS us-east-1 in the United States.

API access: Only the minimum data and permissions needed for approved functionality are accessed through authorized TikTok Shop APIs.

Data Handling

Authorization tokens: Persisted to maintain an authorized shop connection and API access; encrypted at rest and restricted to approved service access. Retained only while authorization or operational need remains, subject to limited required records.

Invitation records: Persisted to create, execute, track, and support invitation activity and status; encrypted at rest and service restricted. Retained for business, support, security, and applicable recordkeeping needs, then deleted or de-identified.

Other sensitive API payloads: Processed transiently only when required for an authorized operation and not intentionally persisted by the application. No durable application retention.

Application logs: Limited operational metadata and errors required to run and secure the service. Tokens and sensitive payloads are excluded or redacted. Controlled operational and security retention.

We use TikTok Shop Protected Data only to provide, secure, support, and comply with the authorized integration. We do not sell it, use it for unrelated advertising, or permit personnel without approved production access to view it.

Requests, Revocation, and Termination

We assist TikTok Shop, sellers, customers, and verified users with applicable access, correction, export, restriction, or deletion requests. When authorization or the contractual relationship ends, we revoke access and delete or de-identify data no longer needed. Limited records may remain where required for legal compliance, security, fraud prevention, dispute resolution, or contractual recordkeeping, under restricted access and defined retention.

SECTION 8

Retention, Security, and Incident Notification

Retention

We retain Personal Data no longer than reasonably necessary for the purpose collected, taking into account authorization status, account lifecycle, contractual commitments, legal obligations, security needs, disputes, and technical deletion cycles. Retention is reviewed by data category rather than applying one period to all information.

Data and General Retention Approach

Account and subscription: While the account or relationship is active and for a limited period afterward for support, transaction, security, tax, accounting, or dispute needs.

Marketing preferences: Until opt-out, withdrawal, suppression, or the end of the applicable business need. A minimal suppression record may be retained to honor the choice.

Support and rights requests: For the period needed to respond, document completion, prevent misuse, satisfy legal requirements, and resolve disputes.

Security and audit records: For controlled periods proportionate to investigation, threat detection, legal, contractual, and evidence needs.

Connected-platform data: According to the authorized feature, revocation status, platform terms, documented purpose, and specific integration sections in this policy.

Security

• Encryption in transit, including TLS 1.2 or higher for official TikTok Shop API exchanges, and encryption at rest for covered sensitive records.
• Role-based, need-to-know, least-privilege access; MFA for supported privileged administration; and restricted production access.
• Network segmentation, restrictive ingress, endpoint protection, secure configuration, logging, monitoring, vulnerability management, and controlled changes.
• Data minimization, sensitive-log redaction, service-provider safeguards, incident response, and recovery controls.

No method of transmission or storage is completely secure. We maintain safeguards designed to reduce risk but cannot guarantee absolute security.

Security Incidents

We maintain a process to identify, contain, investigate, remediate, recover from, and document suspected or confirmed security incidents. Where applicable law or contract requires notification, we coordinate notice to affected customers, sellers, platform partners such as TikTok Shop, individuals, or regulatory authorities within the required timeframe. Notification depends on the facts, risk, applicable law, and contractual obligations; it is not triggered by every unverified alert.

SECTION 9

Data Locations, International Transfers, and Your Rights

Data Locations and Transfers

NOX INFLUENCER LLC is based in the United States. The TikTok Shop integration is processed and stored in AWS us-east-1 in the United States as described in Section 7. Other NoxInfluencer services may use approved service providers or infrastructure in locations appropriate to those services and should be identified through the relevant product, contract, or data-flow documentation.

If Personal Data is transferred from another country to the United States or another jurisdiction, we use safeguards required by applicable law, which may include contractual protections, transfer assessments, access restrictions, encryption, or another recognized transfer mechanism.

Privacy Rights

Depending on location and applicable law, an individual may have some or all of the following rights:

Right and What It May Include

Know and access: Confirm processing, obtain categories and purposes, and receive a permitted copy of Personal Data.

Correct: Correct inaccurate Personal Data and complete relevant incomplete information.

Delete: Request deletion, subject to legal exceptions and valid retention needs.

Portability: Receive eligible information in a structured, commonly used format where required.

Restrict or object: Limit or object to certain processing, including direct marketing or processing based on legitimate interests where applicable.

Withdraw consent: Withdraw consent prospectively where processing relies on consent, without affecting earlier lawful processing.

Opt out: Opt out of marketing and, where applicable, targeted advertising, sale, sharing, or qualifying profiling.

Appeal or complain: Appeal a denied request where required or complain to an applicable data-protection authority.

To make a request, contact [email protected]. Describe the request and the relevant account, service, profile, or integration. We may verify identity, account relationship, or authority; use an authorized agent process where required; and deny or limit a request where law permits. We do not discriminate against a user for exercising an applicable privacy right.

We also cooperate with verified requests from customers, sellers, and platform partners when they act as the primary controller and require our assistance as a service provider or processor.

SECTION 10

Children, Changes, Complaints, and Contact

Children

NoxInfluencer services are intended primarily for business and professional users and are not directed to children under 13 or any higher minimum age required by applicable law. We do not knowingly collect Personal Data from a child in violation of applicable law. A parent or guardian who believes a child provided Personal Data may contact us for review and appropriate deletion.

Changes to This Policy

We review this policy at least annually and when material legal, product, platform, vendor, data-location, security, or data-flow changes occur. We will post the updated policy with a revised effective or last-updated date. If a material change requires additional notice or consent, we will provide it through an appropriate channel before the change takes effect where required.

Complaints

We investigate written privacy complaints and aim to respond within a reasonable period or the timeframe required by applicable law. A complaint should identify the service, account or data involved, the concern, and a reliable contact method. An individual may also contact an applicable supervisory or data-protection authority.

Contact

Controller: NOX INFLUENCER LLC

Privacy and Security Owner: Rodney Dean Marquez

Email: [email protected]

Website: https://www.noxinfluencer.com/contact

Location: United States

DPO status: No formally appointed Data Protection Officer. Rodney Dean Marquez serves as the internal Privacy and Security Owner.

Revision Record

Version 1.0, effective 23 July 2026. Summary: Replaced the prior public privacy statement; updated controller identity, modernized lifecycle and rights disclosures, and added current Google/Gmail and TikTok Shop integration terms.

Publication Note: This public policy describes the currently confirmed operating model. Product teams must update it before materially changing data categories, purposes, human access, platform permissions, storage location, retention, or recipients.