Privacy Policy

Nordic Connect, operated by Nordic Media. Last updated: 10 August 2026.

This policy explains what personal data Nordic Media ("we", "us") collects through Nordic Connect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to the Nordic Connect web application and to the data we access from third-party platforms you choose to connect.

Nordic Media is a trading name of Nordic Filmworks LTD, a company registered in Alberta, Canada.

1. Who we are and our role

Nordic Connect is a client-management and social analytics platform operated by Nordic Media, a marketing agency established in Alberta, Canada. We are accountable for the personal information under our control, and our Privacy Officer can be reached at privacy@nordic.media.

For information about our own account holders and website visitors, we determine the purposes of the processing ourselves. For information we handle inside a client workspace on that client's instructions — their contacts, their conversations, their connected social accounts — the client remains accountable for it and we act only as their service provider under a written agreement, using it solely to deliver the service.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA). Where a client or an individual is located in the United Kingdom or the European Economic Area, we also apply the additional rights described in section 8 to that individual's information.

2. Data we collect

Account data

The name and email address of each authorised user, provided through Google sign-in, and the workspaces that user may access. We do not receive or store your Google password.

Client relationship data

Contact records our clients add to their workspace (name, email address, telephone number, tags, notes), message history with those contacts, and campaign delivery status. This data is supplied by the client and stored in a database schema isolated to that client.

Connected platform data

When a user connects a social account, we store an encrypted access token and retrieve only the data the granted permissions allow. See section 3 for the platform-by-platform detail.

Technical data

Request logs containing IP address, browser user-agent, requested URL and timestamp, kept by our hosting provider for security, abuse prevention and debugging.

We set three strictly-necessary cookies, all of them HttpOnly and none of them used for tracking or advertising:

nc_gate — keeps you signed in after Google sign-in. Without it every page would ask you to sign in again.
nc_client — records which client workspace you currently have open, so each request loads that workspace and no other.
nc_role — records whether you are viewing as the agency or previewing as the client, so the interface shows the right one.

We do not use advertising or third-party tracking cookies on this application, and we do not build advertising profiles.

3. Data obtained from connected platforms

We access third-party platform data only after a user with authority over that account completes the platform's own OAuth consent screen, and only within the scopes granted there. Access can be withdrawn at any time from the platform's own settings, or by disconnecting the account inside Nordic Connect.

TikTok

Where a user connects a TikTok account through the TikTok API, we access:

Basic profile information — the account's open ID, display name, username, avatar URL and follower/following counts, used to identify the connected account in the interface.
Video list and performance data — the account's own published videos and their view, like, comment and share counts, used to produce the analytics dashboards and reports the account holder has asked us to produce.
Content publishing — where the account holder enables it, we send video content that the account holder has created and scheduled in Nordic Connect to their own TikTok account on their instruction. We do not publish anything automatically or without that instruction.

TikTok data is used solely to provide these features to the account holder who connected the account. We do not sell it, do not use it for advertising or profiling, do not use it to train machine-learning models, and do not disclose it to any third party other than the infrastructure sub-processors listed in section 6. Our use of information received from the TikTok API adheres to the TikTok Developer Terms of Service. Aggregated metrics derived from this data are retained as described in section 7; on disconnection or deletion request the underlying tokens and platform data are deleted as described in section 8.

Other platforms

On the same basis we access page and account metadata, audience counts, post-level engagement and insights metrics, and (where enabled) publishing permissions from Meta (Facebook and Instagram) and YouTube.

X works differently, and it is worth being exact about it. The follower and post-engagement figures we chart for an X profile are read from publicly available data using our own application credentials, not using the account holder's authorisation — so an X profile that is only being measured does not have to authorise anything. Connecting an X account through its OAuth consent screen is what allows Nordic Connect to post to that account on the account holder's instruction.

Where a client tracks competitors, we collect only publicly available metrics exposed by those platforms' official APIs.

Google API Services

Where a client connects a Google account, we request only the permissions the connected feature needs.

YouTube — we read the channel's statistics and its own analytics, upload videos the client prepared here, and remove a video the client unpublishes here.

Google Calendar — on the calendars the account owner chooses to connect, we:

read existing events over the period being shown, so that we can display availability and avoid double-booking a time that is already taken;
create an event when a booking is made in Nordic Connect; and
delete that event if the booking is cancelled in Nordic Connect.

We delete only events Nordic Connect itself created, and we never modify an existing calendar event — events already in the calendar are read to check availability and are otherwise left untouched. We do not read calendars the account owner has not connected to a bookable calendar here.

Nordic Connect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to train AI models and is deleted when the connection is removed.

4. Why we use it, and the consent we rely on

We identify our purposes before or at the time we collect information, and we collect only what is necessary for them. Those purposes are:

To provide the service — dashboards, reports, publishing and the message inbox, for the account holder who asked for them.
To send messages you initiate — SMS and email that you or your client compose. Recipients are contacted on the basis of consent obtained and recorded by the client, as required by Canada's Anti-Spam Legislation (CASL) and, for recipients elsewhere, the equivalent local rules.
To generate written summaries and content scores — we send limited post text and engagement figures to our AI provider to produce advisory summaries for the account holder. Contact records and message contents are not used for this purpose.
To keep the service secure and working — logging, monitoring and abuse prevention.
To meet legal and regulatory obligations — responding to lawful requests and meeting our record-keeping duties.

We rely on the consent of the individual concerned, obtained by us or by the client acting as their organisation, except where the law permits collection, use or disclosure without consent (for example to investigate a breach of an agreement or to comply with a court order). Consent may be withdrawn at any time, subject to legal or contractual restrictions and reasonable notice — contact us and we will explain the consequences of withdrawal.

We will not use your information for a new purpose without first obtaining consent. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. Automated decision-making

Nordic Connect produces AI-generated summaries, sentiment indicators and content scores. These are advisory only, are shown to a human operator, and are never used to make a decision that produces a legal or similarly significant effect on an individual without human involvement.

6. Who we share data with

We share personal data only with service providers acting on our instructions:

Cloudflare — application hosting, edge network and file storage.
Neon — managed PostgreSQL database hosting.
Google — authentication for sign-in; platform APIs where connected.
Twilio — SMS delivery. SendGrid (Twilio) — email delivery.
Anthropic — AI text generation for the summary and scoring features. Data sent is not used to train their models.
The social platforms a user chooses to connect, for the purposes described in section 3.

We may also disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition, in which case we will notify affected controllers.

7. Storage outside Canada, and retention

Most of the providers listed above store and process information outside Canada, principally in the United States and the European Union. While information is in another country it is subject to that country's laws, and may be accessible to its courts, law enforcement and national security authorities under those laws. We remain accountable for it and require each provider by contract to protect it to a comparable standard. Where information originates in the UK or EEA, transfers additionally rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. You may contact our Privacy Officer for more information about our policies and practices regarding service providers outside Canada.

We keep data no longer than needed:

Contact and conversation records — for the life of the client workspace, then deleted within 90 days of the workspace closing.
Connected-platform access tokens — until the account is disconnected or the token is revoked, then deleted immediately.
Metrics retrieved from connected platforms — retained for the life of the workspace so that historical and year-on-year reporting works.
Images and video uploaded for publishing — held in our object storage for the life of the workspace, so that a published post's media stays available.
Request and security logs — retained by our hosting provider under its own retention policy; we do not keep a separate copy.

8. Your rights and how to delete your data

Subject to applicable law you may ask us to confirm what personal information we hold about you, how we have used it and to whom we have disclosed it; to correct information that is inaccurate or incomplete; to delete it; and to withdraw your consent to further use. If you are in the UK or EEA you may additionally request restriction of or object to processing, and request a portable copy. Where we hold the information on a client's behalf we will pass your request to that client and support them in answering it.

Email privacy@nordic.media and we will respond within 30 days. There is no charge for a reasonable request.

To delete data associated with a connected platform account:

TikTok — disconnect Nordic Connect from your TikTok account settings, or email privacy@nordic.media from the address associated with the account. We delete the stored access token and the retrieved TikTok profile and video data within 30 days and confirm in writing.
Facebook and Instagram — remove the app in your Facebook settings, which sends us an automatic deletion signal we act on, or email us as above.
Any other platform — disconnect it in Nordic Connect, or email us as above.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca). If you are in the UK you may complain to the Information Commissioner's Office (ico.org.uk); in the EEA, to your local supervisory authority.

9. Security

Data is encrypted in transit with TLS and at rest by our hosting providers. Third-party access tokens are additionally encrypted at rest with a key held outside the database. Each client workspace is isolated in its own database schema. Signing in is normally done with Google sign-in, which we restrict to an allowlist of individually approved Nordic Media addresses; a shared access password issued by Nordic Media also grants a session during the current transition, and is being retired in favour of the allowlist. No system is perfectly secure, but we will notify affected controllers and, where required, the relevant regulator of a qualifying personal data breach without undue delay.

10. Children

Nordic Connect is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, contact us and we will delete it.

11. Text messages (SMS)

Some services send SMS — most commonly a one-time code to verify that a phone number belongs to the person entering it. These messages are sent only in direct response to a request: a code is never sent unless someone asks for one. This includes MineWars (playminewars.com), a game server operated by Nordic Filmworks LTD, where a player entering their number in game receives a verification code from us.

We do not share mobile numbers. Phone numbers collected for SMS are never sold, rented, or shared with third parties or affiliates for their own marketing. They are passed only to our messaging carrier (Twilio) for the sole purpose of delivering the message you asked for.
Message frequency. Verification messages are sent once per request, when you ask for a code. Where a service sends other notifications, frequency varies with your own activity — for example a booking confirmation or reminder. We do not send recurring marketing by SMS.
Message and data rates may apply. Your mobile carrier may charge for messages you receive, according to your plan.
Stopping messages. Reply STOP to any message to opt out, or HELP for help. Opting out of a verification code will mean you cannot complete phone verification for that service.

12. Changes to this policy

We may update this policy as the service changes. The "last updated" date above always reflects the current version, and we will notify account holders by email of any change that materially reduces their rights before it takes effect.

13. Contact

Privacy questions and requests: privacy@nordic.media. General enquiries: info@nordic.media. See also our Terms of Service.