Privacy Policy

1. Introduction

NiceLab AS ("Company", "we", "us", or "our"), operating under the brand name CollabNordic, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our mobile app, or use our services.

CollabNordic is for people aged 18 and over. We do not knowingly collect data about anyone younger.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

2. Data Controller

NiceLab AS is the Data Controller for the personal data collected through the Platform.

NiceLab AS Ålgård, Norway Contact: Contact Form

3. Information We Collect

• Personal Identification Information: Name, email address, phone number, postal address.
• Professional Information: Social media handles, portfolio data, brand details, industry niche.
• Financial Information: Payment details (processed securely by our third-party payment processors), transaction history.
• Technical Data: IP address, browser type, device information, and usage data collected via cookies.
• Support Correspondence: The messages you send us through the support chat, the contact form or by email, and our replies. Where you are signed in, a conversation is linked to your account so the agent answering can see who you are and which of our services you are asking about.
• Content You Create: Messages you send other users, offers, campaign briefs, portfolio images and video, and the work you deliver.
• Mobile App Data: If you use the app and allow notifications, the push address of your device, so we can notify you. If you buy a featured spot in the app, the App Store's confirmation of that purchase. Apple processes the payment; we never receive card details.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. For detailed information on the cookies we use and the purposes for which we use them, please see our Cookie Policy.

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual Necessity: To fulfill our contract with you (e.g., facilitating collaborations and payments).
• Legal Obligation: To comply with tax and accounting laws.
• Legitimate Interest: To improve our services, prevent fraud, and ensure platform security.
• Consent: For marketing communications (which you can withdraw at any time).

6. How We Use Your Information

We use the collected data to:

• Provide and maintain the Platform services.
• Process payments and payouts.
• Verify user identities and prevent fraud.
• Communicate with you regarding your account or transactions.
• Comply with legal obligations.

7. Data Sharing and Third Parties

We do not sell your personal data. We share it only with the service providers below, with other users to the extent needed to work together, and with authorities where the law requires it.

Service providers. Each performs a service on our behalf under a written data processing agreement:

Our Data Processing Agreement sets out in detail what each of them receives.

• Other Users: Brands and creators see what is needed to work together, such as your public profile, your offers and your messages to them.
• Legal Authorities: If required by law or to protect our rights.

Our support desk runs on our own servers rather than on a hosted helpdesk, so your conversations are not held by an outside chat or ticketing provider. There is one exception you should know about: we use OpenAI to help our agents draft and summarise replies, so the content of a support conversation may be sent to OpenAI in the United States for that purpose. If you would rather we handled your conversation without that assistance, tell us and we will.

8. International Data Transfers

Your data is stored within the European Economic Area (EEA). Some of the providers listed in section 7 are United States companies and process data there: Cloudflare, Stripe, Google, Apple, Expo and OpenAI. Every one of those transfers is covered by the European Commission's Standard Contractual Clauses, incorporated into our agreement with each provider. Section 6 of our Data Processing Agreement explains why we rely on the Clauses rather than on the EU-US Data Privacy Framework.

9. Your Rights

Under the GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure of your data ("Right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time, where processing is based on consent. Withdrawing it does not affect processing carried out before you withdrew it.

You can delete your account yourself, in the mobile app under Profile, Delete account, or on the website under your account settings. Deletion removes your name, email address, profile and content straight away. It cannot be done while a collaboration is still in progress, because the other party is relying on it; finish or cancel it first. The financial records described in section 10 are kept for as long as the law requires.

To exercise any other right, please contact us.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.

10. Data Retention

We keep personal data only as long as we need it. In practice that means:

• Contracts, invoices and payment records are kept for five years after the end of the accounting year, as required by the Norwegian Bookkeeping Act (bokføringsloven). This applies even if you close your account, because we cannot remove a party from a financial record we are required to retain.
• Contract and claim-related documentation may be kept for up to ten years where we need it to establish, exercise or defend a legal claim.
• Your account and profile are deleted when you ask us to, apart from the records above. We keep a minimal record that the deletion happened.
• Support conversations are kept for two years after the conversation is closed, so we can see the history behind a recurring problem, and are then deleted.
• Everything else is kept only for as long as it serves the purpose it was collected for, and is deleted or anonymised once that purpose ends.

11. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

12. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.