Nectar Social Privacy Policy

1. Introduction and Scope

Effective Date and Last Updated: September 8, 2026

Mihafa, Inc., a Delaware corporation doing business as Nectar Social (“Nectar,” “we,” “us,” or “our”), provides this Privacy Policy to describe how we collect, use, disclose, and otherwise process Personal Information in connection with our websites, platform, applications, and related services.

This Privacy Policy applies to the following properties and interactions (collectively, the “Services” unless otherwise defined):

• The website located at nectarsocial.com (the “Site”);
• The Nectar platform, including all associated applications, tools, and features;
• Events hosted or sponsored by Nectar;
• Sales and marketing interactions, including demos, webinars, and promotional communications;
• Customer support and related service interactions.

Nectar is an AI-native social operating system that supports engagement, moderation, social listening, creator and influencer workflows, publishing, competitive intelligence, analytics, customer engagement, lead generation, and commerce conversations through social-media APIs and integrations.

By accessing or using the Services, you acknowledge that you have read this Privacy Policy. If you provide Personal Information on behalf of another individual, you represent that you have authority to do so and to permit us to process that information as described here. Defined terms not introduced in this Section 1 are set out in Section 2 (Definitions).

2. Definitions

The following capitalized terms have the meanings set forth below when used in this Privacy Policy. Other capitalized terms are defined where they first appear.

• “Customer” means an entity or individual that enters into a contract with Nectar for the Services.
• “Customer Data” means any data, content, or information submitted by or on behalf of a Customer to the Services, or collected or processed through the Services on a Customer’s behalf, including Personal Information contained therein. Customer Data does not include De-Identified Insights Data.
• “De-Identified Insights Data” means data derived from Customer Data that has been aggregated or de-identified so that it cannot reasonably identify, relate to, describe, be associated with, or be linked to any Customer or individual, whether directly or indirectly.
• “Nectar,” “we,” “us,” or “our” means Mihafa, Inc., a Delaware corporation doing business as Nectar Social.
• “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual. Personal Information includes equivalent terms under applicable law, such as “personal data.”
• “Services” means the Nectar platform, applications, websites (including nectarsocial.com), events, sales and marketing interactions, support, and related services described in Section 1.
• “Site” means nectarsocial.com and any successor websites operated by Nectar.

3. Our Role: Controller and Processor

3.1 Controller or Business. When Nectar collects or processes Personal Information from Site visitors, direct account users, prospects, event attendees, and individuals who contact us directly, Nectar acts as the controller (or, under applicable U.S. state privacy laws, the business) for that processing. This Policy describes our practices in that capacity.

3.2 Processor or Service Provider. When Nectar processes Customer Data on behalf of a Customer pursuant to a service agreement, Nectar acts as the processor (or service provider) and processes Customer Data in accordance with the Customer’s documented instructions and the applicable contract. The Customer remains the controller or business for that Customer Data.

3.3 Rights Requests for Customer Data. If you are a social-media user, end user, or other individual whose Personal Information is contained in Customer Data, you should direct any access, deletion, correction, or other privacy rights request to the applicable Customer, as that Customer controls the purposes and means of processing. If you are unable to identify or reach the relevant Customer, you may contact us at [email protected] and we will use reasonable efforts to route your request appropriately.

4. Personal Information We Collect and Sources

Nectar collects Personal Information from the following categories of sources and in the following ways.

4.1 Information You Provide Directly. When you create an account, request a demo, contact us, attend an event, or otherwise interact with us, we may collect: name, business email address, phone number, employer, job title or role, business address, account and profile information, profile image, language preference, communications and support inquiries, event registration details, marketing preferences, billing contact information, payment cadence, and commercial records.

4.2 Information Collected Automatically. When you visit the Site or use the Services, we may collect: IP address, device and browser information, unique identifiers, approximate location derived from IP address, pages visited, referring pages, access times, feature interactions, and data gathered through cookies, pixels, web beacons, local storage, JavaScript, and similar technologies. Section 8 describes these technologies and your choices in detail.

4.3 Social Platform and Integration Data. Through Customer-authorized social platforms and integrations, we may process: social-media handles, usernames, profile information, public posts, messages exchanged with Customers, follower and following lists, reactions, likes, comments, shares, and engagement metrics.

4.4 Sources. We receive Personal Information from Customers, creators, channel partners, resellers, service providers, public sources, social networks, platform integrations, and data brokers or resellers used to verify or supplement business-contact and commercial information.

4.5 Sensitive Information Restrictions. Customers should not submit cardholder data, health information, government identifiers, or other sensitive or special-category information to the Services unless specifically authorized by Nectar in writing and supported by the applicable Service configuration.

5. How We Use Personal Information

We use Personal Information for the purposes described below. Where we act as a processor or service provider, we process Customer Data in accordance with the applicable Customer’s instructions and agreements.

• Providing, securing, maintaining, supporting, personalizing, and improving the Services.
• Managing accounts, authentication, demos, inquiries, support, customer relationships, billing, and service communications.
• Conducting analytics, diagnostics, research, and feature development.
• Maintaining records and enforcing our terms of service.
• Preventing fraud, abuse, and other harmful activity.
• Complying with legal obligations and responding to lawful requests.
• Facilitating corporate transactions such as mergers, acquisitions, or asset transfers.
• Sending marketing and promotional communications, subject to your preferences and applicable law.

For individuals in the European Economic Area, United Kingdom, and Switzerland, our legal bases for processing depend on the context and include: (a) performance of a contract, for example when we provide the Services you or your organization have requested; (b) our legitimate interests, such as improving the Services, preventing fraud, and conducting direct marketing to business contacts, where those interests are not overridden by your rights; (c) compliance with a legal obligation; and (d) your consent, where we have specifically requested it, such as before activating optional cookies or tracking technologies. You may withdraw consent at any time as described in Section 8, without affecting the lawfulness of processing carried out before withdrawal.

6. Artificial Intelligence

6.1 Nectar uses artificial intelligence across its Services, including engagement, moderation, social listening, analytics, creator and influencer workflows, publishing, competitive intelligence, and commerce conversations.

6.2 Nectar does not use Customer Data to train, fine-tune, or improve any AI models, whether Nectar’s own or those of third parties. Customer Data is processed solely for inference and the delivery of Customer-directed Services.

6.3 Third-party AI providers that process Customer Data do so only to provide contracted services to Nectar and its Customers. These providers are contractually prohibited from using Customer Data, customer inputs, or generated outputs for their own purposes, including model training or improvement.

6.4 Nectar may use De-Identified Insights Data for diagnostics, security, analytics, product development, and improvement of products, services, and models. Nectar maintains reasonable technical and organizational measures designed to prevent re-identification, keeps such data in de-identified form, does not attempt to re-identify it, and contractually requires recipients to follow equivalent restrictions.

6.5 Nectar does not use Personal Information for automated decisions that produce legal or similarly significant effects concerning employment, credit, housing, insurance, education, or access to essential services.

7. Disclosures of Personal Information

Nectar may disclose Personal Information to the following categories of recipients for the purposes described in this Policy.

• Service Providers and Subprocessors. Nectar engages service providers and subprocessors that process Personal Information on Nectar’s behalf for hosting, security, support, analytics, billing, professional services, communications, and AI inference. A current list of subprocessors is available at https://privacy.nectarsocial.com/subprocessors.
• Customer-Authorized Social Platforms and Integrations. When a Customer connects a social platform or third-party integration, Personal Information may be disclosed to that platform or integration as directed by the Customer.
• Customers. Where Nectar processes Customer Data as a processor or service provider, Nectar discloses Personal Information to the applicable Customer in accordance with the Customer’s instructions and the governing agreement.
• Affiliates. Nectar may share Personal Information with its corporate affiliates for purposes consistent with this Policy.
• Professional Advisers, Authorities, and Legal Requirements. Nectar may disclose Personal Information to legal counsel, auditors, consultants, and governmental or regulatory authorities as required by law, legal process, or to protect rights, safety, or property.
• Corporate Transactions. In connection with a merger, acquisition, reorganization, financing, or sale of assets, Personal Information may be disclosed to transaction parties and their advisers.
• Consent or Direction. Nectar may disclose Personal Information where an individual provides consent or at the direction of a Customer.
• Analytics, Advertising, and Visitor-Identification Partners. Nectar uses Google Analytics, Meta Pixel, RB2B, Leadsy, Cloudflare Web Analytics, and Cloudflare hosting and security services. These partners may receive identifiers, device and browser information, approximate location, referring and visited pages, interaction data, and timestamps, depending on consent settings and configuration. These partners may combine such data with information they independently maintain, subject to their own privacy notices and Nectar’s contractual requirements. Controls applicable to each technology are described in Section 8 (Cookies, Tracking Technologies, and Your Choices).

8. Cookies, Tracking Technologies, and Your Choices

Nectar uses a consent-management system (CookieConsent) hosted within the Site. Analytics and Marketing technologies start disabled for all visitors. Necessary technologies remain enabled to support core Site functionality.

When you first visit the Site, you may choose from the following options:

• Accept All: enables Analytics and Marketing technologies.
• Reject Optional: Analytics and Marketing technologies remain blocked. Only Necessary technologies operate.
• Manage Preferences: select individual categories (Analytics, Marketing) to enable or disable.

Your preferences are stored in your browser for 180 days. You may change your choices at any time through the persistent Cookie Preferences link in the Site footer. When you withdraw consent, optional tracking stops on page reload and configured tracking cookies are cleared.

Nectar recognizes legally recognized universal opt-out signals, including Global Privacy Control (GPC). When GPC is active, Marketing technologies (Meta Pixel, RB2B, and Leadsy) remain blocked. Google Analytics loads only if you affirmatively accept Analytics through the Cookie Preferences control, regardless of GPC status.

Cloudflare Web Analytics is a cookie-less analytics technology that may operate independently of cookie preferences. It does not set cookies in your browser and transmits beacon-based performance data. Cloudflare hosting and security services operate separately for website protection and rate limiting.

Browser-based controls (such as cookie-blocking settings) may supplement, but do not replace, the Site’s Cookie Preferences control.

The following table describes the technologies currently in use. Durations are approximate and may change due to vendor updates, browser behavior, or configuration changes.

9. Sale, Sharing, and Targeted Advertising

9.1 Nectar does not sell Personal Information for monetary consideration.

9.2 Nectar’s use of advertising, marketing, and visitor-identification technologies (including Meta Pixel, RB2B, and Leadsy) may constitute a “sale,” “sharing” for cross-context behavioral advertising, or “targeted advertising” as those terms are defined under certain U.S. state privacy laws. These technologies may receive identifiers, device and browser information, approximate location, page-visit data, interaction data, and timestamps, as described in Section 8.

9.3 Individuals may opt out of such sale, sharing, or targeted advertising through any of the following mechanisms:

• Cookie Preferences: Use the persistent Cookie Preferences link in the Site footer to reject Marketing technologies or withdraw prior consent.
• Global Privacy Control (GPC): Enable a legally recognized universal opt-out signal such as GPC in a supported browser. When GPC is detected, Marketing technologies remain blocked.
• Email Request: Submit an opt-out request to [email protected].

9.4 Nectar does not knowingly sell or share Personal Information of individuals under 16 years of age without any authorization required by applicable law.

10. Data Retention

10.1 Nectar retains Personal Information only as long as reasonably necessary to fulfill the purposes described in this Policy, taking into account the nature and sensitivity of the data, the purposes for processing, applicable legal and contractual obligations, and legitimate business needs such as recordkeeping, dispute resolution, and enforcement of agreements.

10.2 Active Customer Data is generally deleted or de-identified within 90 days after termination of the applicable Customer account, unless a longer period is required by the Customer’s contract, applicable law, or ongoing legal proceedings. Residual copies in encrypted backups may remain isolated until overwritten or deleted in accordance with established backup schedules.

10.3 De-Identified Insights Data may be retained indefinitely because, by definition, it cannot reasonably be linked to any Customer or individual.

10.4 For information about the retention periods and operation of specific cookies and tracking technologies, see the cookie and tracker table in Section 8 (Cookies, Tracking Technologies, and Your Choices). Durations listed there are approximate and may change due to vendor updates, browser behavior, or configuration changes.

10.5 When Personal Information is no longer required under the criteria above, Nectar will delete, de-identify, or anonymize it using commercially reasonable methods.

11. Security

Nectar maintains reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, loss, and destruction. These safeguards are selected and maintained in light of the nature and sensitivity of the information processed, the potential risks to individuals, and applicable legal requirements.

No method of transmission over the Internet or method of electronic storage is completely secure. While Nectar works to protect Personal Information in its care, Nectar cannot guarantee absolute security. If you have questions about the security of your Personal Information, please contact us at [email protected].

12. U.S. State Privacy Rights and California Notice

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Virginia, and other states with applicable privacy laws may exercise the rights described below, subject to verification, applicability, and legal exceptions.

• Right to Know and Access: request the categories and specific pieces of Personal Information Nectar has collected, used, or disclosed about you.
• Right to Correction: request correction of inaccurate Personal Information.
• Right to Deletion: request deletion of Personal Information, subject to permitted exceptions.
• Right to Portability: obtain a copy of your Personal Information in a portable format.
• Right to Opt Out of Sale, Sharing, and Targeted Advertising: opt out through the Cookie Preferences control, a legally recognized universal opt-out signal such as Global Privacy Control, or by contacting [email protected].
• Right to Opt Out of Significant-Decision Profiling: Nectar does not use Personal Information for automated profiling that produces legal or similarly significant effects.
• Right to Appeal: if Nectar denies a request, you may appeal by contacting [email protected].
• Authorized Agents: you may designate an authorized agent to submit requests on your behalf with appropriate verification.
• Nondiscrimination: Nectar will not discriminate against you for exercising your rights.
• Sensitive Information: Nectar does not use or disclose sensitive Personal Information to infer characteristics about individuals.

California Notice: Under the California Consumer Privacy Act, as amended, the following categories of Personal Information have been collected in the preceding 12 months: identifiers and contact data; customer records and commercial information; internet and network activity; approximate geolocation; professional and employment information; communications; social-media content and interactions; and inferences. Nectar may have disclosed each of these categories to service providers for business purposes. Nectar may have shared identifiers, internet and network activity, approximate geolocation, professional and employment information, and related inferences with analytics, advertising, and visitor-identification partners for marketing, measurement, visitor identification, or targeted advertising, depending on consent and configuration. Nectar has not sold Personal Information for monetary consideration. To submit a request, contact [email protected] or use the Cookie Preferences control or Global Privacy Control for sale, sharing, and targeted-advertising opt-outs.

13. EEA, UK, and Switzerland

This Section 13 applies to individuals located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland.

13.1 Your Rights. Subject to applicable law and exceptions, you may exercise the following rights by contacting [email protected]:

• Access: request confirmation of processing and a copy of your Personal Information.
• Correction: request rectification of inaccurate or incomplete Personal Information.
• Deletion: request erasure of your Personal Information.
• Restriction: request that processing be restricted in certain circumstances.
• Portability: receive your Personal Information in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interests, including direct marketing.
• Withdrawal: withdraw consent at any time without affecting the lawfulness of prior processing.
• Complaint: lodge a complaint with your local supervisory authority.

Where Nectar processes Personal Information as a processor on behalf of a Customer, please direct your request to the applicable Customer. You may also contact us at [email protected], and we will forward your request where appropriate.

13.2 Consent and Cookie-Less Analytics. Google Analytics, Meta Pixel, RB2B, and Leadsy require your prior consent before loading. Necessary technologies, including Cloudflare hosting and security, remain active without consent. Cloudflare Web Analytics is a cookie-less analytics technology used for limited website performance and usage measurement based on Nectar’s legitimate interests where permitted by applicable law. Nectar does not claim that Cloudflare Web Analytics is exempt from consent requirements in every jurisdiction.

13.3 International Transfers. Nectar transfers Personal Information to the United States and other locations where its service providers operate. Where required, Nectar relies on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, to protect transferred Personal Information. Nectar does not currently hold a Data Privacy Framework certification.

14. Children, Third-Party Services, and Marketing Communications

14.1 Children. The Services are designed for business use and are not directed to children under 18. Nectar does not knowingly collect Personal Information directly from children under 18. If we learn that we have collected Personal Information from a child under 18 without appropriate authorization, we will take steps to delete that information promptly. Where Nectar processes data concerning minors as part of Customer Data under Customer instructions, the Customer is responsible for ensuring it has the necessary legal basis and authorizations for that processing.

14.2 Third-Party Services. The Services may contain links to, or integrate with, websites, platforms, applications, and services operated by third parties. These third-party services are governed by their own privacy notices and terms, and Nectar is not responsible for their privacy practices or content. We encourage you to review the applicable privacy notice before providing Personal Information to any third-party service.

14.3 Marketing Communications. Nectar may send marketing emails to individuals who have provided their contact information or where otherwise permitted by applicable law. You may unsubscribe from marketing emails at any time by using the unsubscribe link included in each marketing message or by contacting us at [email protected]. Unsubscribe requests will be processed promptly. Opting out of marketing emails does not affect transactional or service-related communications, such as account notifications, security alerts, billing correspondence, or support responses.

15. Changes to This Policy and Contact Information

Nectar may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes, we will post the revised Policy on the Site with an updated “Last Updated” date and, where appropriate, provide additional notice (such as a prominent notice on the Site or an email to account holders). We encourage you to review this Policy periodically.

Your continued use of the Site or Services after a revised Policy becomes effective constitutes your acknowledgment of the updated terms. If you do not agree with any changes, you should discontinue use of the Site and Services.

If you have questions or concerns about this Policy or Nectar’s privacy practices, please contact us:

Mihafa, Inc. (d/b/a Nectar Social)
119 University Avenue
Palo Alto, California 94301
Attn: Legal
Email: [email protected]