Privacy Policy

Effective Date: March 1, 2026 Last Updated: March 27, 2026

1. Introduction — Who We Are

NEXT90 (“we,” “us,” or “our”) is a cross-media influence intelligence company. We don’t measure channels — we trace influence. Our Insights & Data Engine (IDE) ingests every signal that influences a business — advertising across all channels, weather, demographics, search behavior, news events, viral trends — unifies them into one picture, and makes that picture actionable. We help advertisers, agencies, and publishers understand whether their campaigns across any medium drive real business outcomes.

We operate in two capacities:

• As a website operator. We run the website at n90.co, where we collect limited information from visitors like you.
• As an influence intelligence provider. Our clients deploy a NEXT90 measurement tag on their websites as part of our Insights & Data Engine. The IDE traces influence from any stimulus — TV, radio, digital, CTV, outdoor, direct mail, weather events, news, demographics, and more — through response to conversion. When you visit a client’s website that uses our tag, we collect certain data on their behalf.

This privacy policy covers both roles. We believe transparency is not optional — especially for a company whose business is tracing influence.

NEXT90 [Address] Email: [email protected] Website: n90.co

2. Information We Collect

We collect different categories of information depending on how you interact with us.

On Our Website (n90.co)

We do not collect sensitive personal information on our website. We do not collect financial information, biometric data, precise geolocation, or Social Security numbers.

Through Our Measurement Technology (on Client Websites)

When you visit a website that uses the NEXT90 measurement tag, we may collect:

Section 5 below explains our measurement technology in detail.

3. How We Use Your Information

We use the information we collect for the following purposes:

On our website:

• To respond to your inquiries, demo requests, and communications
• To understand how visitors use our website and improve it
• To send you information you have requested about our services
• To maintain website security and prevent fraud

Through our measurement technology:

• To measure the effectiveness of our clients’ advertising and influence campaigns across all channels
• To trace the connection between any stimulus — advertising, weather, news events, demographic shifts, and more — and the response it generates
• To generate aggregated, statistical reports for our clients
• To improve our measurement methodology and accuracy

For audience intelligence and activation:

• To build primary audiences based on observed response patterns (e.g., people who visited a client’s website after exposure to a specific stimulus)
• To create geographic audience segments — identifying areas with specific traits (response patterns, demographic characteristics, environmental conditions) that can be activated through data onboarding
• To onboard aggregated or modeled data to data management platforms or clean rooms, where it may be used to create expanded look-alike audiences or negative (suppression) audiences on behalf of our clients
• To support our clients’ media optimization by enabling audience-based targeting informed by measured influence data

Legal bases for processing (for visitors from the EU/EEA):

• Consent — for analytics cookies and non-essential tracking on our website
• Legitimate interest — for website security, fraud prevention, and service improvement
• Contract performance — to fulfill requests you make through our website (demo requests, contact forms)
• Legitimate interest of our clients — for measurement data collected via the NEXT90 tag on client websites, where our clients have a legitimate interest in understanding the effectiveness of their advertising

4. How We Collect Information — Cookies and Tracking Technologies

Cloudflare Zaraz (Server-Side Tag Management)

We use Cloudflare Zaraz to manage analytics and measurement tools on n90.co. This is a meaningful privacy choice. Unlike traditional tag managers that load third-party JavaScript directly in your browser, Zaraz processes tracking requests server-side at Cloudflare’s edge network.

What this means for you:

• Third-party scripts do not execute in your browser. Analytics and measurement code runs on our server infrastructure, not on your device.
• Third-party services do not directly access your browser or set third-party cookies through our site.
• Your IP address can be anonymized before being forwarded to analytics providers.
• Data is minimized at the edge — personally identifiable information can be stripped before it reaches third-party services.

Even with these protections, we still disclose all data collection below because you have a right to know what data is collected regardless of where it is processed.

Google Analytics 4

We use Google Analytics 4 (GA4), loaded through Cloudflare Zaraz, to understand how visitors use our website. GA4 uses first-party cookies to distinguish unique users and track sessions.

What GA4 collects: Pages visited, session duration, engagement events, browser and device information, approximate geographic location, and referral source.

What GA4 does not receive from us: Your name, email address, or other directly identifying information. GA4 processes but does not store full IP addresses.

Your choices:

• You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on
• You can manage cookie preferences through our cookie consent controls
• Google’s privacy policy: https://policies.google.com/privacy

Cloudflare Web Analytics

We also use Cloudflare Web Analytics, a privacy-friendly analytics tool that does not use cookies and does not collect personal data. It provides aggregate traffic metrics without tracking individual visitors.

Cookies We Set

We do not set or allow third-party cookies on n90.co.

5. Our Measurement Technology

This section describes the NEXT90 measurement tag and our Insights & Data Engine (IDE) — the core technology behind our business. We believe you should understand what it does, what data it collects, and how you can opt out.

What the Tag Does

The NEXT90 measurement tag is a small piece of JavaScript code that our clients place on their websites. It is part of our Insights & Data Engine (IDE), which traces influence from any stimulus to response to conversion. The tag captures the response and conversion signals — whether people who were exposed to an advertising or influence stimulus subsequently visited the advertiser’s website or took a specific action (like making a purchase or filling out a form).

The NEXT90 tag is deployed on our clients’ websites, not on n90.co itself.

How It Works

1. Our clients run advertising and influence campaigns across any combination of channels — TV, radio, digital, CTV, outdoor, direct mail, and more. The IDE also ingests non-advertising signals like weather, demographics, search behavior, news events, and viral trends.
2. The NEXT90 tag on the client’s website records information about visitors — including anonymized identifiers, page visits, and conversion events.
3. Using our proprietary methodology built on three pillars — Context, Geography, and Time — the IDE traces the full chain from stimulus to response to conversion. Rather than crediting the last touchpoint, we trace back to the actual stimulus and every influence along the way.
4. We deliver aggregated, statistical measurement reports to our clients showing which stimuli actually drove business outcomes.
5. From measured response data, we may build audience segments — primary audiences based on observed behavior, geographic audiences based on area-level traits, or modeled look-alike and negative audiences. These audiences may be onboarded to data management platforms or clean rooms for activation.

Audience Creation and Data Onboarding

In addition to measurement reporting, the IDE can produce actionable audience intelligence:

• Primary audiences. Groups of people or households that exhibited a measured response to a specific stimulus or combination of stimuli.
• Geographic audiences. Areas (zip codes, DMAs, custom geographies) that share specific response traits, demographic characteristics, or environmental conditions. These geographic segments can be onboarded as targetable audiences.
• Look-alike audiences. Modeled audiences that resemble a primary audience, created through data onboarding to a data management platform or clean room environment.
• Negative audiences. Suppression segments — people who have already converted or are not responding — used to reduce wasted spend.

When audience data is onboarded to a third-party platform, we use privacy-safe methods: clean room environments, aggregated or modeled data, and contractual restrictions on downstream use. Individual-level personally identifiable information is not shared directly with advertising platforms for targeting.

Cross-Device and Cross-Context Correlation

Our technology performs cross-context measurement — connecting stimulus exposure across any channel (one context) with web behavior (a different context). This is a form of cross-context correlation.

We want to be clear about what this means:

• We use probabilistic methods, not deterministic tracking, to correlate stimulus exposure with website activity.
• We do not build individual profiles for ad targeting purposes.
• We do not sell the data we collect to third parties.
• The output of our measurement is aggregated campaign performance data, not individual-level targeting data.

What the Tag Collects

When you visit a website that uses the NEXT90 measurement tag, it may collect:

• IP address — used for geographic analysis and as one input for probabilistic matching, then hashed or truncated
• Device and browser information — browser type, operating system, screen resolution, language setting
• Page activity — URLs visited, timestamps, referral source, conversion events defined by the client
• Cookie identifiers — first-party cookies set by the tag to distinguish returning visitors

What the Tag Does Not Do

• It does not collect your name, email address, phone number, or other directly identifying information
• It does not access your browsing history on other websites
• It does not serve advertisements directly
• It does not collect sensitive personal information (health, financial, biometric, etc.)

Note: Data collected by the tag may be used to build audience segments for advertising activation (see “Audience Creation and Data Onboarding” above). You can opt out of this use through the mechanisms below.

How to Opt Out of NEXT90 Measurement and Audience Creation

You have several options:

• Global Privacy Control (GPC): If your browser sends a GPC signal, we honor it. See Section 11.
• Browser cookie settings: You can block or delete first-party cookies from any website. This will prevent the NEXT90 tag from recognizing return visits.
• Contact us directly: Email [email protected] to request that data associated with your device be deleted or excluded from audience segments.
• Client website preferences: Many of our clients offer their own cookie consent and opt-out mechanisms. If you opt out of analytics or measurement cookies on a client’s website, the NEXT90 tag will respect that choice.

If you opt out, your data will not be used for measurement, audience creation, or any downstream activation. Opting out does not affect data that has already been aggregated into audience segments prior to your request, as aggregated data cannot be disaggregated to identify individuals.

6. How We Share Your Information

We share personal information only in the following circumstances:

Service Providers

We use service providers who process data on our behalf under contract:

• Cloudflare — website hosting, security, server-side tag management (Zaraz), and privacy-friendly web analytics
• Google — website analytics (GA4)
• Cloud infrastructure providers — data storage and processing for our measurement platform

These providers are contractually required to use your data only as directed by us and to maintain appropriate security measures.

Data Management Platforms and Clean Rooms

For audience creation and activation purposes, we may onboard aggregated or modeled data to data management platforms (DMPs) or clean room environments. These platforms are used to create look-alike audiences, negative audiences, and geographic audience segments on behalf of our clients. Data shared with these platforms is aggregated, modeled, or de-identified — we do not upload raw personally identifiable information for audience onboarding. These platforms operate under contractual restrictions that limit how onboarded data may be used.

Our Clients (for Measurement and Audience Data)

When you visit a client’s website that uses our measurement tag, we share aggregated measurement reports and, where applicable, audience segments with that client. These reports contain statistical campaign performance data. Audience segments are based on aggregated response patterns, geographic traits, or modeled attributes — not individual-level browsing data or personally identifiable information.

Legal Requirements

We may disclose information if required to do so by law, regulation, legal process, or governmental request; to enforce our terms of service; or to protect the rights, safety, or property of NEXT90, our clients, or others.

Business Transfers

If NEXT90 is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via our website.

No Sale of Personal Information

We do not sell your personal information. We have not sold personal information in the preceding 12 months.

7. “Do Not Sell or Share” My Personal Information

Under the California Consumer Privacy Act (CCPA) and similar state laws, “sharing” has a specific legal meaning: making personal information available to a third party for cross-context behavioral advertising.

NEXT90 does not sell personal information.

With respect to sharing: our influence intelligence technology involves making certain data (IP addresses, device identifiers, browsing activity on client websites) available to NEXT90 as a third party relative to our clients’ website visitors. This data is used for influence measurement and, in some cases, to build audience segments that may be activated for advertising purposes through data onboarding to DMPs or clean rooms. We recognize that these uses may constitute “sharing” under the CCPA’s broad definition.

For this reason:

• We honor Global Privacy Control (GPC) signals as a valid opt-out of sharing.
• We provide opt-out mechanisms described in Section 11.
• Our clients are responsible for providing their own “Do Not Sell or Share” mechanisms on their websites.

If you wish to opt out of the sharing of your personal information, you may:

1. Enable Global Privacy Control in your browser
2. Use the opt-out mechanisms on the client website where you encountered our tag
3. Email us at [email protected]

8. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy.

After the retention period expires, personal data is deleted or permanently anonymized. Specific retention periods for measurement data may vary based on contractual agreements with our clients.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information. We honor these rights regardless of which specific state law applies to you.

Rights Available Under US State Privacy Laws (CCPA/CPRA and 18 Other State Laws)

• Right to Know. You can request that we disclose what personal information we have collected about you, the categories of sources, our purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to Delete. You can request that we delete personal information we have collected from you, subject to certain exceptions (legal obligations, completing transactions, security).
• Right to Correct. You can request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing. You can opt out of the sale or sharing of your personal information. See Section 7.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised a privacy right.

Additional Rights for EU/EEA Residents (GDPR)

• Right of Access. You can request a copy of the personal data we hold about you.
• Right to Rectification. You can request that we correct inaccurate or incomplete data.
• Right to Erasure. You can request deletion of your personal data under certain circumstances.
• Right to Restrict Processing. You can request that we limit how we use your data.
• Right to Data Portability. You can request your data in a structured, commonly used, machine-readable format.
• Right to Object. You can object to processing based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent. Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
• Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority in your member state.

How to Exercise Your Rights

You can submit a privacy rights request by:

• Email: [email protected]
• Mail: NEXT90, [Address]

We will verify your identity before processing your request. We respond to all verified requests within 45 days (as required by CCPA) or 30 days (as required by GDPR). If we need additional time, we will notify you of the extension and the reason.

You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may still verify your identity directly.

A note about measurement data: If your request relates to data collected through our measurement tag on a client’s website, we may need to coordinate with that client to verify and fulfill your request. We will still respond within the required timeframes.

10. Opt-Out Mechanisms

We provide multiple ways for you to control data collection:

Global Privacy Control (GPC)

We recognize and honor the Global Privacy Control signal. If your browser or a browser extension sends a GPC signal, we will treat it as a valid opt-out of the sale or sharing of personal information, as required by the CCPA and other applicable state laws. No further action is needed on your part.

Learn more about GPC at globalprivacycontrol.org.

Cookie Consent on n90.co

When you visit our website, you can manage your cookie preferences through our consent controls. You can decline non-essential cookies, which will prevent GA4 from collecting data about your visit.

Google Analytics Opt-Out

You can install the Google Analytics Opt-Out Browser Add-on to prevent Google Analytics from collecting data across all websites you visit.

NEXT90 Measurement Tag Opt-Out

To opt out of data collection by the NEXT90 measurement tag on client websites:

• Enable GPC in your browser (honored automatically)
• Use the cookie consent or opt-out tools provided by the client’s website
• Block or delete first-party cookies in your browser settings
• Email [email protected] to request deletion of data associated with your device

Do-Not-Track Signals

Some browsers offer a “Do Not Track” (DNT) setting. There is no universal standard for how websites should respond to DNT signals. We do, however, honor GPC signals, which serve a similar purpose with legal recognition in multiple states.

11. International Data Transfers

NEXT90 is based in the United States. If you are visiting our website or interacting with a client website that uses our measurement technology from outside the United States, your information will be transferred to and processed in the United States.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary measures as needed based on transfer impact assessments

By using our website or interacting with websites that use our measurement technology, you acknowledge that your data may be processed in the United States, where data protection laws may differ from those in your jurisdiction.

If you have questions about international data transfers, please contact us at [email protected].

12. Data Security

We take the security of your information seriously and implement appropriate technical and organizational measures to protect it, including:

• Encryption of data in transit (TLS/HTTPS on all connections)
• Encryption of data at rest
• Access controls limiting who within our organization can access personal data
• Regular security assessments and monitoring
• Cloudflare’s enterprise security infrastructure, including DDoS protection and web application firewall
• Contractual security requirements for all service providers and sub-processors

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

13. Children’s Privacy

Our website and measurement services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information as promptly as possible.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

Our measurement tag is deployed on client websites across various industries. We contractually require our clients to comply with all applicable laws, including COPPA, and not to deploy our tag on websites directed at children under 13.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Post the revised policy on our website
• For material changes that affect how we handle personal information, provide notice through our website at least 30 days before the changes take effect

We encourage you to review this policy periodically. Your continued use of our website or services after any changes indicates your acceptance of the updated policy.

15. Contact Us

If you have questions about this privacy policy, want to exercise your privacy rights, or have concerns about how we handle your information, please contact us:

NEXT90 Attn: Privacy [Address] Email: [email protected]

For GDPR-related inquiries, you may also contact our privacy team at the email address above. We will respond to all inquiries within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

16. Additional Disclosures

For California Residents

This entire policy is designed to comply with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). The rights and disclosures described throughout apply to California residents. In particular:

• Categories of personal information collected are detailed in Section 2.
• Business purposes for collection are detailed in Section 3.
• Categories of third parties are detailed in Section 6.
• Sale and sharing disclosures are in Section 7.
• Your rights are in Section 9.
• Retention periods are in Section 8.

We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA Section 1798.121.

For Residents of Other US States with Privacy Laws

As of 2026, 19 US states have comprehensive consumer privacy laws in effect. We extend the rights described in Section 9 — including the right to know, delete, correct, and opt out — to residents of all states with applicable privacy laws. If your state law provides rights not specifically listed here, please contact us and we will work with you to honor your request.

For EU/EEA Residents

Our legal bases for processing are described in Section 3. Our data protection contact for EU inquiries is [email protected]. International transfer mechanisms are described in Section 11. The provision of personal data on our website is voluntary; you are not required to provide any personal information, but certain features (such as contact forms) may not function without it.

Automated Decision-Making

NEXT90’s Insights & Data Engine uses statistical models and probabilistic methods to trace the connection between stimuli — across all channels and influence signals — and web activity. This processing produces aggregated campaign performance reports for our clients — it does not make automated decisions about individuals that produce legal or similarly significant effects. If our use of automated processing changes in a way that affects individual rights, we will update this policy and provide appropriate notice and opt-out mechanisms.