Privacy notice

Section 1Who we are

SeeForth Services Ltd, trading as Nightly Studio, is the controller of the personal data this notice describes. The exception is enquiries sent through a page's form, where we act for the page's owner (see section 11).

We're registered in England and Wales, company number 09793300. Registered office: 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom.

We're a small company and don't have a data protection officer. Email hello@nightlystudio.com about anything in this notice.

Section 2What we collect

When you sign up and sign in

• Your email address, and your name if you give it. Your account holds the websites you make.
• If you choose "Continue with Google": from Google, an ID for your Google account, your email address, whether Google has verified it, and your name. If you choose "Continue with Apple": from Apple, an ID for your Apple account and your email address, and your name the first time. Apple may give us a private relay address instead of your real one, and emails we send to it reach you through Apple. We never receive your Google or Apple password, and we can't see or use anything else in those accounts.
• If you choose email: a one-time sign-in link and 6-digit code we email you. We keep only a scrambled copy (a hash) of each, and each works once, for 15 minutes.
• Which browsers are signed in to your account, and when each was last used.
• If you made a website with us before you had an account, with the same email address: we show it in your account, and add it when you ask us to. You can also add one by pasting its link from our emails. If that website was made with another email address, we email that address first to ask, saying which account asked, and add it only if they say yes.

When you set up your website

• Your answers: whether your business is new, what kind of business it is, where you're based, its name, a phone number if you give one, your current website if you have one, anything else you tell us about it, and the photos and logo you add.
• Where you're based is filled in from the town or area your connection appears to be in, which Cloudflare works out from your IP address. You can change it. We don't keep it unless you keep it as your answer.
• "Find your business on Google": the words you type in the search box, and the listing you choose. From that listing we receive its name, type, address, phone number, opening hours, website, star rating, number of reviews, up to 5 reviews with the name each reviewer shows on Google, and up to 8 photos with the name of whoever posted each one. Only the reviews and photos you tick go on your website. Reviews and photos belong to the people who wrote or took them: we keep each one's name with it, as Google requires, and photos your customers posted start unticked.

When you send a brief

• Your answers: your business name and what it does, your offer, your customers, the facts and reviews you give us, your button wording and link, your tone, words to avoid, your look, country, spelling and time zone. Reviews can include your customers' names.
• Your email address: to send you a link to finish your brief later and one reminder if you haven't sent it, the email when your page is ready, and messages about your project.
• Your answers as you type them, once you've given your email on the first screen of the brief, so you can finish it later on any device.
• The boxes you tick: that you're a business or sole trader, that your facts are true and, if you give us a website you like, that your page will be original.
• A website whose look you like, and what you like about it, if you give one. We use it for direction only.
• Your logo and photos, if you add them, and what you say is in each photo. We remove location, camera and other details stored inside the files before we keep them. Your photos may show people: you confirm that anyone recognisable has agreed.
• Your current website's address, if you paste it, and the text of that public page, which we use to draft your answers.
• If you use the voice interview (section 4a): a written transcript of the conversation, anything you paste into it, and the websites you name. We don't keep a recording of your voice.
• If your brief may use words from a website (your own site as the style reference, or the site we drafted your answers from): the contact email addresses that website shows publicly, on its home and contact pages. We read them to offer you a quick check that the site is yours. We keep a record of the check: which address we sent the confirm link to, when, and whether it was confirmed. If you choose one of the site's own addresses, we email that address once with the link, and whoever reads it can say yes or no.
• Change requests you send from your project page, and emails you send us.

What we make for you

Your sketch, page, ad images, screenshots, QA receipt and claims ledger. They're built from your brief.

From visitors to pages we build

• Enquiries sent through a page's form: name, email address and message. We store them for the business that owns the page (section 11).
• Reports sent with "Report this page": which page, and what's wrong. The form doesn't ask for a name or email address.

Technical data

• Your IP address, to limit how many requests come from one connection and to stop abuse. We don't store the address itself. We store a hash: a one-way code made from the address and a secret key. It lets us count requests without keeping your IP address. A hash still counts as personal data, so we keep it only for a short time.
• Technical logs, such as the time of a request, the page asked for, errors and browser type. Cloudflare also uses IP addresses to deliver pages and block attacks.
• A record of each project: when the brief arrived, how the build and checks went, whether the page was published, and what the AI cost us.

What we don't collect

No passwords: you sign in with Google, Apple or a code we email you. No card details: if you buy a paid plan, you give those to Stripe on its checkout page, and we never see them. We don't need sensitive data, such as health information, so please don't put any in your brief.

Section 3Why we use it, and our lawful bases

UK data protection law says we need a lawful basis for each use. Here are ours.

• To save your brief as you go and email you a link to finish it, with one reminder. Lawful basis: steps you asked us to take before a contract (you started a brief and gave us your email). If you act for a company: our legitimate interest in providing the service the company asked for.
• To make your account, sign you in, keep you signed in, and show you your websites. Lawful basis: contract, because it's how you use the service. If you act for a company: our legitimate interest in providing the service the company asked for.
• To look up your business on Google and fill in your answers from its listing, when you ask us to. Lawful basis: steps you asked us to take before a contract. For the reviewers' and photographers' names that come with the listing: our legitimate interest, and yours, in showing real reviews and photos with credit to the people who wrote or took them, and only the ones you choose.
• To build, check, host and deliver your page and ads, and email you about them. Lawful basis: contract, because it's what you asked us to do. If you act for a company: our legitimate interest in providing the service the company asked for.
• To screen briefs, deal with reports and take down pages that break our rules. Lawful basis: legitimate interests, in keeping visitors, page owners and our service safe from fraud and abuse. Sometimes also legal obligation, where the law requires us to act.
• To limit requests from one connection or one email address, using hashed IP addresses and the email address on each project. Lawful basis: legitimate interests, in keeping the service available and its costs under control.
• To check a website is yours before your page reuses its words, by reading the contact addresses the site shows and emailing a confirm link to you, or to one of those addresses if you choose it. Lawful basis: legitimate interests, in never copying anyone's website without their say-so. Without the check, your page is still built, in fresh words.
• To run, fix and improve Nightly, using technical logs and project records. Lawful basis: legitimate interests.
• To answer your emails. Lawful basis: legitimate interests.
• To keep records the law requires, and to make or defend legal claims. Lawful basis: legal obligation, or legitimate interests.
• To store enquiries and show them to page owners. We do this as the owner's processor, on their instructions (section 11).

We only email you about your project (including, if you haven't sent your brief, a link to finish it and one reminder) and about changes to our terms. We won't send you marketing emails unless you've agreed to them.

Section 4Automatic screening

Before we build anything, rules and then an AI model check your brief for phishing, impersonation, scams and requests to copy another site. If the screen refuses a brief, we don't build the page.

An AI model also looks at every logo and photo you upload, and every free stock photo we consider, before it can appear on a page. It refuses things like adult content, violence, other brands' logos and pictures of personal documents. A refused image isn't kept.

If you think a refusal is wrong, email us and a person will look at it.

Section 4aThe voice interview

When it's available, you can talk through your brief with an AI interviewer instead of typing it. The interviewer is an AI, not a person. It only starts after you tick a box to agree, and you can type instead, pause or stop at any time.

• Our voice provider hears your voice as you speak, turns it into text, and speaks the interviewer's questions. We set it to keep no recording and no transcript after the call.
• Our AI provider reads the conversation as it happens, to ask the next question, and afterwards drafts your answers from it.
• We keep the written transcript while you check your draft. If you send your brief, we keep it with your brief, so every line on your page can be traced to what you said. If you don't, we delete it after 2 days.

Lawful basis: contract, because it's how you asked to give us your brief. Your voice is personal data, but we don't use it to identify you, and we don't keep it.

Section 4bThe AI sales executive (Ask Nightly)

On nightlystudio.com and on this app's home page, "Ask Nightly" is Nightly's AI sales executive: it answers questions about Nightly and helps you choose a plan. It's an AI, not a person, and it answers only from Nightly's facts sheet. Nothing loads until you open it.

• What we keep: the questions you ask and the answers it gives, the page you asked on, the time, what each answer cost us, and a short note of what kind of business asked and which plan it suggested. Email addresses and phone numbers are removed before a question is answered or stored. Please don't type other personal details: it doesn't need them.
• Why: to answer you, and to learn which questions we answer badly, so we can improve our answers and our pages. Lawful basis: legitimate interests.
• How long: the words of each question and answer for 90 days. After that we keep only counts, such as how many conversations there were.
• Who reads it: our AI provider (section 5) reads each question to write the answer and to check it against the facts. The log is stored with the rest of Nightly's data.
• Your browser: it sets no cookie. A random conversation number and the chat so far are kept in your browser's session storage, so the chat follows you from page to page, until you close the tab.

To stop abuse, we count messages from each connection with the hashed IP address described in section 2.

Section 5Who we share it with

We use a few service providers to run Nightly. Cloudflare, DigitalOcean, our AI provider and, for the voice interview, our voice provider act on our instructions, under data processing terms. Each provider is named at the end of this notice.

• Cloudflare, Inc. (United States) hosts the app and the pages, stores our database and files, sends our emails, runs the browser that tests your page, and protects the service from attacks. Its network runs in data centres around the world.
• DigitalOcean, LLC (United States) runs our small server in its London data centre. That server sends a page owner's bare domain (yourbusiness.co.uk) on to their page's www address, where their domain company can't do that with the padlock itself. It sees each visitor's IP address and the address they asked for, only to answer them. We keep no record of either.
• Our AI provider (United States) provides the AI models that screen briefs, sketch, build and check pages, and draft answers from your current site. It receives your answers, the text of your page, the logo and photos you upload and, if you paste it, the text of your current site. It also receives the questions you ask the AI sales executive (section 4b). We don't send it your email address or any enquiries. Under its commercial terms, it doesn't use data sent through its API to train its models, and keeps that data only for a limited period.
• Stock photo libraries, only if you ask for free stock photos: Pexels and Pixabay (Canva, Germany), Unsplash (Canada, part of Getty Images, United States), Openverse (a WordPress.org project), Wikimedia Commons (Wikimedia Foundation, United States) and Shutterstock (Shutterstock, Inc., United States). We ask them in turn until we have enough photos, and send them a few search words about your business, such as "sourdough bakery", never your name, email address or answers. We copy the photos we choose to our own storage, so your page's visitors don't connect to the libraries, with one exception: Unsplash's terms require pages to show its photos from Unsplash's own image server. If your page shows an Unsplash photo, each visitor's browser asks images.unsplash.com for it, so Unsplash receives the visitor's IP address and browser details, as Google does for fonts. We keep the libraries' search results for 24 hours, as Pixabay's terms ask, and then delete them.
• Our voice provider (United States), only if you use the voice interview: it receives your voice while you talk, and the interviewer's words, to turn speech into text and text into speech. We set it to keep no audio or transcripts after the call. Our AI provider also receives the conversation, as described above.
• Google (Google LLC, United States), if you choose "Continue with Google": Google tells us who you are, as described in section 2. Google's own privacy policy covers what Google does when you sign in there.
• Apple (Apple Inc., United States), if you choose "Continue with Apple": Apple tells us who you are, as described in section 2. Apple's own privacy policy covers what Apple does when you sign in there.
• Google Maps Platform (Google LLC, United States), if you use "Find your business on Google": our server sends Google the words you type in the search box, the listing you choose, and the approximate location of your connection (a town and its map position, from Cloudflare) so the nearest businesses come first. It doesn't send your name, email address or IP address. The listing's photos are shown to you from Google's own image server, so Google receives your IP address and browser details when they load, as it does for fonts.
• Google Fonts, run by Google, supplies the fonts used by the app and by the pages we build. When a browser downloads a font, Google receives the visitor's IP address and browser details. Google says it doesn't use this to build profiles or target ads.

We also share personal data:

• with the business that owns a page, for enquiries sent through it;
• with Stripe, for payments, VAT calculation, receipts and invoices, if you buy a paid plan;
• with our professional advisers, such as lawyers and accountants, when we need to;
• with the police, regulators or courts, when the law requires it, or to report fraud or a scam;
• with a buyer, if we sell or merge the business. They'd have to protect your data as this notice says.

Payments. If you buy a paid plan, Stripe (Stripe Payments UK, Ltd. and Stripe, Inc.) processes your payment. Your card details go straight to Stripe, and we never see or store them. Stripe also works out the VAT and keeps the payment records. It is an independent controller for its own fraud-prevention and legal duties (Stripe's privacy notice). From Stripe we receive and keep your billing name and address, your VAT number if you give one, the last 4 digits and expiry month of your card, and your payment history. We use them to run your plan, to issue invoices and to keep tax records.

We don't sell personal data, and we don't share it with advertisers.

Section 6International transfers

We’re based in the UK. Cloudflare, DigitalOcean, our AI provider, our voice provider, Google, Apple and Stripe are US companies, and Cloudflare's network runs worldwide. So your data may be processed outside the UK, including in the United States.

When it is, we rely on a safeguard UK law recognises:

• UK adequacy regulations, for countries the UK has approved, such as those in the European Economic Area;
• the UK–US data bridge, for US companies certified under it; or
• the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in our providers' data processing terms.

Email us if you'd like to know which safeguard applies to a provider.

Section 7How long we keep it

We keep personal data only as long as we need it. Periods marked Default are what we propose while this notice is in draft.

• Your brief, email address, page, ads and project records. If your page is never published: 12 months after you send the brief. If it's published: while it's live, and for 30 days after it comes down. Default
• Your account. While you have it. If you ask us to close it, we delete it within 30 days, along with your answers, and your websites follow the periods above. Default
• Signed-in browsers. 30 days after each was last used, or until you sign out there.
• Sign-in links and codes. They work for 15 minutes; we delete the record a day after that.
• Setup answers you haven't built a website from yet, including a Google listing you chose. 30 days after you last changed them, then deleted. Once you build, they're kept with your project, with only the reviews and photos you ticked.
• Enquiries sent through a page. 12 months after each one is sent, or until the project is deleted, if that's sooner. The page owner can ask us to delete them earlier. Default
• Logos and photos you upload but don't send with a brief. 2 days.
• Answers to a brief you haven't sent, with your email address. 30 days after you gave your email, then deleted. Once you send the brief, they become your brief.
• Website checks: the addresses we read on the site and the record of each confirm link. Kept with your project, for as long as it is. Each link stops working after 3 days, or once it's used.
• A voice interview's transcript. With your brief, if you send it. If you don't, 2 days.
• Questions to the AI sales executive, and its answers. 90 days, with email addresses and phone numbers removed. After that, only counts.
• Stock photo search words and results (for free stock photos). 24 hours.
• An image you take off your page through a change request. Deleted when the new version goes live.
• Hashed IP addresses. 30 days. Default
• Technical logs. Up to 30 days. Default
• Reports, refused briefs and records of pages we took down. 2 years, so we can spot repeat abuse and deal with claims. Default
• Emails with us. 2 years after the last message. Default
• Backups. Deleted data can stay in backups for up to 30 more days. Default
• Payment records. 6 years after the end of the tax year they relate to, because tax law requires it.

If you ask us to delete your project sooner, we will, unless we need to keep something for a legal reason.

Section 8Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted;
• ask us to limit how we use it;
• object to how we use it, where we rely on legitimate interests;
• get the data you gave us in a format you can reuse, where we rely on contract;
• have a person review a decision made automatically (section 4).

To use any of these, email hello@nightlystudio.com. Please write from the email address on your project, so we can find it and know it's you. We'll reply within one month. There's no charge, unless a request is clearly unfounded or excessive.

If you sent an enquiry through a page, the business that owns the page decides what happens to it. Contact them first. If you contact us, we'll pass your request on to them.

Section 9Complaints

If you're unhappy with how we've used your data, please tell us first, and we'll try to put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Section 10Cookies and browser storage

• We use no advertising cookies.
• The Nightly app sets no tracking cookies, and we don't use analytics that track you.
• We record which link brought you here, for example a LinkedIn post, never who you are. Your browser keeps the link's tag only until you close the tab.
• When you sign in, the app sets one cookie on app.nightlystudio.com only. It keeps you signed in for up to 30 days, and is deleted when you sign out. Scripts can't read it, and it's never sent to any other site, including the pages we build. While you sign in with Google or Apple, a second cookie, lasting 15 minutes, connects their answer to your browser. Both are strictly necessary for the sign-in you asked for, so they don't need your consent.
• Pages we build set no cookies and send no analytics.
• The AI sales executive (section 4b) keeps a random conversation number and the chat so far in your browser's session storage until you close the tab. It sets no cookie.
• The brief form also keeps your unfinished answers in your own browser, so you don't lose them if you leave. They're cleared from it when you send the brief, and you can clear them in your browser settings.
• To show visitors in the US prices in dollars, nightlystudio.com asks the app which country your connection is in. We keep nothing about it, and your browser remembers the answer only until you close the tab.

Section 11For page owners: enquiry forms and data processing

If your page has an enquiry form, visitors can send you their name, email address and a message. For these entries, you're the controller and we're your processor. This section sets out the terms we process them on, as UK data protection law requires (Article 28 of the UK GDPR). It forms part of our terms of use.

What we do for you

• Data: names, email addresses and messages from people who use the form on your page. A message can contain anything the visitor writes.
• Purpose: to receive the entries, store them, and show them to you on your project page.
• Duration: as long as section 7 says, or until you ask us to delete them or your project ends.
• Instructions: we use entries only for that purpose, or where the law requires it. Choosing the enquiry form in your brief is your instruction to us. If we think an instruction breaks the law, we'll tell you.
• Confidentiality: only people who need to see entries can, and they must keep them confidential.
• Security: entries travel over encrypted connections and are stored with Cloudflare. They're shown only through your private project link, so keep that link safe.
• Sub-processors: you agree that we use Cloudflare to receive and store entries. We don't send entries to our AI provider. Before we add or change a sub-processor that handles entries, we'll update this notice and email you. You can object. If we can't resolve it, you can stop using the form or close your project.
• International transfers: section 6 applies.
• Helping you: as far as is reasonable, we'll help you answer requests from visitors (for example, to delete their message) and meet your security and data protection duties.
• Breaches: if we become aware of a personal data breach affecting entries, we'll tell you without undue delay.
• At the end: when your project ends, we delete the entries, unless the law requires us to keep them. You can ask us for a copy first.
• Checks: we'll give you the information you reasonably need to show we're keeping to these terms, and answer reasonable questions about it.

What you do

• Your page tells visitors that their details are sent to you and stored by Nightly Studio on your behalf. You're responsible for telling them anything else the law requires, such as how you'll use their details.
• Use enquiries to reply and deal with the request. Don't add people to marketing lists without the consent the law requires.
• If a visitor asks you to delete their message, tell us and we'll delete it.

Section 12Changes to this notice

We'll update this notice when what we do changes, for example when we add new plans. The date at the top shows the latest version. If a change affects you significantly, we'll email you before it applies.