Privacy notice

Section 1Who we are

SeeForth Services Ltd, trading as Nightly Studio, is the controller of the personal data this notice describes. The exception is enquiries sent through a page's form, where we act for the page's owner (see section 11).

We're registered in England and Wales, company number 09793300. Registered office: 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom.

We're a small company and don't have a data protection officer. Email hello@nightlystudio.com about anything in this notice.

Section 2What we collect

When you send a brief

• Your answers: your business name and what it does, your offer, your customers, the facts and reviews you give us, your button wording and link, your tone, words to avoid, your look, country, spelling and time zone. Reviews can include your customers' names.
• Your email address, for your 07:00 note and messages about your project.
• The boxes you tick: that you're a business or sole trader, that your facts are true and, if you give us a website you like, that your page will be original.
• A website whose look you like, and what you like about it, if you give one. We use it for direction only.
• Your current website's address, if you paste it, and the text of that public page, which we use to draft your answers.
• Change requests you send from your project page, and emails you send us.

What we make for you

Your sketch, page, ad images, screenshots, QA receipt and claims ledger. They're built from your brief.

From visitors to pages we build

• Enquiries sent through a page's form: name, email address and message. We store them for the business that owns the page (section 11).
• Reports sent with "Report this page": which page, and what's wrong. The form doesn't ask for a name or email address.

Technical data

• Your IP address, to limit how many requests come from one connection and to stop abuse. We don't store the address itself. We store a hash: a one-way code made from the address and a secret key. It lets us count requests without keeping your IP address. A hash still counts as personal data, so we keep it only for a short time.
• Technical logs, such as the time of a request, the page asked for, errors and browser type. Cloudflare also uses IP addresses to deliver pages and block attacks.
• A record of each project: when the brief arrived, how the build and checks went, whether the page was published, and what the AI cost us.

What we don't collect

No passwords, because there are no accounts yet. No payment details, because nothing is on sale yet. We don't need sensitive data, such as health information, so please don't put any in your brief.

Section 3Why we use it, and our lawful bases

UK data protection law says we need a lawful basis for each use. Here are ours.

• To build, check, host and deliver your page and ads, and email you about them. Lawful basis: contract, because it's what you asked us to do. If you act for a company: our legitimate interest in providing the service the company asked for.
• To screen briefs, deal with reports and take down pages that break our rules. Lawful basis: legitimate interests, in keeping visitors, page owners and our service safe from fraud and abuse. Sometimes also legal obligation, where the law requires us to act.
• To limit requests from one connection or one email address, using hashed IP addresses and the email address on each project. Lawful basis: legitimate interests, in keeping the service available and its costs under control.
• To run, fix and improve Nightly, using technical logs and project records. Lawful basis: legitimate interests.
• To answer your emails. Lawful basis: legitimate interests.
• To keep records the law requires, and to make or defend legal claims. Lawful basis: legal obligation, or legitimate interests.
• To store enquiries and show them to page owners. We do this as the owner's processor, on their instructions (section 11).

We only email you about your project and about changes to our terms. We won't send you marketing emails unless you've agreed to them.

Section 4Automatic screening

Before we build anything, rules and then an AI model check your brief for phishing, impersonation, scams and requests to copy another site. If the screen refuses a brief, we don't build the page.

If you think a refusal is wrong, email us and a person will look at it.

Section 5Who we share it with

We use a few service providers to run Nightly. Cloudflare and Anthropic act on our instructions, under data processing terms.

• Cloudflare, Inc. (United States) hosts the app and the pages, stores our database and files, sends our emails, runs the browser that tests your page, and protects the service from attacks. Its network runs in data centres around the world.
• Anthropic, PBC (United States) provides the Claude AI models that screen briefs, sketch, build and check pages, and draft answers from your current site. Anthropic receives your answers, the text of your page and, if you paste it, the text of your current site. We don't send it your email address or any enquiries. Under its commercial terms, Anthropic doesn't use data sent through its API to train its models, and keeps that data only for a limited period.
• Google Fonts, run by Google, supplies the fonts used by the app and by the pages we build. When a browser downloads a font, Google receives the visitor's IP address and browser details. Google says it doesn't use this to build profiles or target ads.

We also share personal data:

• with the business that owns a page, for enquiries sent through it;
• with our professional advisers, such as lawyers and accountants, when we need to;
• with the police, regulators or courts, when the law requires it, or to report fraud or a scam;
• with a buyer, if we sell or merge the business. They'd have to protect your data as this notice says.

When paid plans start, a payment provider will handle card details. We'll update this notice before that happens.

We don't sell personal data, and we don't share it with advertisers.

Section 6International transfers

We're based in the UK. Cloudflare and Anthropic are US companies, and Cloudflare's network runs worldwide. So your data may be processed outside the UK, including in the United States.

When it is, we rely on a safeguard UK law recognises:

• UK adequacy regulations, for countries the UK has approved, such as those in the European Economic Area;
• the UK–US data bridge, for US companies certified under it; or
• the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in our providers' data processing terms.

Email us if you'd like to know which safeguard applies to a provider.

Section 7How long we keep it

We keep personal data only as long as we need it. Periods marked Default are what we propose while this notice is in draft.

• Your brief, email address, page, ads and project records. If your page is never published: 12 months after you send the brief. If it's published: while it's live, and for 30 days after it comes down. Default
• Enquiries sent through a page. 12 months after each one is sent, or until the project is deleted, if that's sooner. The page owner can ask us to delete them earlier. Default
• Hashed IP addresses. 30 days. Default
• Technical logs. Up to 30 days. Default
• Reports, refused briefs and records of pages we took down. 2 years, so we can spot repeat abuse and deal with claims. Default
• Emails with us. 2 years after the last message. Default
• Backups. Deleted data can stay in backups for up to 30 more days. Default
• Payment records, once paid plans start. 6 years, because tax law requires it.

If you ask us to delete your project sooner, we will, unless we need to keep something for a legal reason.

Section 8Your rights

You have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted;
• ask us to limit how we use it;
• object to how we use it, where we rely on legitimate interests;
• get the data you gave us in a format you can reuse, where we rely on contract;
• have a person review a decision made automatically (section 4).

To use any of these, email hello@nightlystudio.com. Please write from the email address on your project, so we can find it and know it's you. We'll reply within one month. There's no charge, unless a request is clearly unfounded or excessive.

If you sent an enquiry through a page, the business that owns the page decides what happens to it. Contact them first. If you contact us, we'll pass your request on to them.

Section 9Complaints

If you're unhappy with how we've used your data, please tell us first, and we'll try to put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Section 10Cookies and browser storage

• We use no advertising cookies.
• The Nightly app sets no tracking cookies, and we don't use analytics that track you.
• Pages we build set no cookies and send no analytics.
• The brief form saves your unfinished answers in your own browser, so you don't lose them if you leave. They stay on your device, and are cleared when you send the brief. You can also clear them in your browser settings.

Section 11For page owners: enquiry forms and data processing

If your page has an enquiry form, visitors can send you their name, email address and a message. For these entries, you're the controller and we're your processor. This section sets out the terms we process them on, as UK data protection law requires (Article 28 of the UK GDPR). It forms part of our terms of use.

What we do for you

• Data: names, email addresses and messages from people who use the form on your page. A message can contain anything the visitor writes.
• Purpose: to receive the entries, store them, and show them to you on your project page.
• Duration: as long as section 7 says, or until you ask us to delete them or your project ends.
• Instructions: we use entries only for that purpose, or where the law requires it. Choosing the enquiry form in your brief is your instruction to us. If we think an instruction breaks the law, we'll tell you.
• Confidentiality: only people who need to see entries can, and they must keep them confidential.
• Security: entries travel over encrypted connections and are stored with Cloudflare. They're shown only through your private project link, so keep that link safe.
• Sub-processors: you agree that we use Cloudflare to receive and store entries. We don't send entries to Anthropic. Before we add or change a sub-processor that handles entries, we'll update this notice and email you. You can object. If we can't resolve it, you can stop using the form or close your project.
• International transfers: section 6 applies.
• Helping you: as far as is reasonable, we'll help you answer requests from visitors (for example, to delete their message) and meet your security and data protection duties.
• Breaches: if we become aware of a personal data breach affecting entries, we'll tell you without undue delay.
• At the end: when your project ends, we delete the entries, unless the law requires us to keep them. You can ask us for a copy first.
• Checks: we'll give you the information you reasonably need to show we're keeping to these terms, and answer reasonable questions about it.

What you do

• Your page tells visitors that their details are sent to you and stored by Nightly Studio on your behalf. You're responsible for telling them anything else the law requires, such as how you'll use their details.
• Use enquiries to reply and deal with the request. Don't add people to marketing lists without the consent the law requires.
• If a visitor asks you to delete their message, tell us and we'll delete it.

Section 12Changes to this notice

We'll update this notice when what we do changes, for example when we add accounts or paid plans. The date at the top shows the latest version. If a change affects you significantly, we'll email you before it applies.