Privacy Notice

Who we are

Nightshift is operated by Rebecca Wilson ("we", "us"), trading as Nightshift. We act as the data controller for the personal data described in this notice and decide how and why it is processed.

Data we collect and why

• Account data (email address, login credentials managed by our authentication provider) — to create your account, sign you in, and give you access to your orders. Legal basis: performance of our contract with you.
• Order and brief data (the brief you submit, service selected, generated deliverable) — to produce and deliver the service you purchased. Legal basis: performance of our contract.
• Membership data (plan, status, usage counts) — to apply your entitlements and enforce fair-use limits. Legal basis: performance of our contract.
• Communications (delivery emails, support messages) — to send you your deliverable and answer questions. Legal basis: contract and our legitimate interest in supporting customers.
• Technical data (IP address, device and browser information, error logs, usage telemetry) — for security, fraud prevention, debugging, and improving the service. Legal basis: our legitimate interests.

Payment card details are never collected or stored by us. Payments are handled by Paddle, our Merchant of Record.

AI processing of your brief

To fulfil an order, the brief you submit is sent to our AI model provider so the deliverable can be generated. Do not include sensitive personal data, credentials, or confidential third-party information in a brief.

Who we share data with

• Paddle.com — our Merchant of Record, for the sale of our products, subscription management, payments, invoicing, tax compliance, and refunds.
• Service providers — hosting, database and authentication, AI model providers, email delivery, and error monitoring, all acting on our instructions.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose data by law.

We do not sell personal data. Where data is transferred outside the UK/EEA, we rely on adequacy decisions or standard contractual clauses as appropriate safeguards.

Retention

We keep account, order, and deliverable data for as long as your account is active and afterwards only as long as needed for legal, tax, and accounting obligations (typically up to six years for transaction records). Technical logs are kept for a short period. Data no longer needed is deleted or anonymised.

Your rights

Subject to applicable law, you may request access to your data, correction of inaccurate data, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interests or withdraw consent where consent applies. Contact us and we will respond within one month. You also have the right to complain to your data protection supervisory authority.

Security

We use appropriate technical and organisational measures, including encryption in transit, row-level access controls on our database, server-side authorisation checks, and private tokenised links to deliverables.

Cookies

We use essential cookies and local storage only — to keep you signed in and to maintain your session. We do not use advertising cookies. You can clear or block these in your browser, but the signed-in areas of the site will not work without them.

Contact

For privacy requests or questions, contact Rebecca Wilson through the email address used for your order confirmation. Billing and refund questions are handled by Paddle at paddle.net.

Changes

We may update this notice as the service changes. The version published on this page is the current one.