Privacy policy

This policy explains how Niko Developments Ltd (company number 17450168, 25 Pateley Square, Wigan, WN6 7HG, United Kingdom) handles personal data in the Service ("the Service"). Contact for any privacy question or request: support@nikodev.co.uk.

Two roles

• We are the controller of the data needed to run accounts, billing, security and support: the people who sign up and sign in, and the businesses that subscribe.
• Our customers are the controllers of the data in their workspaces and of their audiences, such as people who click a customer's tracked link or whose public review a customer turns into a graphic. We process that data only on the customer's instructions, under our data processing agreement. If you clicked a link published by one of our customers, that customer is responsible for it and you can contact them directly; we will help them answer you.

What we collect as controller, and why

• Account data: name, email address, organisation, role, a password hash (Argon2id) or passkey public key, an encrypted authenticator secret, recovery-code hashes, session records and an audit log of actions. Purpose: providing the Service and keeping it secure. Basis: performance of our contract and our legitimate interest in security.
• Billing data: plan, subscription status, invoices and the billing contact. Card details are handled by Stripe and never reach our systems. Basis: contract and legal obligations (tax and accounting records).
• Usage and technical data: which features are used, counts of generations and media against plan limits, error logs, and the IP address of requests for security and rate limiting (kept briefly in logs). Basis: legitimate interests in running, securing and improving the Service.
• Support and email: messages you send us, and service emails we send (verification, invitations, password resets, billing notices). Basis: contract and legitimate interests. We do not send marketing email without consent.

What we process for customers

• Tracked link clicks: time, device type, operating system and browser versions, in-app browser, referrer, campaign tags, approximate location from the IP address (country, region, city) and preferred language. The IP address itself is never stored: it is turned into a keyed hash that changes every day. The page shown after a click sets no cookies and loads nothing from other companies.
• Connected accounts: access tokens for the social media, app store and analytics accounts a customer connects, encrypted with AES-256-GCM, used only to publish what the customer approves and to read the performance of that content.
• App attribution and public reviews: where a customer's app reports opens from links, a random install identifier, the link code, app version and platform (no advertising identifier); public app-store reviews of the customer's apps.

Who we share it with

We use the subprocessors listed in the data processing agreement, including Microsoft Azure (hosting, database, AI models and email, in the United Kingdom and the EU), Anthropic (AI drafting fallback), Stripe (payments), and the platforms a customer connects. AI providers receive product and campaign information to write drafts, not audience personal data, and do not train on it. We do not sell personal data or build advertising profiles.

International transfers

Data is hosted in the United Kingdom, with generative media processed in Sweden. Where a subprocessor processes data outside the UK, we rely on adequacy regulations or the UK International Data Transfer Addendum.

How long we keep it

• Account and audit data: while the account is active and up to 12 months after it is closed.
• Billing records: 6 years, as tax law requires.
• Individual link clicks: 13 months, after which only anonymous totals remain.
• Customer Content and connected-account tokens: until deleted by the customer or 30 days after the workspace closes.
• Security logs: up to 90 days.

Security

Two-factor sign-in for everyone, encryption in transit and of stored secrets, workspace isolation checked by automated tests, least-privilege access for our staff, and encrypted backups.

Your rights

You can ask for access to your data, its correction or deletion, its portability, or object to or restrict its use, by emailing support@nikodev.co.uk. We answer within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk. How to remove data that came from connected platforms is on the data deletion page.