Privacy Policy

Account data (Partners):

• Name, email address, and password — collected and stored by Base44, NichoAI’s underlying application platform, which handles authentication. If a Partner signs up via OAuth (e.g., Google), Base44 receives the relevant profile data from the OAuth provider instead of a password.

[PLACEHOLDER: does Base44 also collect anything beyond name/email/password by default, e.g. login timestamps, IP address at signup? Needs confirmation directly from Base44’s own data processing documentation, not assumed here.]

Payment data (Partners):

• Handled entirely by Stripe. NichoAI does not receive or store raw card numbers, CVV, or full payment credentials — only what Stripe returns via its API (e.g., transaction status, last 4 digits of a card, subscription/billing status).

Third-party data Partners submit about others:

• Creator Build: creator profile links, screenshots, captions, and other basic info about a creator that a Partner enters into the Platform in order to generate a product pitch.
• Web Build: a business’s publicly available contact information (used to generate a website for that business).
• This data is provided by the Partner, about a third party who is not themselves a NichoAI user.

[PLACEHOLDER: this raises a real question of whose “data subject” this is under GDPR — the creator/business is the data subject, but NichoAI’s direct relationship is with the Partner, not them. Needs explicit legal treatment (see Section 2, legal basis) — do not assume the standard “we collect data from users about themselves” framing applies here.]

Content generated on the Platform:

• Websites (Web Build) and product pitches/recommendations (Creator Build) generated from the above inputs.

[PLACEHOLDER — REQUIRES LEGAL CONFIRMATION FOR EACH ROW BELOW. Nothing in this section should be treated as settled; it is a starting list of categories that need a lawyer’s sign-off on the correct GDPR Article 6 basis, not a determination.]

The following third parties process data on NichoAI’s behalf as sub-processors:

• Base44 — application platform; handles authentication (account data) and underlying infrastructure/hosting for the Platform. Base44’s Data Processing Agreement is part of its Terms of Service rather than a separately executed document — confirmed by reading base44.com/dpa directly, which states SOC 2 Type II and ISO 27001 certification. Base44’s own sub-processors are listed at base44.com/dpa/exhibitc.
• Data residency — verified 2026-07-31 directly in the Base44 workspace (Settings → Overview → Data hosting → “View app data residency”): NichoAI’s data region is US, not EU/UK.

[PLACEHOLDER: where personal data is transferred from the EEA/UK to the United States, this transfer relies on Standard Contractual Clauses / the EU-US Data Privacy Framework — hold as placeholder until Base44 confirms directly which mechanism actually applies to NichoAI’s account.]

[PLACEHOLDER — UNRESOLVED, do not guess: Base44’s own DPA pages name two different contracting entities. base44.com/dpa states the DPA is part of the Terms of Service “governing the services provided to you by Base44, Inc.”, while base44.com/dpa/exhibitc states it is part of the Terms of Service “governing the services provided to you by Wix.com Ltd (including its subsidiaries and affiliates), which operates the Base44 branded services.” Do not state which entity is NichoAI’s actual data processor (Base44, Inc. vs Wix.com Ltd.) until Base44 confirms — this affects the SCC reference jurisdiction and which entity’s DPA execution status applies to NichoAI’s account.]

[UNRESOLVED: our hosting provider’s own sub-processor page lists two different sets of vendors in the same document — a visible grid, and a table in the page’s markup that is not displayed and names vendors the grid does not (Langfuse and Logfire among them). We therefore cannot state with certainty which list is authoritative, and we are asking them. We would rather say that than print one of the two lists here as though the question had been settled.]

• Stripe — payment processing; handles all payment card data and billing.
• Pexels — image API used to source background/hero photos for generated websites (Web Build). No standalone Pexels DPA was found publicly — only a general Privacy Policy and Terms of Service, which describe contractual necessity as their processing basis but do not offer a dedicated GDPR DPA document to link or reference.

[PLACEHOLDER remains open: confirm directly with Pexels whether a DPA can be requested/executed, and separately confirm exactly what, if any, personal data is sent to Pexels in an API request (likely just a search/keyword query) — this affects whether the absence of a DPA is even a real gap.]

• AI/LLM provider — gpt_5_mini, accessed via Base44’s OpenAI integration — powers both Leo/Bosse (Web Build assistant) and MAX (Creator Build assistant). OpenAI publishes a Data Processing Addendum at openai.com/policies/data-processing-addendum, but it must be actively executed by the party with a direct OpenAI account/contract.

[UNRESOLVED: the AI that writes the copy is reached through Base44’s own integration rather than through an account NichoAI holds with the model provider. So the chain is NichoAI → Base44 → the model provider, and it is Base44’s agreement with that provider, rather than one of ours, that governs the processing. We are confirming with Base44 that their agreement covers this as our sub-processor. Until that is confirmed in writing we are not claiming a direct agreement with the model provider, because we do not have one.]

[PLACEHOLDER: standard sub-processor list boilerplate — does NichoAI commit to notifying Partners before adding new sub-processors? Not yet decided.]

No data is sold to third parties.

[PLACEHOLDER: confirm this claim is actually true given the marketing-use clause in ToS Section 5 — “not sold” and “used for marketing with an opt-out” are different things and both need to be accurately described, not just the more favorable one.]

[PLACEHOLDER: no retention periods have been defined for any data category — account data, third-party data submitted via Creator Build/Web Build, or generated output. This needs an explicit product decision (how long is data kept after a Partner stops being active, or after a specific generated site/pitch is created) before legal can assess GDPR storage-limitation compliance (Art. 5(1)(e)).]

Under GDPR, data subjects have the right to:

• Access — request a copy of personal data held about them.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of their data (“right to be forgotten”), subject to legal exceptions.
• Data portability — receive their data in a structured, commonly used format.
• Object — object to processing based on legitimate interest, including marketing use.

[PLACEHOLDER: process not yet defined. Who receives these requests (a support email? a dedicated privacy inbox?), what is the response timeframe (GDPR default is one month), and — critically — how are requests handled for the creator/business third-party data submitted by Partners, given NichoAI has no direct relationship or contact channel with those individuals? This last point connects back to the unresolved legal-basis question in Section 2 and needs to be resolved together with it, not separately.]

The full version of this section, re-audited on 2026-10-08, is the Cookie Policy. It also lists something this section never did: the outside services whose content your browser fetches, and which therefore receive your IP address. Google Fonts was the significant one, and it was removed on 8 October 2026: the typefaces on this site, and in every site generated from now on, come from our own servers. Sites published before that date keep the page they were saved with until they are rebuilt.

This section is based on an actual review of the NichoAI codebase on 2026-07-25, not an assumption. Findings:

• No analytics or advertising trackers were found. A search of the codebase and package.json dependencies found no Google Analytics, Google Tag Manager, Meta/Facebook Pixel, Hotjar, Mixpanel, PostHog, Microsoft Clarity, or similar tracking scripts anywhere in the app.
• No cookies are set on the Landing page itself.
• One cookie-setting function exists in the codebase (src/components/ui/sidebar.jsx, a UI-library component that stores sidebar open/collapsed state in a cookie), but it is not imported or used anywhere in the app — confirmed via a codebase-wide search for references to that component. It is inert boilerplate, not active on any page including Landing.
• The app does use browser localStorage (not cookies) app-wide, via src/lib/app-params.js, to persist the Base44 authentication access token and a few app configuration parameters. This runs as part of the global app shell, not something specific to a logged-in area — so technically active on every page load, including Landing. This is a functional/strictly-necessary storage mechanism (authentication), not tracking or marketing.
• Stripe’s checkout flow (hosted on Stripe’s own domain during payment) will set its own cookies under Stripe’s domain, outside NichoAI’s direct control — this is disclosed via Stripe’s role as a sub-processor (Section 3), not as a NichoAI first-party cookie.

[PLACEHOLDER: strictly-necessary storage (like the auth-token localStorage use above) is generally exempt from cookie-consent-banner requirements under the EU ePrivacy Directive, but “generally exempt” is not the same as “confirmed exempt for this specific implementation” — a lawyer should confirm this classification holds, and whether localStorage (as opposed to HTTP cookies specifically) is treated identically under Swedish implementation of the ePrivacy rules. Do not assume no cookie banner is needed without this confirmation.]

For questions about this Privacy Policy or to exercise a data subject right, contact: nichoai.contact@gmail.com

[PLACEHOLDER: does NichoAI, given its size and processing activities, need to appoint a Data Protection Officer (DPO) under GDPR Art. 37? Likely not mandatory at current scale, but this is a legal determination, not a product one — flag for legal review rather than assuming “no.”]