Privacy Policy

§ 1. GENERAL PROVISIONS

1.1. Data Controller
The controller of your personal data is NOCTURNE.AI Sp z o.o., with its registered office in Wrocław, ul. Tęczowa 82E/21, 53-603 Wrocław, Poland, NIP: 8971955272, KRS: 0001177447, REGON: 541975240 (hereinafter: the “Controller” or the “Service”).

1.2. Contact for Data Protection Matters
In matters related to the processing of your personal data, you may contact the Controller in writing at the address indicated above or via e-mail: info@ai-nocturne.com.

1.3. Scope of this Policy
This Privacy Policy applies to users of the website: www.app-nocturne.com (hereinafter: “Nocturne”). It sets out the rules for the collection and use of user data, obtained directly from users or through cookies and similar technologies. This Privacy Policy governs the processing of personal data in connection with the use of the Nocturne online platform.

§ 2. DATA WE COLLECT

2.1. Data provided directly by you:

Registration data: e-mail address, full name, username

2.2. Data collected automatically:

Technical data: IP address, browser type and version, browser language settings, device operating system, screen resolution, device type (desktop/mobile/tablet), connection information (server response time, HTTP errors, session interruptions)
User activity data: login and logout times, time spent on individual subpages, clicked buttons and links (e.g., subscription purchase, bot data access), activity in the user panel (e.g., password change, new license purchase), navigation path (e.g., referring website)
Analytical data: user ID, number of logins during a given period, statistics on feature usage (e.g., number of users who downloaded bot access data), sales conversions (e.g., number of users who clicked “buy license” and completed the purchase), user behavior throughout the sales funnel, behavior after subscription expiration
Account data: account status (active, suspended, expired/pending), subscription plan (weekly, quarterly, annual), account creation date, account status change history, subscription and payment history (number and duration of purchased licenses), login history (IP address, location, date and time), bot access assignment information (activation date, broker, login), support ticket history, user reaction time to received e-mails (open rate, click-through rate)
Cookies: described in detail in section 7.1 of this Policy

2.3. Data from external sources:

Payment providers: transaction ID, customer email, amount, payment method, transaction status (approved, declined, pending)

3. PURPOSES AND LEGAL BASIS OF DATA PROCESSING

Personal data may be processed for the following purposes:

To analyze traffic and ensure security within the Service, optimize platform performance, and tailor content to user needs — based on the Controller’s legitimate interests (Article 6(1)(f) GDPR)
To communicate with users, respond to inquiries and conduct correspondence — based on the user’s consent and the Controller’s legitimate interests in fulfilling user requests (Article 6(1)(a) and (f) GDPR)
To provide the platform’s services (i.e., account creation and access to the bot) — for the performance of a contract (Article 6(1)(b) GDPR)
For billing and accounting purposes — to fulfill legal obligations (Article 6(1)(c) GDPR)
For the establishment, exercise or defense of legal claims — based on the Controller’s legitimate interests (Article 6(1)(f) GDPR)
For newsletter distribution — to inform users of new features and promotions — based on consent (Article 6(1)(a) GDPR)

§ 4. DATA RETENTION PERIOD

Personal data will be retained as follows:

Contact form data: for the period necessary to respond to your message and archived for 3 months from the date of response, after which it will be deleted
Consent-based processing: until consent is withdrawn. Consents given on the Platform may be withdrawn at any time
Platform services: for the duration of account use. After account closure, related data will be stored for 12 months
Billing data: for 5 years following the tax year in which the tax obligation arose
Legal claims: until the expiration of the limitation period for potential claims

§ 5. DATA RECIPIENTS

The recipients of your personal data may include:

Entities and authorities legally authorized to receive such data
Third-party service providers acting on behalf of the Controller, including legal, IT, marketing, accounting, hosting, e-mail service providers, analytics services, payment processors, banks, and other entities involved in service delivery

Your data will not be transferred to third countries (outside the European Economic Area).

§ 6. YOUR RIGHTS UNDER THE GDPR

Pursuant to the GDPR, you have the right to:

Access your data and obtain a copy
Rectify (correct) your data if it is inaccurate or outdated, and request erasure
Restrict or object to the processing of your data
Withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal)
Lodge a complaint with the supervisory authority — in Poland, this is the President of the Personal Data Protection Office (UODO)
(current address: ul. Stawki 2, 00-193 Warsaw; from July 2024: ul. Moniuszki 1A, 00-014 Warsaw)