Privacy Policy

1. Who is responsible?

Nikita Innovations, a Dutch sole proprietorship, is the controller responsible for the processing described in this policy.

Irenestraat 1
3648 BB Wilnis
The Netherlands
Netherlands Chamber of Commerce: 94426686
VAT ID: NL005082583B86
Website: https://asknikita.app
Email: support@asknikita.app

2. What information we process

Depending on how you use Ask Nikita, we process:

• an optional first name and birth date used for the introductory reading;
• account information, including email address, sign-in provider, account identifiers, and authentication and security information handled through Supabase;
• your messages, Nikita's responses, conversation identifiers, timestamps, and continuity information;
• Memory items you choose to add or confirm, including their category, content, and status;
• free and paid usage, entitlement state, billing period, cancellation state, and answer counters;
• Stripe customer and subscription references, subscription and invoice status, and billing-period information. Ask Nikita does not receive or store full card or bank-account details;
• limited first-party analytics, such as an allowlisted event name, language, acquisition source, limited campaign parameters, coarse entitlement or answer state, generated event identifiers, a hashed session identifier, and an account identifier when an event is associated with a signed-in account;
• contact-form information, including name, email address, subject, and message; and
• technical and security information needed to serve requests, authenticate sessions, prevent abuse, and diagnose failures. For contact rate limiting, an HMAC-derived network bucket is stored instead of a raw IP address.

3. Local and account-backed storage

Before you save to an account, parts of your reading, conversation, preferences, language choice, Memory, usage state, and analytics session may be kept in browser storage on your device. You can remove this data through the available product controls or your browser settings.

If you create an account or explicitly transfer a guest conversation, account, conversation, message, Memory, usage, and entitlement information is stored with Supabase so it can be restored securely for that account. Conversation history and Memory are separate: deleting Memory does not automatically delete conversation history.

4. Why we use information and our legal bases

We use information to provide the reading and chat you request, create and secure accounts, preserve continuity, apply answer limits, administer subscriptions, provide support, prevent abuse, maintain reliability, and understand whether the service works as intended.

Where the GDPR applies, the legal basis is usually performance of the service or steps you request before entering into a contract. We also rely on legitimate interests for proportionate security, abuse prevention, service reliability, and minimized first-party product analytics. Billing and administrative records may be processed to comply with legal obligations. Where processing depends on consent, you may withdraw that consent without affecting earlier lawful processing.

5. AI processing with OpenAI

Ask Nikita sends your current message, relevant recent conversation context, and any selected relevant Memory to OpenAI to generate the response you request. The introductory reading sends the validated reading input needed to generate that reading. Provider requests are configured with storage disabled, but OpenAI may still process limited data as described in its applicable business and security terms.

Do not include information that is unnecessary for your question. AI responses may be incomplete or incorrect and should be treated as reflective guidance rather than verified fact.

6. Payments with Stripe

Stripe processes Checkout, payment methods, subscriptions, invoices, tax calculation, and the Customer Portal. Ask Nikita stores only the identifiers and status information needed to connect a Stripe customer or subscription to the correct Ask Nikita account and entitlement. Stripe processes payment details under its own privacy information.

7. Contact delivery with Resend

When you submit the contact form, Ask Nikita sends your name, email address, subject, and message through Resend to the Ask Nikita support mailbox. The application does not store the raw contact submission in its database. Resend and the receiving mailbox process it for delivery and support handling.

8. Hosting, authentication, database, and other recipients

We use Vercel to host and deliver the application; Supabase for authentication, account data, database storage, and access controls; OpenAI for requested AI generation; Stripe for payments and subscriptions; and Resend for contact-form delivery. These providers receive only the information needed for their role.

We may also disclose information when required by law, to protect users or the service, or in connection with professional advice or a business reorganization, subject to appropriate confidentiality and legal safeguards.

9. First-party analytics

Ask Nikita uses a restricted first-party analytics system to measure steps such as homepage visits, account creation, completed answers, checkout progress, subscription state, and paid-answer completion. Event properties are allowlisted and minimized.

Conversation text, Nikita responses, Memory content, names, email addresses, birth dates, raw IP addresses, authentication data, full URLs, and full referrers are not included in these analytics events.

10. Cookies and browser storage

Essential cookies and browser storage are used for authentication, security, language, local reading and conversation continuity, Memory controls, entitlement continuity, and the limited first-party analytics session. Ask Nikita does not use advertising cookies or session recording in the current implementation. Stripe may use its own necessary technologies on Stripe-hosted payment pages.

11. International processing

Some service providers may process information outside the European Economic Area. When GDPR transfer rules apply, processing must be covered by an applicable transfer mechanism, such as an adequacy decision or contractual safeguards. You can contact us for information about the safeguards relevant to a particular provider or transfer.

12. How long information is kept

We do not apply one fixed period to every category. Local browser data remains until you remove it, use an applicable product control, or clear the relevant browser storage. Account, conversation, Memory, entitlement, and billing-linkage data is retained while needed to provide your account and continuity, and afterwards only as needed for legal obligations, security, disputes, or a valid operational need.

Memory remains until you edit or remove it, clear Memory, or the associated account data is deleted. Raw contact messages are not stored in the Ask Nikita database; copies in support email systems are kept only as needed to handle and follow up on the request. Contact rate-limit bucket records are automatically removed after they are no longer needed for the short abuse-prevention window. Analytics, billing, webhook, security, and provider logs are kept according to operational, fraud-prevention, accounting, dispute, and legal needs. Backups and provider systems may retain deleted information for a limited additional period according to their normal rotation and legal obligations.

Ask Nikita does not currently promise a fixed deletion deadline. We assess deletion requests and remove or restrict information unless retention is required or permitted by law.

13. Your GDPR rights

Where the GDPR applies, you may ask to access, correct, delete, restrict, or receive a portable copy of your personal data. You may object to processing based on legitimate interests and withdraw consent where consent is the basis. These rights can be limited where the law allows or requires continued processing.

Memory controls let you view, edit, remove, or clear saved Memory. For an account-wide request, conversation deletion request, or another privacy request, email support@asknikita.app from the address associated with your account where possible. We may need to verify your identity without asking for more information than necessary.

You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

14. Security

We use proportionate technical and organizational safeguards, including authenticated account boundaries, database access controls, limited server-side credentials, input validation, and minimized analytics. No online service can guarantee absolute security. Please avoid sharing information that is unnecessary for the guidance or support you request.

15. Adults only

Ask Nikita is intended for people aged 18 or older and is not directed to children.

16. Changes and contact

We may update this policy when the service, providers, or legal requirements change. The current version and update date will remain available here. Questions and privacy requests can be sent to support@asknikita.app.