Last updated: October 20, 2026
This Privacy Policy explains how Kundi d.o.o. (“Nightwatch”, “we”, “us”) collects, uses, shares and protects personal data when you visit nightwatch.io, create an account, or use the Nightwatch platform and its API (together, the “Service”). It also explains your rights under the EU General Data Protection Regulation (GDPR) and how to exercise them.
1. Who we are
The controller responsible for your personal data is:
Kundi d.o.o.
Gmajna 42a, 2380 Slovenj Gradec, Slovenia
Company registration number: 6739733000
VAT ID: SI91811112
For any privacy question or request, contact us at [email protected].
2. Scope and our role
We act as controller for data about our website visitors, account holders, trial users and newsletter subscribers. The same applies to people who contact us for sales or support, and to business contacts we reach out to about Nightwatch.
We act as processor for personal data that customers put into the Service on behalf of their own organisation or their clients, for example contact details in reports, client websites, or connected analytics accounts. In that case the customer is the controller, and our processing is governed by our Data Processing Agreement, available on request. If your data was added to Nightwatch by one of our customers, please contact that customer first.
This policy does not cover third-party websites or services linked from the Service.
3. Personal data we collect
Category | Examples | Source |
Account and authentication data | Name, email address, password (stored only as a hash), company name, IP address at sign-up and login. If your organisation uses single sign-on, the identifier and email address provided by your identity provider | You, your organisation’s identity provider |
Billing data | Billing name and address, VAT ID, plan, invoices, payment status. Card details are handled by Stripe (and Braintree for some older accounts); we never see or store full card numbers | You, Stripe, Braintree |
Usage and device data | Pages and features used, clicks, session data, browser and device type, IP address, cookie identifiers | Automatically, via cookies and similar technologies |
Connected account data | Google Analytics OAuth token, GA property/profile ID, Search Console property URL, and the metrics listed in section 5 | Google, with your authorisation |
Service content | Websites, keywords, competitors, AI prompts, reports, notes and settings you add to Nightwatch | You |
Communications | Support chats, emails, sales conversations, call notes, shared Slack channels, feedback | You |
Error and diagnostic data | Email address, IP address, request details and technical logs captured when an error occurs | Automatically |
Marketing data | Email address, newsletter preferences, email open and click events | You |
Business prospect data | Name, work email, job title, company, location and public professional profile (such as LinkedIn) | Public sources such as LinkedIn and company websites |
We do not intentionally collect special categories of personal data (such as health or political data). Please do not add them to the Service.
4. Purposes and legal bases
Purpose | Data used | Legal basis (GDPR Art. 6) |
Creating and running your account, providing the Service | Account, service content, connected account data | Performance of a contract (6(1)(b)) |
Processing payments, invoicing, tax and accounting | Billing data | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
Customer support and responding to inquiries | Communications, account data | Contract (6(1)(b)) or, for prospects, legitimate interest (6(1)(f)) |
Security, fraud prevention, error tracking and debugging | Error and diagnostic data, IP address | Legitimate interest in a secure, reliable Service (6(1)(f)) |
Product analytics and improvement | Usage and device data | Consent (6(1)(a)) for non-essential cookies; otherwise legitimate interest (6(1)(f)) |
Transactional emails (account, billing, trial and service notices) | Email address | Contract (6(1)(b)) |
Sales follow-up with prospects and trial users about Nightwatch | Account, communications | Legitimate interest (6(1)(f)) |
Contacting business professionals who may benefit from Nightwatch (B2B outreach) | Business prospect data | Legitimate interest in promoting our services to relevant businesses (6(1)(f)) |
Newsletter and marketing emails | Email address, preferences | Consent (6(1)(a)), or legitimate interest for existing customers about similar services, as allowed by law |
Complying with legal requests and defending legal claims | Any relevant data | Legal obligation (6(1)(c)) and legitimate interest (6(1)(f)) |
Where we rely on legitimate interest, you can object at any time (see section 12). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
5. Google API data
If you connect Google Analytics or Google Search Console, we access only what we need to show that data in your Nightwatch dashboard:
Google Analytics: OAuth access token, property/profile ID, and the metrics Sessions, Users, Pageviews, Bounces and New Users
Google Search Console: property URL and the metrics Impressions and Clicks
We fetch these metrics daily, store them in our database, and display, aggregate and chart them alongside Nightwatch data. We do not sell this data, use it for advertising, or use it to train AI models. Our staff do not read it except with your permission, for security reasons, or where required by law.
Nightwatch’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google at any time in your Nightwatch settings or through your Google Account permissions. When you disconnect or close your account, we delete the stored token and Google data.
6. AI features
Nightwatch includes AI features such as AI visibility tracking, Citation Intelligence and the NightOwl SEO Agent.
AI visibility tracking sends the prompts you configure to AI platforms such as ChatGPT, Claude, Gemini, Perplexity and Google AI Overviews, and records their answers. Prompts should not contain personal data.
NightOwl and other generative features may send the content you provide (for example keywords, URLs, page content and instructions) to our AI model providers, currently OpenAI and Google (Gemini), to generate results.
We do not use your service content or Google API data to train our own AI models. AI output may be inaccurate; please review it before relying on it.
7. Service providers and sharing
We do not sell your personal data. We share it only with the service providers below, who process it on our behalf under written data processing agreements, and as described at the end of this section. A current list is also available on request.
Provider | Purpose |
Amazon Web Services | Hosting and database |
Netlify | Web application hosting |
Stripe, Braintree | Payments and invoicing |
Google Analytics, PostHog, Mixpanel | Website and product analytics |
Rollbar, AppSignal | Error tracking and monitoring |
Intercom | Support chat and customer messaging |
Postmark | Transactional emails |
MailBluster | Newsletter |
Clarify | Customer relationship management |
Slack | Shared support channels, where requested by the customer |
OpenAI, Google (Gemini) | AI features |
We may also disclose personal data:
to professional advisers (lawyers, accountants, auditors) under confidentiality obligations
to authorities where required by law or to protect our rights, users or the public
to a buyer or successor in a merger, acquisition or sale of assets, who will be bound by this policy
to anyone else with your consent
8. International transfers
Some of our providers are located, or access data, outside the European Economic Area (EEA), mainly in the United States. When we transfer personal data outside the EEA, we rely on one of these safeguards:
an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified US providers
Standard Contractual Clauses approved by the European Commission, with supplementary measures where needed
You can request a copy of the relevant safeguards by contacting [email protected].
9. Retention
We keep personal data only as long as needed for the purposes in section 4. After that we delete or anonymise it.
Account data and service content: for as long as your account is active, and deleted within a reasonable period after you close it. You can export your data before closing the account.
Google API data: until you disconnect Google or close your account.
Billing records and invoices: for the period required by Slovenian tax and accounting law.
Support and sales communications: for as long as needed to handle your requests and maintain our business relationship.
Logs, analytics data and backups: for a limited period, after which they are deleted or overwritten in the normal course of operations.
Newsletter data: until you unsubscribe. We keep your email on a suppression list so we don’t email you again.
We may keep data longer where required by law or to establish, exercise or defend legal claims.
10. Cookies
We use strictly necessary cookies to run the Service, such as keeping you logged in and securing your session. These do not require consent.
We also use analytics and functional cookies (for example from Google Analytics, PostHog, Mixpanel and Intercom) to understand how the Service is used and to provide support chat. Where required by law, we set these only with your consent. You can withdraw consent or block cookies at any time through your browser settings.
11. Security
We protect personal data with technical and organisational measures appropriate to the risk, including:
encryption of data in transit (TLS)
passwords stored only as hashes
mandatory two-factor authentication and strong password policies for our staff
least-privilege access to production systems
firewalls, security software and regular internal security audits
single sign-on for customer organisations
regular backups and application monitoring
No system is fully secure. If a personal data breach is likely to put your rights at risk, we will notify you and the supervisory authority as required by GDPR.
12. Your rights
Under GDPR you have the right to:
Access the personal data we hold about you and receive a copy
Rectification of inaccurate or incomplete data
Erasure of your data where there is no longer a reason to keep it
Restriction of processing in certain cases
Data portability: receive data you provided in a structured, machine-readable format, or have it sent to another provider
Object to processing based on legitimate interest, and to direct marketing at any time
Withdraw consent at any time, without affecting processing before the withdrawal
To exercise any right, email [email protected]. We will reply within one month, which may be extended by two months for complex requests. We may ask you to verify your identity. Requests are free unless they are clearly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You may also complain to the authority in your EU country of residence or work.
13. Marketing communications
We send newsletters and product marketing emails only with your consent, or to existing customers about similar Nightwatch services where the law allows. Every marketing email includes an unsubscribe link, and you can also opt out by emailing [email protected].
If you are a business professional we have contacted about Nightwatch, we obtained your work contact details from public sources such as LinkedIn or your company’s website. You can ask us to stop contacting you at any time by replying to our email or writing to [email protected]. We then keep only the minimum needed to make sure we don’t contact you again.
Opting out of marketing does not stop service emails about your account, billing, security or trial status.
14. Other information
Required data. Your email address and a password are required to create an account, and billing data is required for a paid plan. Without them we cannot provide the Service. All other data is optional.
Automated decision-making. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, including profiling.
Children. The Service is intended for businesses and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
15. Changes and contact
We may update this policy when our services, providers or legal requirements change. The “Last updated” date at the top shows the latest version. For material changes, we will notify account holders by email or in the app before the change takes effect.
Questions or requests: [email protected]
Kundi d.o.o., Gmajna 42a, 2380 Slovenj Gradec, Slovenia