Privacy Policy

1. Introduction

Nuit (“we”, “us”, “our”) operates the website nuit.archi and the Nuit web application (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Data Controller

The data controller responsible for your personal data is Nuit. For any privacy-related inquiries, contact us at hi@nuit.archi.

3. Information We Collect

3.1 Information You Provide

• Account information: email address provided during registration.
• Project data: text prompts, project names, briefs, and reference images you upload.
• Communications: messages you send to us via email.

3.2 Information Collected Automatically

• Usage data: pages visited, features used, generation count, timestamps, and interaction patterns.
• Device data: browser type, operating system, screen resolution, and language preference.
• Log data: IP address, access times, and referring URLs.
• Anti-abuse signals: to prevent abuse of free credits and detect multiple accounts, we process technical signals including IP address and an approximate device fingerprint. The lawful basis is our legitimate interest in preventing fraud and abuse.
• Location check: we determine the country associated with your IP address to comply with export-control and sanctions law. This is normally resolved on our own servers against an offline database, so your IP address is not disclosed to anyone; for addresses that database does not cover, we query the geolocation service ipapi.co. We do not infer your location from your language settings, the language you write in, or your email provider — only from your IP address. IP geolocation by DB-IP, licensed under CC BY 4.0.

3.3 Cookies

We use essential cookies to maintain your session and preferences. We may use analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings or our cookie consent banner.

We set a first-party cookie named _nuit_attr to record how you arrived at our site — for example, the partner link or marketing campaign that brought you here. This is used internally to credit partners for referrals and to apply any discount associated with that partner. The cookie expires after 60 days. It does not track you across other websites and is not shared with third parties. Because it is necessary to honour the discount you arrived with, it is set without a consent prompt — you can clear it through your browser’s cookie settings at any time.

Cookie settings

4. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Service.
• Process your image generation requests.
• Manage your account and subscription.
• Send transactional communications (account verification, billing, service notices such as changes to these terms).
• Analyze usage patterns to improve features and performance.
• Detect, prevent, and address technical issues or abuse.
• Comply with legal obligations.

5. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, we process your data based on:

• Contract performance: processing necessary to provide the Service you requested (account, generation, billing).
• Legitimate interests: improving the Service, analytics, security, and fraud prevention.
• Consent: where you have given explicit consent (e.g., marketing communications, non-essential cookies).
• Legal obligation: where processing is required by law.

6. Data Sharing and Disclosure

We do not sell your personal data. We share data with the following categories of recipients:

• Hosting and infrastructure: Vercel, which hosts this website and parts of the Service.
• AI model providers: the companies whose models generate your images from the prompts and reference images you submit. We use, or may use, models from Google, Meta, xAI (Grok), Black Forest Labs and Recraft. Some model calls are routed through Vercel’s AI Gateway, which forwards the request to the model provider on our behalf; others go directly to the provider, or to a hosting partner that runs the model for the provider — Flux models, for example, are executed by fal.ai. Which of these receives a given request depends on the model selected for that generation.
• Image storage and delivery: bunny.net, which stores the images you generate and upload and delivers them to your browser.
• Payment processing: our payment processor, which handles card details directly. We do not store card numbers.
• Email delivery: our transactional email provider, which sends sign-in, verification, billing and service messages.
• Analytics: our product analytics provider, which records how the website and the studio are used.
• Geolocation: ipapi.co, queried only for IP addresses our offline location database does not cover (see 3.2).
• Legal requirements: if required by law, court order, or governmental request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

The providers named above are those we use today together with those we may use as the models offered in the Service change. Those that receive data today are bound to protect it, either by our contract with them or by the published terms under which we use their service. Those listed only as ones we may use receive nothing from us unless and until a model of theirs is actually offered in the Service. Adding or removing a model does not change how we handle your data under this policy; it changes which of these providers receives a particular request, and that is determined by the model you choose.

Which provider is behind which model

We publish the mapping rather than answer it case by case. The first table lists every model that appears in the studio, the company whose model it is, how the request reaches that company, and links to its terms and privacy policy. The second does the same for the other services that handle your data.

These tables describe the Service as at the “Last updated” date at the top of this page. They are revised whenever a model or a service is added to, or removed from, the Service.

7. AI-Generated Content

7.1 What we do

When you submit prompts and reference images, they are sent to a third-party AI provider so that an image can be generated and returned to you. We do not use your prompts or your generated images to train models of our own, and we do not sell, license, or otherwise pass them to anyone for the purpose of training AI models. Generated images are stored in your account and are accessible only to you unless you choose to share them.

7.2 What the providers do

Generation itself is carried out by third-party providers on their own infrastructure, under their own terms and privacy policies. Those terms are not identical across the models we offer: for some models the provider is contractually barred from using submitted content to train or improve its models, and for others no such restriction applies. We can only pass on the commitments we have actually been given, so we do not claim that no provider ever uses submitted content for training.

The model used for a generation is shown in the studio and is your choice. If a provider’s training and retention policy matters for your work — confidential briefs, work under NDA, competition entries — choose the model accordingly and read the policy of the provider behind it before you submit the material. You do not have to ask us which one that is: the table in section 6 names the provider behind every model and links to its terms and privacy policy.

8. Data Retention

• Account data: retained as long as your account is active. Upon account deletion, personal data is removed within 30 days.
• Generated images: retained as long as your account is active. Deleted upon account deletion.
• Usage logs: retained for up to 12 months for analytics and security purposes.
• Billing records: retained as required by applicable tax and accounting laws.

Retention by AI providers. The periods above cover the data we hold. Prompts and images sent to a third-party AI provider for generation may also be retained on that provider’s own systems, for its own period, under its own policy. Those periods differ from provider to provider and are outside our control, and deleting an image from your Nuit account does not by itself remove any copy a provider may hold. Where a provider publishes its retention period, it applies to the models that provider serves and not to the Service as a whole.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data.
• Portability: request your data in a machine-readable format.
• Restriction: request that we limit processing of your data.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at hi@nuit.archi. We will respond within 30 days.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data in accordance with applicable law.

12. Children’s Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact

For questions, concerns, or requests regarding this Privacy Policy, contact us at: hi@nuit.archi