Privacy Policy

1. Introduction

Nuit (“we”, “us”, “our”) operates the website nuit.archi and the Nuit web application (collectively, the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Data Controller

The data controller responsible for your personal data is DDDEV LTD, a company registered in the United Kingdom, trading as NUIT.archi. For any privacy-related inquiries, contact us at hi@nuit.archi.

3. Information We Collect

3.1 Information You Provide

• Account information: email address provided during registration.
• Project data: text prompts, project names, briefs, and reference images you upload.
• Communications: messages you send to us via email.

3.2 Information Collected Automatically

• Usage data: pages visited, features used, generation count, timestamps, and interaction patterns.
• Device data: browser type, operating system, screen resolution, and language preference.
• Log data: IP address, access times, and referring URLs.
• Anti-abuse signals: to prevent abuse of free credits and detect multiple accounts, we process technical signals including IP address and an approximate device fingerprint. The lawful basis is our legitimate interest in preventing fraud and abuse. These IP addresses and device signals are kept for up to 180 days after they were last seen, then deleted.
• Location check: we determine the country associated with your IP address to comply with export-control and sanctions law. This is normally resolved on our own servers against an offline database, so your IP address is not disclosed to anyone; for addresses that database does not cover, we query the geolocation service ipapi.co. We do not infer your location from your language settings, the language you write in, or your email provider — only from your IP address. The check applies to each request on its own: we do not suspend, block or delete an account because of where you connect from, and you can always sign in, view and download your work, and delete your account. When a request is refused because of region, the country and IP address of that request, with the time and, if you are signed in, your account, are kept as a log for 90 days. IP geolocation by DB-IP, licensed under CC BY 4.0.

3.3 Cookies

We use essential cookies to maintain your session and preferences. We may use analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings or our cookie consent banner.

We set a first-party cookie named _nuit_attr to record how you arrived at our site — for example, the partner link or marketing campaign that brought you here. This is used internally to credit partners for referrals and to apply any discount associated with that partner. The cookie expires after 60 days. It does not track you across other websites and is not shared with third parties. Because it is necessary to honour the discount you arrived with, it is set without a consent prompt — you can clear it through your browser’s cookie settings at any time.

Cookie settings

3.4 Connecting Nuit to AI assistants

You can connect your Nuit account to an AI assistant such as Claude or ChatGPT through our connector at mcp.nuit.archi. When you connect, you sign in to Nuit with a one-time email code and authorise the assistant to act on your Nuit account. We then store a registration record for the assistant’s client (its identifier and the address it returns you to) and access and refresh tokens, kept only as one-way hashes, together with your Nuit session in encrypted form. Access tokens expire after one hour and refresh tokens after 30 days. You can end access at any time by disconnecting the connector in the assistant; any remaining tokens stop working when they expire, or we revoke them on request at hi@nuit.archi.

The assistant sends our connector only what a tool needs to do its job, for example a design prompt, a project or image identifier, or a floor-plan program. We process and store this as part of your Nuit project, exactly as if you had entered it in the studio. We do not receive or request your conversation history, the assistant’s memory or your other files. Our servers keep short technical logs of connector requests (time, request path, tool name, response status and a connection identifier, without the content of your prompts) for security and troubleshooting. Purchases are made only on nuit.archi, never through the connector. How the assistant itself handles your conversation is governed by its provider’s privacy policy.

4. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Service.
• Process your image generation requests.
• Manage your account and subscription.
• Send transactional communications (account verification, billing, service notices such as changes to these terms).
• Analyze usage patterns to improve features and performance.
• Detect, prevent, and address technical issues or abuse.
• Comply with legal obligations.

5. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, we process your data based on:

• Contract performance: processing necessary to provide the Service you requested (account, generation, billing).
• Legitimate interests: improving the Service, analytics, security, and fraud prevention.
• Consent: where you have given explicit consent (e.g., marketing communications, non-essential cookies).
• Legal obligation: where processing is required by law.

6. Data Sharing and Disclosure

We do not sell your personal data. We share data with the following categories of recipients:

• Hosting and infrastructure: Vercel, which hosts this website and parts of the Service.
• AI model providers: the companies whose models generate your images from the prompts and reference images you submit. We use, or may use, models from Google, Meta, xAI (Grok), Black Forest Labs and Recraft. Requests reach them through OpenRouter, which forwards the request to the model provider on our behalf, or through the provider's own API.
• Image storage and delivery: bunny.net, which stores the images you generate and upload and delivers them to your browser.
• Payment processing: our payment processor, which handles card details directly. We do not store card numbers.
• Email delivery: our transactional email provider, which sends sign-in, verification, billing and service messages.
• Analytics: our product analytics provider, which records how the website and the studio are used.
• Geolocation: ipapi.co, queried only for IP addresses our offline location database does not cover (see 3.2).
• Legal requirements: if required by law, court order, or governmental request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

The providers named above are those we use today together with those we may use as the models offered in the Service change. Those that receive data today are bound to protect it, either by our contract with them or by the published terms under which we use their service. Those listed only as ones we may use receive nothing from us unless and until a model of theirs is actually offered in the Service. Adding or removing a model does not change how we handle your data under this policy; it changes which of these providers receives a particular request, and that is determined by the model you choose.

Model providers and their terms

The companies below may process the prompts and images you submit when you generate. Each processes them under its own terms and privacy policy, linked here. The second table does the same for the other services that handle your data.

These tables describe the Service as at the “Last updated” date at the top of this page. They are revised whenever a model or a service is added to, or removed from, the Service.

7. AI-Generated Content

7.1 What we do

When you submit prompts and reference images, they are sent to a third-party AI provider so that an image can be generated and returned to you. We do not use your prompts or your generated images to train models of our own, and we do not sell, license, or otherwise pass them to anyone for the purpose of training AI models. Generated images are stored in your account and are accessible only to you unless you choose to share them.

7.2 What the providers do

Generation itself is carried out by third-party providers on their own infrastructure, under their own terms and privacy policies. Those terms are not identical across the models we offer: for some models the provider is contractually barred from using submitted content to train or improve its models, and for others no such restriction applies. We can only pass on the commitments we have actually been given, so we do not claim that no provider ever uses submitted content for training.

If a provider’s training and retention policy matters for your work — confidential briefs, work under NDA, competition entries — read the policies of the providers in section 6 before you submit the material, or write to us at hi@nuit.archi.

8. Data Retention

• Account data: retained as long as your account is active. Upon account deletion, personal data is removed within 30 days.
• Generated images: retained as long as your account is active. Deleted upon account deletion.
• Usage logs: retained for up to 12 months for analytics and security purposes.
• Billing records: retained as required by applicable tax and accounting laws.
• AI assistant connections: access tokens stop working after one hour and refresh tokens after 30 days. Connector request logs are kept as long as necessary for security and operations, up to 90 days.

Retention by AI providers. The periods above cover the data we hold. Prompts and images sent to a third-party AI provider for generation may also be retained on that provider’s own systems, for its own period, under its own policy. Those periods differ from provider to provider and are outside our control, and deleting an image from your Nuit account does not by itself remove any copy a provider may hold. Where a provider publishes its retention period, it applies to the models that provider serves and not to the Service as a whole.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data.
• Portability: request your data in a machine-readable format.
• Restriction: request that we limit processing of your data.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at hi@nuit.archi. We will respond within 30 days.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data in accordance with applicable law.

12. Children’s Privacy

The Service is not intended for children under the age of 13, and we do not knowingly collect personal data from them. If you are between 13 and 17, you may use the Service only with the permission of a parent or legal guardian. If we become aware that a child under 13 has provided us with personal data, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact

For questions, concerns, or requests regarding this Privacy Policy, contact us at: hi@nuit.archi