Effective 25 October 2026
Privacy policy
1. Who we are
Nightsquire is provided by Bastiaan Prummel, a sole trader trading as Nightsquire, of Dromroe, Ballagh, Killeedy, Co. Limerick, V42 HT62, Ireland, VAT number IE0375955FB (Nightsquire, we, us).
For any question about this policy or your personal data, or to exercise your rights, email security@nightsquire.dev.
2. What this policy covers
This policy covers two things:
- The website at nightsquire.dev, including the form where you ask to be notified when Nightsquire opens.
- The service at app.nightsquire.dev: the dashboard, the controller, managed executors, Nightsquire AI and the email we send for it.
In the service we have two roles, depending on the data:
| Role | Data | What applies |
|---|---|---|
| Controller | Data about the people who visit the website, ask to be notified, or use the service: accounts, sign-in, memberships, sessions, security logs and our communication with you. | This policy. |
| Processor | Data inside a customer's organisation: GitLab events, issue and merge request content, repository content, logs, transcripts, model prompts and outputs, credentials, usage and audit data, and who started each run. | The customer decides why and how this data is processed. We process it on the customer's behalf under the data processing agreement. |
If your data appears in a customer's GitLab project, for example because you wrote an issue, a comment or a commit, the customer is the controller. Please contact them first; we will help them answer you.
3. Visiting the website
This website runs on netcup in Germany, on the same infrastructure as the Nightsquire control panel. When you visit it, our server receives the technical data every web request carries: your IP address, browser and device type, the page requested, the referring page and the time. We keep this in server logs for at most 30 days to deliver the site and protect it against abuse.
The website sets no cookies, runs no analytics, advertising or tracking scripts, and loads its fonts from its own domain.
Our status page at status.nightsquire.dev runs on our own server in the Netherlands. It works the same way: request logs for at most 30 days, no cookies, no tracking.
4. The notify form
When you ask to be notified, we receive your email address and, if you choose to fill them in, your company or team, which GitLab you use and what you would hand Nightsquire first.
We use this only to tell you when Nightsquire opens to more teams and, if you are interested, to invite you. We do not send newsletters and do not share your details for marketing.
The form is delivered to us by email through Scaleway's Transactional Email service and arrives in our mailbox, hosted by Infomaniak in Switzerland. You can ask us to remove you at any time by emailing security@nightsquire.dev.
5. Using the service
5.1 Account and identity data
- Name, email address and profile picture URL.
- GitLab identities: your organisation's GitLab instance, your numeric GitLab user id and username, from signing in with that GitLab or linking your account.
- OAuth tokens your organisation's GitLab issues when you sign in or link your account. Owners' and admins' tokens are stored encrypted and used only to set up projects and the bot's access. Other members' tokens are used once to identify you and then discarded.
- Your organisation memberships and roles, and invitations (the invitee's email address, who invited them and when).
- If you are a Member or Viewer: whether your GitLab account can read each of your organisation's projects, asked of your organisation's GitLab and refreshed about every 15 minutes, so the dashboard shows you only the projects you can read there.
- The GitLab user who started each run. Before a run reads another project of your organisation's GitLab, or creates an issue in one, Nightsquire checks that you could do so yourself in GitLab, and refuses otherwise.
5.2 Session and security data
- Session records: a session token, its expiry, your IP address and browser user agent.
- Audit records of actions in the service, such as sign-ins, settings and configuration changes, credential changes (never the credential itself), member changes and executor management, with the acting user and time.
- Technical server logs of requests and errors, which may include IP addresses.
5.3 Communication
- Emails we send you (invitations, sign-in links, run notifications, service and security notices) and emails you send us, with their content and metadata.
- Your notification choices per organisation, and a delivery log of the notification emails we send you: event, subject, status and time, never the address or the message itself.
5.4 Acceptance of the terms
- When you accept the terms of service, and when an owner accepts the data processing agreement for an organisation: who accepted, which document and version, when, and the IP address and browser user agent it was accepted from.
We do not collect special categories of personal data about you, and we do not buy data about you from others.
6. Purposes and legal bases
| Purpose | Data | Legal basis (Article 6(1) GDPR) |
|---|---|---|
| Delivering the website and protecting it against abuse | 3 | (f) legitimate interest in running a secure website |
| Telling you when Nightsquire opens, and inviting you | 4 | (a) consent, which you give by submitting the form and can withdraw at any time |
| Creating and running your account and membership, signing you in | 5.1, 5.2 | (b) contract with you or the customer you work for; where you act for a customer, (f) our legitimate interest in providing the service to that customer |
| Showing members only the projects they can read in GitLab, and checking a run's access to other projects against the person who started it | 5.1 | (b) contract with the customer you work for, and (f) legitimate interest in keeping each customer's data from people who may not see it |
| Keeping the service secure: authentication, rate limiting, preventing and investigating abuse, audit trail | 5.2 | (f) legitimate interest in the security of the service and our customers' data |
| Sending invitations, sign-in links, run notifications and service and security notices | 5.1, 5.3 | (b) contract, or (f) legitimate interest in operating the service |
| Answering questions and support requests | 5.3 | (b) contract, or (f) legitimate interest in helping our users |
| Keeping a record of who accepted which version of the terms and the data processing agreement | 5.4 | (f) legitimate interest in being able to show what was agreed |
| Establishing or defending legal claims | as needed | (f) legitimate interest |
Where we rely on legitimate interests, you may object (section 11). We do not use your data for advertising, we do not sell it, and we make no decisions about you based solely on automated processing that have legal or similarly significant effects. The service uses AI models to decide how to handle GitLab issues; those decisions concern work items, not people.
7. Cookies and browser storage
Website: no cookies and no browser storage.
Service: only first-party storage that is strictly necessary for the service to work:
| Name | What it does | How long |
|---|---|---|
| Session cookie | Keeps you signed in. | About 7 days, or until you sign out |
| nightsquire_org | Remembers the organisation you last used, so the app opens there. | 365 days |
| nightsquire_oauth | Ties a GitLab sign-in to the browser that started it, so nobody else can complete it. | At most 10 minutes; removed when the sign-in completes |
| Setup and invitation token (session storage) | Keeps the token of a setup or invitation link while your browser is on GitLab to sign you in. | Until the tab is closed |
| Colour theme (local storage) | Remembers your light or dark choice. | Until you clear it |
- Neither the website nor the service uses analytics, advertising or tracking cookies, or third-party scripts.
- The dashboard may show profile pictures loaded from your organisation's GitLab instance; your browser then contacts that instance.
Because we only use strictly necessary storage, we do not ask for cookie consent.
8. Who receives data
| Recipient | What for | Location |
|---|---|---|
| netcup GmbH | Hosting of the control panel, its database and storage, and this website. | Germany (Nuremberg) |
| Scaleway SAS | Managed executors, Nightsquire AI, backups, and Scaleway Transactional Email, which sends all our service email (invitations, sign-in links, notifications) and the notify form. | France (Paris) |
| Infomaniak Network SA | Our mailbox for hello@ and security@, where notify form submissions and your emails to us arrive. It does not send service email. | Switzerland |
Data may also go to:
- Your organisation's GitLab instance, when you sign in with it or link your account, and when Nightsquire asks it which projects you can read.
- Other people in your organisation: owners and admins see members, roles, linked GitLab usernames and the audit log.
- Authorities, where the law requires it.
- A successor, if our business is transferred, under the same protections.
A customer that connects its own model provider (for example a Claude API key or an OpenAI-compatible API) or its own executors chooses and contracts those itself. Model calls then go from the executor straight to that provider, not through the Nightsquire control panel.
9. Transfers outside the EEA
The service, this website and our status page run entirely in the EU: on netcup in Germany, Scaleway in France and our own server in the Netherlands. Apart from our mailbox, below, we do not transfer personal data we control outside the European Economic Area.
Our mailbox is hosted by Infomaniak in Switzerland, which the European Commission recognises as providing an adequate level of data protection.
Services a customer chooses itself, such as its GitLab provider, model provider or executor hosts, may be located elsewhere; the customer is responsible for those transfers.
10. How long we keep data
| Data | Retention |
|---|---|
| Website server logs | At most 30 days |
| Notify form submissions | Until you ask us to remove you, or 24 months after we last contacted you, whichever is first. If you join, your details move to your account. |
| Account and identity data | While your account exists; deleted within 30 days after you ask, or after the account is closed. |
| Memberships and invitations | While the membership exists, or until the invitation is accepted, withdrawn or expires. |
| Project access checks | Refreshed about every 15 minutes; removed with your membership or the project. |
| Notification choices | While your membership exists. |
| Notification delivery log | 90 days |
| Records of acceptance of the terms and the data processing agreement | As long as your account (terms) or the organisation (data processing agreement) exists, as evidence of what was agreed. |
| Sessions | Until the session expires, after about 7 days, or you sign out. |
| Audit and security records | While the organisation exists, for at most its audit retention period (default 365 days, settable from 90 to 1,825). |
| Service server logs | 30 days |
| Emails and support requests | As long as needed to handle the request, and no longer than 24 months. |
| Backups | Overwritten within 30 days. |
We may keep data longer where needed to establish or defend legal claims, or where the law requires it.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data;
- erase your data, unless we must keep it;
- restrict processing in some cases;
- data portability: receive data you gave us in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent where we rely on it, such as for the notify form, without affecting what we did before.
Email security@nightsquire.dev. We answer within one month; in complex cases this may be extended by two months, and we will tell you. We may ask you to confirm your identity first.
12. Security
We protect personal data with technical and organisational measures, including TLS for every connection, encryption of stored credentials and OAuth tokens (AES-256-GCM) with a key per organisation, strict separation between organisations, access limited to authorised members, and audit logging. Annex 2 of the data processing agreement describes the measures in detail.
13. Children and changes
The website and the service are for businesses and are not intended for anyone under 16.
We may update this policy. We tell organisation owners about material changes by email or in the dashboard before they take effect. The date at the top shows the current version.