Privacy Notice

1. Who is responsible for your data

Aidan Mc Carron, trading as NicoServe, is the data controller for personal data processed to operate NicoServe's website, accounts and customer relationships. Contact sales@nicoserve.com for privacy questions or requests. Where we handle personal data on an organisation's instructions as part of its workspace, the organisation may be the controller for that data.

2. What we collect and why

• Account and workspace information: name, email address, authentication information, workspace membership and preferences, used to create accounts, control access and provide the service. The legal basis is performance of our contract and legitimate interests in secure administration.
• Monitoring and service content: connected domains, verification information, scan evidence, findings, uptime history, incidents, reports and remediation records. These may include personal data present in public website or DNS information. We process them to deliver requested monitoring and reports under our contract.
• AI conversations: prompts, replies and relevant workspace evidence, used to answer security questions. Relevant content is shared with AI service providers to generate responses under our contract. Do not submit passwords, private keys or unnecessary personal or sensitive information.
• Support and contact messages: your name, email and message contents, used to respond to enquiries and support requests under our contract or legitimate interests in customer communication.
• Technical and security information: IP addresses, browser or device information, request and error logs, account-security events and service usage, used for reliability, troubleshooting, abuse prevention and service improvement on the basis of legitimate interests.
• Notification settings and destinations: email preferences and connected alert-channel information, used to deliver the notifications you request under our contract. Optional marketing, if offered, relies on consent where required; consent can be withdrawn.

We may also process information where necessary to meet a legal obligation. Where we rely on legitimate interests, those interests must be balanced against your rights.

3. Who receives information

Information is shared only where needed for the relevant purpose: with service providers supporting hosting, storage, authentication, AI processing, email delivery, diagnostics or support; with authorised workspace members; and with alert destinations configured by your workspace. Public domain details may be submitted to DNS, reputation and availability-check providers to perform requested checks.

Paddle is our Merchant of Record and receives information needed for product sales, subscription management, payments, tax compliance and invoicing. Paddle handles checkout payment details under its own Privacy Policy. We may receive order references, customer identifiers and subscription status to provide paid access.

We may share necessary information with professional legal or accounting advisers and authorities where legally required.

4. Retention

Account and workspace information is retained while needed to provide the service. Cancelling a subscription pauses monitoring after the paid period but does not automatically delete saved results. Account-security activity is retained for up to 30 days, with older records removed by daily cleanup.

Other service records, conversations, support messages and diagnostics are retained only as long as needed for their purpose, resolving disputes, maintaining security or meeting legal obligations. When no longer needed, personal data will be deleted or anonymised. Contact us to request deletion or ask about retention for a particular record; legally required records may need to be retained.

5. Security and international transfers

We are responsible for applying appropriate technical and organisational measures proportionate to the risks, including access controls and protection of information in transit and storage where appropriate. No online service can guarantee absolute security.

Service providers may process information outside your country, including outside the UK or European Economic Area. Where applicable data-protection law requires safeguards for a transfer, we will use an appropriate lawful mechanism, such as an adequacy decision or approved standard contractual clauses. Contact us for information about relevant recipients, locations and safeguards.

6. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent at any time without affecting processing already carried out lawfully. UK and EEA individuals may also complain to their supervisory authority, including the Irish Data Protection Commission where relevant.

Email sales@nicoserve.com to exercise your rights. We may need to verify your identity. For requests covered by UK or EU GDPR, we will respond within one month, subject to any permitted extension that we explain to you.

7. Cookies and browser storage

Essential cookies or browser storage may be used to maintain sign-in sessions, secure access and remember necessary settings. You can manage cookies and site storage through your browser, but blocking essential storage may prevent sign-in or payment features from working. Checkout providers may use their own cookies under their privacy notices.

If non-essential analytics or marketing cookies are introduced, we will provide information and obtain consent where required before using them, with a way to manage or withdraw that consent.

8. Changes and contact

We may update this notice when the service or our processing changes. The effective date appears above; material changes will be communicated where appropriate. For questions, contact Aidan Mc Carron at sales@nicoserve.com.