Privacy Policy

Last updated: July 15, 2026

NightShift ("we", "us", or "our") operates the website nightshiftai.agency and provides an AI-powered email auto-responder service for small service businesses ("Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service.

1. Information We Collect

Personal Information You Provide

When you sign up for NightShift, we collect your name, email address, business name, and a password (stored as a bcrypt hash — never in plain text). If you connect an email account to enable auto-reply, we store your IMAP/SMTP credentials encrypted at rest.

Information Collected Automatically

When you visit our site, we automatically receive your IP address, browser type, operating system, referring URLs, and pages visited. We use this data only in aggregate to operate, secure, and improve the Service.

2. How We Use Your Information

• To provide and maintain the Service (generate AI replies, send them via your connected SMTP).
• To authenticate you and protect your account from unauthorized access.
• To send you service-related emails (billing, security alerts, feature updates). Marketing emails are opt-in.
• To respond to support requests you submit.
• To detect and prevent abuse, fraud, and violations of our Terms of Service.

3. AI Processing

Inbound customer emails are sent to OpenAI to generate a contextual reply. Subject lines and body content may be transmitted for this purpose. NightShift does not use your customer emails to train AI models, and we have configured our OpenAI usage accordingly.

4. How We Share Your Information

We do not sell your personal information. We share data only with:

• OpenAI — generates AI replies on your behalf, governed by OpenAI's usage policies.
• Stripe — processes payments when you subscribe; Stripe receives your billing details directly.
• Meta (Facebook Pixel) — measures the effectiveness of our advertising on Meta platforms. Pixel PageView fires on every page; Lead on signup; Purchase on confirmed Stripe payment.
• Service providers — hosting and infrastructure (Render), email delivery (your connected SMTP). Each is bound by confidentiality obligations.
• Law enforcement — only when compelled by valid legal process.

5. Data Security

Passwords are hashed with bcrypt. IMAP/SMTP credentials are encrypted at rest. All traffic is served over HTTPS. Access to production data requires authentication and is limited to authorized personnel. No method of transmission over the Internet is 100% secure, but we work continuously to protect your data.

6. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we delete your personal information within 30 days (except where retention is required by law, e.g. tax records). Conversation and AI response data is retained to deliver the Service and may be retained in anonymized aggregate form for analytics.

7. Your Rights

You may access, correct, or delete your personal information at any time via your account Settings, or by emailing support@nightshiftai.agency. California residents have the right to know what personal information we collect and to request deletion (CCPA). European residents have the right to access, rectify, erase, restrict processing, data portability, and to object to processing (GDPR).

8. Children's Privacy

NightShift is not intended for children under 16. We do not knowingly collect information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact Us

If you have questions about this Privacy Policy, email us at support@nightshiftai.agency.