Privacy Notice
How we process personal data under UK GDPR.
Last updated: 21 August 2026
This Privacy Notice explains how Nikah AI Ltd (“GigBlend”, “we”, “us”) processes personal data when you use the Platform. It is designed for UK GDPR and the Data Protection Act 2018. If you are in the EEA, equivalent rights generally apply via our arrangements with EU users.
**Controller:** Nikah AI Ltd, Office 1216 Fitzrovia, 60 Tottenham Court Road, London, W1T 2EW, company number 17199968. **Contact:** privacy@gig-blend.com **Data Protection Officer / lead:** Data protection lead at privacy@gig-blend.com **ICO registration:** ZC176381 (if applicable)
1. Data we collect - **Identity & contact:** name, email, display name, country, organisation - **Account & security:** password hashes (via auth provider), session metadata, MFA status, device/browser data, IP address (often hashed or truncated in logs) - **Profile & seller data:** bio, skills, portfolio links, languages (no identity document images) - **Transaction data:** orders, packages, fees, payout ledger entries, dispute records - **Content:** messages, requirements answers, uploaded files, deliverables, reviews - **AI execution metadata:** job status, token/cost estimates, evaluation scores, prompts configuration references (not buyer-facing system secrets) - **Support:** tickets, emails, call notes if any - **Technical logs:** diagnostics, error reports, security logs - **Marketing preferences:** consents and opt-outs - **Cookies:** see Cookie Notice
**We do not store:** full payment card numbers; passport/driving-licence images; selfies for KYC; bank statements for Connect verification—those are collected by Stripe where required.
2. Sources You; your organisation admins; payment providers (Stripe); auth providers (e.g. Supabase Auth); device; public sources only where a Gig expressly uses consented web research; anti-fraud signals.
3. Purposes and lawful bases | Purpose | Lawful basis | |--------|----------------| | Provide accounts, Gigs, orders, messaging, delivery | Contract | | Take payment, prevent fraud, keep ledgers | Contract; legitimate interests; legal obligation | | Seller Connect onboarding coordination | Contract; legal obligation | | AI fulfilment of purchased Gigs | Contract | | Quality, trust & safety, AUP enforcement | Legitimate interests; legal obligation | | Service emails (order updates) | Contract | | Product emails / marketing | Consent or soft opt-in where lawful; you can opt out | | Analytics (if enabled) | Consent for non-essential cookies/tools | | Improve models/agents using limited operational metrics | Legitimate interests (not training public foundation models on your private files by default) | | Comply with law, regulators, tax | Legal obligation | | Establish/defend legal claims | Legitimate interests |
4. AI processing When you buy an AI or hybrid Gig, your requirements and files are processed by our systems and, where configured, by subprocessors (model providers). We instruct providers via API under our contracts. Do not submit special category data or children’s data unless a Gig expressly supports it with safeguards. See AI Transparency Notice and Subprocessors.
5. Sharing We share data with: infrastructure hosts (e.g. Supabase, cloud region UK/EEA where available); Stripe; email provider (e.g. Resend); file storage (e.g. Cloudflare R2); AI model providers for fulfilment; support tools; professional advisers; authorities when legally required; and counterparties on an order (buyer/seller/reviewer) as needed to perform the order.
We do not sell personal data.
6. International transfers If data leaves the UK/EEA, we use appropriate safeguards (e.g. UK IDTA / Addendum, EU SCCs, adequacy regulations) and transfer risk assessments where required.
7. Retention Each period below is enforced automatically by a scheduled job, not by anyone remembering. They are exact, not maximums.
| Data | We keep it for | Why that period |
|---|---|---|
| Deliverable files, and the free-text content of your brief | **90 days** after the order is settled — accepted or auto-accepted, revisions used up and any dispute window closed | Long enough to re-download work and raise a late complaint. The questions your brief answered are kept; the answers are deleted. |
| Orders, invoices, ledger entries, payouts | **6 years** from the end of the accounting period | Finance Act 1998 Sch 18 para 21, and the limitation period for contract claims (Limitation Act 1980 s.5) |
| Seller identity and earnings records for platform reporting | **5 years** after the end of the reportable period | The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 (SI 2023/817) |
| Messages you send | Deleted when you close your account; attachments expire with the order's files at 90 days | Not needed once the order and any dispute are closed |
| Sign-in and sign-out history | **90 days** | Enough to investigate a recent account compromise |
| Other security and admin audit records | **12 months** | Investigation window for platform abuse |
| Record that you registered | Kept for the life of the account | It is the evidence that you consented at sign-up |
| Notifications | **30 days** once read, **180 days** otherwise | They restate what is already on your order |
| Record that we emailed you | Address and subject line deleted at **90 days**; the template name, outcome and date are kept | Proof of delivery does not require your address |
| Sessions | Expire 30 days after your last visit, and **90 days** after sign-in regardless of activity | A sliding session should be convenient, not permanent |
| Payment provider event records | **90 days** | Only the event id, amount and status; never the provider's object |
| Marketing consent | Until you withdraw it | PECR reg 22 |
Closing your account deletes everything above that is not in a statutory row. Where a statutory row applies we keep the record and replace your name and email address with a permanent tombstone, so the books still balance but the record no longer identifies you.
**We do not hold** payment card numbers, bank details, dates of birth or identity documents. Where seller verification requires them, Stripe collects and holds them under its own terms — we receive only a yes/no on whether payouts are enabled.
8. Your rights (UK GDPR) Access; rectification; erasure; restriction; portability; objection (including to direct marketing); withdraw consent; complaint to the ICO (ico.org.uk). We may need to verify identity. Some rights are limited where we must retain data for legal claims or law.
**Exercise rights:** Sign in and use **Account → Your data** to download everything we hold as JSON, or to close your account immediately. You can also email privacy@gig-blend.com.
9. Children The Platform is not directed at children under 18. We do not knowingly collect their data.
10. Security See Security page. No method is 100% secure; report vulnerabilities to support@gig-blend.com.
11. Automated decision-making We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement, except fraud blocks that you can contest via support. Ranking and moderation signals may be partly automated with human escalation paths.
12. Changes We will update this Notice and revise the date above. Material changes will be highlighted where appropriate.
Questions?
Privacy: privacy@gig-blend.com · Legal: legal@gig-blend.com · See also Contact & company information.