Privacy Policy

Last updated: 6/15/2026

Introduction

This Privacy Policy explains how Night Mode Ltd collects, uses, stores, and protects your personal data when you visit our website at https://aspire.wales (the "Website") or use our mobile application "Aspire" (the "App"). The Website and App are referred to together as the "Services".

We are committed to protecting your privacy and handling your personal data transparently and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and (where applicable) the EU General Data Protection Regulation (EU GDPR).

If you have any questions about this policy or how we handle your data, please contact us at support@nightmode.studio.

Who we are (Data Controller)

The data controller responsible for your personal data is:

Night Mode Ltd GCNG House, Unit 12 Swansea SA7 9LA United Kingdom

Email: support@nightmode.studio

What data we collect

We only collect personal data that we genuinely need to provide and improve our Services. The data we collect depends on how you interact with us.

Information you give us via the Website

When you sign up via our landing page at aspire.wales (for example, to join the waitlist), we collect:

• Your email address

The Website does not use any cookies, advertising trackers, or analytics tools.

Information you give us via the App

When you create an account or use the App, we collect:

• Account information: your name, email address, and password (passwords are stored in hashed/encrypted form — we never see your plaintext password).
• Push notification tokens: a device-specific identifier issued by Apple or Google that allows us to send you push notifications, if you have granted permission.
• Chat conversations and messages: content you send into the AI features of the App (see Section 6 for how this is processed).

Information collected automatically

When you download or install the App from the Apple App Store or Google Play Store, those platforms may collect certain technical information about your device and your installation. We do not control what Apple or Google collect please refer to their respective privacy policies.

How we use your data and our legal basis

Under UK GDPR, we must have a lawful basis for every use of your personal data. Here is how we use your data and why:

Marketing and product updates from the Website

We use your email to send you updates after you sign up via our landing page. Legal basis: Consent (Article 6(1)(a)).

Creating and managing your App account

We use your email, and password to set up and maintain your account. Legal basis: Performance of a contract (Article 6(1)(b)).

Transactional emails

We use your email address to send essential account-related emails such as password resets and important account notifications. Legal basis: Performance of a contract (Article 6(1)(b)).

Push notifications

We use your push notification token to send you notifications you have opted into. Legal basis: Consent (Article 6(1)(a)).

AI-powered features in the App

We process your chat conversations to provide AI features within the App. Legal basis: Performance of a contract (Article 6(1)(b)).

Security and abuse prevention

We use your account data to keep our Services secure and prevent fraud, abuse, or misuse. Legal basis: Legitimate interests (Article 6(1)(f)).

Legal compliance

We may use your account data where required to comply with applicable laws. Legal basis: Legal obligation (Article 6(1)(c)).

You can withdraw consent at any time for marketing emails, by clicking the unsubscribe link in any email; for push notifications, by disabling them in your device settings.

How we share your data (Sub-processors)

We do not sell your personal data. We share it only with carefully chosen service providers ("sub-processors") who help us operate the Services. Each provider is contractually bound to protect your data and only process it on our instructions.

Postscale

Used for sending emails. Postscale is operated by DNScale OÜ, an Estonian (EU) company, and hosts primary service data within the EU/EEA. Limited operational metadata may be processed by infrastructure providers under appropriate data transfer safeguards.

Microsoft Azure

Used for cloud hosting, storage, and infrastructure. All account and App data may be processed here. This is based in UK SOUTH.

Microsoft Azure AI Foundry

Used to power the AI chat features in the App. Chat conversations and messages are sent to this service to generate responses. This is based in UK SOUTH

Sanity.io

Used as our content management system for Website and App content. This primarily holds our own content. Sanity operates globally with EU infrastructure.

Apple App Store and Google Play Store

Used for App distribution and platform services. Data is shared as determined by each platform's own terms. These services operate globally.

We may also disclose your data where legally required (for example, in response to a court order), or to protect our rights, users, or others from harm.

AI features and how your messages are used

The App includes AI-powered chat features that are provided using Microsoft Azure AI Foundry. When you interact with these features:

• Your messages are sent to Microsoft Azure AI Foundry to generate a response.
• Microsoft processes this data on our behalf as a sub-processor under their enterprise terms.
• Your chat content is not used by Microsoft or by us to train public AI models.
• Conversations may be stored in your account so you can access your history.

If you do not want your messages processed by AI features, please do not use those features.

How long we keep your data

We retain your personal data indefinitely for as long as your account remains active or you remain subscribed to our communications.

You can request deletion at any time. Once we receive a deletion request, we will:

• Delete your account data from our active systems within 30 days;
• Remove your data from routine backups within a further 90 days as backups are rotated;
• Retain only what is strictly required by law

If you unsubscribe from our mailing list, we will remove your details from active marketing lists but may retain a suppression record (your email only) so we can ensure we do not contact you again.

Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — to ask us to delete your data.
• Right to restrict processing — to ask us to limit how we use your data.
• Right to data portability — to receive your data in a portable, machine-readable format.
• Right to object — to object to certain types of processing, including direct marketing.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time.
• Rights related to automated decision-making — we do not currently make decisions about you based solely on automated processing.

To exercise any of these rights, email us at support@nightmode.studio. We will respond within one calendar month.

How we protect your data

We take security seriously and use a range of technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS);
• Encryption of sensitive data at rest;
• Hashed and salted password storage;
• Access controls so that only authorised personnel can access personal data;
• Use of reputable, security-certified infrastructure providers (Microsoft Azure).

Children's privacy

Aspire is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at support@nightmode.studio and we will delete it.

Cookies

The Aspire Website at https://aspire.wales does not use cookies, advertising trackers, or analytics tools.

The App is not a website and therefore does not use cookies, although it does use locally stored data (such as your login session) needed for the App to function.

Third-party links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before sharing any personal data with them.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Notify you by email or via an in-App notice where the changes are significant.

We encourage you to review this policy periodically.