Privacy Policy

NIAH Data Ltd (“we”, “us”, “our”) operates the Venue Intelligence platform (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

Information You Provide

• •Account Information: Name, email address, company name, and password when you register
• •Payment Information: Billing details processed through our payment provider (Stripe)
• •Usage Data: Searches performed, exports generated, and features used within the platform

Information Collected Automatically

• •Log Data: IP address, browser type, access times, and pages viewed
• •Cookies: Session cookies for authentication and preferences

2. How We Use Your Information

We use collected information to:

• •Provide and maintain the Service
• •Process your transactions
• •Send administrative information (account updates, security alerts)
• •Respond to your enquiries and support requests
• •Improve and personalise the Service

3. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

• •Service Providers: Third parties that help us operate the Service (hosting, payment processing)
• •Legal Requirements: When required by law or to protect our rights
• •Business Transfers: In connection with a merger, acquisition, or sale of assets

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time.

5. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• •Encryption of data in transit (HTTPS/TLS)
• •Secure password hashing
• •Regular security assessments

6. Your Rights (GDPR)

If you are in the UK or European Economic Area, you have the right to:

• •Access: Request a copy of your personal data
• •Rectification: Correct inaccurate data
• •Erasure: Request deletion of your data
• •Restriction: Limit processing of your data
• •Portability: Receive your data in a structured format
• •Objection: Object to processing based on legitimate interests

To exercise these rights, contact us at info@niahdata.co.uk

7. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies without your consent.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Service.

9. Contact Us

For privacy-related questions or concerns:

NIAH Data Ltd

Email: info@niahdata.co.uk

Website: https://www.niahdata.co.uk

10. Synthetic Consumers platform

This section covers Synthetic Consumers, our AI consumer-panel platform. It supplements the sections above, which continue to apply. NIAH Data Ltd is the data controller for the personal data described here.

What we collect

When you apply for access: your name, work email, company, job title, and any context you choose to give us about your role, your research needs and the decisions you face. We record the consents you give and when you gave them.

When you use the platform: your account details, sign-in events, and usage records such as tests run and features used. We collect this to operate your account, meter usage against your plan, and improve the product.

The content you submit: the concepts, briefs, creative, images, video and chat messages you test. This includes personal data only if you choose to put it there. We recommend you do not submit personal data about identifiable individuals.

Cookies: a strictly necessary session cookie keeps you signed in. The platform sets no advertising or cross-site tracking cookies and runs no analytics.

How we use it, and our lawful basis

• •Reviewing your application and operating your account. Lawful basis: contract, or steps taken before entering one.
• •Generating persona reactions to the content you submit. Lawful basis: contract.
• •Sending service email such as sign-in codes, welcome messages and service notices. Lawful basis: contract, and our legitimate interest in running the service.
• •Improving the product using usage records and the feedback you give us. Lawful basis: our legitimate interest in improving what we sell.
• •Marketing email. Lawful basis: your consent, given only if you opted in, and withdrawable at any time.
• •Security, audit and abuse prevention. Lawful basis: our legitimate interest in protecting the service, and our legal obligations.

We do not use your content to train AI models, and we do not permit our AI providers to do so. Your content is processed to generate your results and for no other customer.

Who else processes your data

• •Supabase: database, authentication and file storage for your account and your tests.
• •OpenAI: processes the content you submit to generate persona reactions, chat replies, transcription of any video you upload, and generated images. Content sent through the API is not used to train OpenAI's models.
• •Vercel: hosting for the web application.
• •Resend: delivery of transactional email.
• •Sentry: error monitoring, so we find faults before you have to report them.
• •Stripe: payment processing, if and when you take a paid plan. We never see your full card details.

Some of these providers process data outside the UK. Where they do, we rely on UK adequacy findings or on the UK International Data Transfer Addendum incorporated into their terms.

How long we keep it

• •Chat conversations: deleted after 90 days.
• •Tests and their results: kept while your account is active so you can revisit them, and deleted when your account is deleted.
• •Account and consent records: kept while your account is active and for six years afterwards, for legal and accounting purposes.
• •Unsuccessful applications: deleted after 12 months.

You can ask us to delete your test and chat history at any time without closing your account.

A note on what the platform produces

Persona responses are AI-generated, directional insight. The personas are synthetic composites built from research signals. They do not describe, and cannot be traced back to, any real individual.