Privacy Notice

Who we are

WatchTower is a trading name of Nikah AI Ltd, a company registered in England and Wales with company number 17199968, registered office Office 1216, 60 Tottenham Court Road, London W1T 2EW. We are registered with the Information Commissioner’s Office under registration number ZC176381. Contact us through the contact form or at info@nikah-ai.com.

This notice explains how we use personal data as a controller: when you visit watchtowerai.co.uk, contact us, sign up or use a console account, or pay us.

If your organisation monitors your device with WatchTower

When an organisation installs the WatchTower agent on a device, that organisation is the controller of the information collected and we process it for them as a processor, under our Data Processing Terms. Please ask your organisation how it uses WatchTower and send requests about that information to it; if you contact us we will pass your request on. Our monitoring notice explains what the agent can collect.

What we collect and why

• Website visits: our server records ordinary request logs (address requested, time, response, IP address and browser type) to keep the site secure and working. Lawful basis: legitimate interests in running a secure website.
• Contact form and email: your name, email address, the category you choose, your message, and the IP address it came from, used to reply and to keep a record of the enquiry. Lawful basis: legitimate interests in answering you; contract where you are a customer.
• Accounts: for console users, name, work email, role, organisation, password (stored hashed), multi-factor settings, sign-in times and the actions you take in the console (kept in the audit log). Lawful basis: contract with your organisation, and legitimate interests in securing the service.
• Billing: the billing contact, plan, device count, invoices and payment status. Card details are entered on Stripe’s page and we never see them. Lawful basis: contract, and legal obligation for accounting records.
• Service emails: we email account holders about their account, security alerts they have set up, and material changes to our terms. We do not send marketing email.

We do not sell personal data, we do not use it for advertising, and we do not use analytics or tracking tools on this website or in the console.

Who we share it with

We use these providers, each under contract:

• OVHcloud — virtual server hosting. The server that runs the console and stores every workspace’s data is in the United Kingdom.
• Stripe — payments and subscription billing. Receives the billing contact, organisation name and device count for a subscription; never endpoint telemetry. Stripe may process data outside the UK.
• Zoho — hosts the info@nikah-ai.com mailbox. Receives notifications of contact-form messages and anything you email us, which may include personal data you choose to send. Zoho may process data outside the UK.

We may also disclose information where the law requires it, to protect the security of the service, or to a buyer of the WatchTower business, who would have to respect this notice.

Where it is kept

Our server is in the United Kingdom. Stripe and Zoho may process the data they receive outside the UK; where they do, they rely on UK adequacy regulations or on transfer safeguards such as the UK International Data Transfer Addendum.

How long we keep it

• Server request logs: only as long as needed for security and troubleshooting.
• Contact-form enquiries: up to two years after our last exchange, unless they become part of a customer record.
• Console accounts and the audit log: for as long as the workspace exists; see the Data Processing Terms for what happens when it ends.
• Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
• Backups: database backups are overwritten within 30 days.

Cookies

This site sets only strictly necessary cookies: csrf_token, which protects forms against cross-site request forgery; access_token, which keeps you signed in; and wt_consent, only if you ever submit a cookie preference. There is no analytics, advertising or third-party cookie. Details are in the Cookie Policy.

Security

Connections are encrypted with TLS, passwords are hashed, agent secrets and integration credentials are encrypted in the database, the database is not reachable from the internet, and administrative actions are recorded in a hash-chained audit log. No system is perfectly secure; if a breach affects you and the law requires it, we will tell you and the ICO.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to our use of it, and to data portability. Console users can export much of their own data from the Your data page. To use a right, use the contact form or email info@nikah-ai.com; we will respond within one month. You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113; we would appreciate the chance to put things right first.

Changes

We will update this notice when our use of personal data changes, and show the date at the top.