Privacy Policy
Draft — pending legal review. Not yet in force.
This text is a draft for review by our lawyers. It is not yet our privacy notice. Text in square brackets is still to be decided. When in force, the English version governs; the Chinese version is a translation.
Version: draft of 29 September 2026 · Effective date: [to be set]
This policy explains how NICETO LTD ("we", "us") uses personal data in connection with Preworld Review, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are and our role
- For account, sign-in, service log and billing data, and for this documentation site, NICETO LTD, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, is the controller.
- For personal data inside our customers' content (tests, test files, what an AI under test says and does, reports, repository contents in a sandbox), the customer is the controller and we are its processor, acting under the Data Processing Agreement. If your data is in a customer's content, please contact that customer first; we will help them respond.
Contact for anything about this policy: huanting.w@nice2.io. [Data protection officer: to be confirmed whether one is required.]
2. What we collect
| Category | Data | Source |
|---|---|---|
| Account data | Email address, name (optional), organization, role, language preference | You, or the colleague who invites you |
| Sign-in and device data | Session records, CLI devices and test runners with their labels (which may include a computer's hostname) | Your use of the Service |
| GitHub or Google sign-in (only if you use it) | From GitHub: your user ID, user name, name and the email addresses GitHub has verified. From Google: your account ID, email address and whether Google has verified it, and your name. We keep the account ID and the email it had when it was linked to your account. We never receive your GitHub or Google password, and the access token they give us is used once to read these details, then discarded | GitHub or Google, when you choose to sign in with them |
| Service logs | IP address, time, request and response details | Your browser and tools, automatically |
| Support communications | What you write to us and our replies | You |
| Billing data (once billing starts) | Billing contact, company name and address, VAT number, invoices, payment status. Card details are collected and held by Stripe, not by us | You and Stripe |
| Assistant conversations | What you ask the in-app assistant and its answers; text that looks like a secret is replaced before storage | You |
| Usage analytics (only if you accept analytics cookies) | The addresses of the pages you open, clicks, scrolling and mouse movement, the layout of those pages (in the web app with every text hidden), your browser, device and screen size, and the IP address Microsoft receives | Your browser, through Microsoft Clarity (section 4) |
3. How we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing the Service: creating your account, signing you in, running your tests, showing your reports | Contract |
| Keeping the Service secure: preventing abuse, investigating incidents, enforcing spending limits | Legitimate interests (protecting our customers and the Service) |
| Service messages: sign-in links, run notifications, changes to the Service or these policies | Contract; legitimate interests |
| Support | Contract; legitimate interests |
| Billing, accounting and tax records | Contract; legal obligation |
| Understanding and improving the Service from usage data | Legitimate interests |
| Seeing how people use the web app and this site (Microsoft Clarity) | Consent, given in the cookie banner; you can withdraw it at any time under "Cookie settings" |
| Marketing emails, if we send any | Consent, or for existing customers our legitimate interests as the law allows; every email has an unsubscribe link |
We do not use personal data for automated decisions that have legal or similarly significant effects on you. The judge model grades the behaviour of AI systems under test, not people.
4. Cookies and similar technologies
Strictly necessary. The web app sets one cookie you cannot switch off: the session cookie that keeps you signed in. Signing in with GitHub or Google sets one more for ten minutes, sent only to the sign-in addresses, which ties their answer to your browser. Your browser also keeps, on your device only, your language, your light or dark theme on this site, and your answer to the cookie banner. None of these is sent to anyone else.
Analytics, only if you accept. When we switch it on, a banner on the web app and on this site asks whether we may use Microsoft Clarity to see how people use them. Nothing of Clarity loads until you click "Accept"; "Reject" is one click as well, and one answer covers the web app and this site. You can change it at any time under "Cookie settings" (in the web app's side bar, or its header when you are signed out, and in this site's side bar). If you accept:
- Clarity records clicks, scrolling, mouse movement and the layout of the pages you open, the page addresses, and your browser, device and screen size. In the web app every text on the page is hidden before it leaves your browser (only placeholders go to Clarity), and pages with reports, logs, tests or a project are never recorded, nor any address that carries a sign-in or invitation code. On this site the page text is public and is not hidden. What you type into a form is always hidden.
- We never pass Clarity your name, email address, organization or any of our identifiers.
- Clarity sets two first-party cookies:
_clck(a random Clarity user ID, kept up to a year) and_clsk(joins your page views into one session, kept a day). We grant analytics storage only, not ad storage, so Microsoft's advertising cookie sync does not run. - Microsoft keeps recordings for 30 days; recordings we mark as favourites, and a random sample, for up to 9 months.
- If you reject after accepting, Clarity is told, its cookies are deleted and it stops.
Microsoft processes this data for us under the Microsoft Clarity terms [Microsoft's role and the data protection terms: to be confirmed]. See the data processing page.
5. Who we share it with
- Sub-processors that help us run the Service: Google Cloud (hosting, London), OpenAI and Anthropic (judge model and assistant; OpenAI also the model requests of an agent in a sandbox project without its own
OPENAI_API_KEY), Microsoft Azure (platform models, only when you pick one or for such an agent; sandbox virtual machines, only for a project set to run on Azure), Microsoft Clarity (usage analytics, only for visitors who accept it), Stripe (payments, once billing starts), an email provider and a status page provider. The current list, with what each receives, is on the data processing page. - Professional advisers (lawyers, accountants, auditors) under duties of confidentiality.
- Authorities, when the law requires it.
- A buyer or successor of our business, who would be bound by this policy.
We do not sell personal data.
6. International transfers
We store personal data in the United Kingdom (Google Cloud, London). Some sub-processors are outside the UK, and so are the sandbox virtual machines of a project set to run on Azure while it runs:
| Recipient | Country | Safeguard |
|---|---|---|
| OpenAI | United States | [UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where the recipient is certified — to be confirmed] |
| Anthropic | United States | [as above — to be confirmed] |
| Microsoft Azure | Sweden (Sweden Central). Platform models: deployment type [to be confirmed]: a Global Standard deployment may process outside the EU. Sandbox virtual machines of a project set to Azure: Sweden Central, until they move to UK South (London) | [UK adequacy regulations for the EEA; for processing outside the EU, as above — to be confirmed] |
| Microsoft Clarity | [to be confirmed]: Microsoft's data centres, possibly the United States | [Microsoft's terms for Clarity; for customers in the EU, Microsoft Ireland Operations Limited with Standard Contractual Clauses with Microsoft Corporation — to be confirmed for the UK] |
| Stripe | [to be confirmed] | [as above — to be confirmed] |
You can ask us for a copy of the safeguards at huanting.w@nice2.io.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account exists, then deleted within [30] days of closure |
| Linked GitHub or Google account | Until you leave your last organization |
| Service logs | 30 days |
| Usage analytics (Microsoft Clarity) | 30 days; favourite recordings and a random sample up to 9 months |
| Assistant conversations | While your account exists, unless you delete them [to be confirmed] |
| Support communications | [2 years] after the matter is closed |
| Billing and tax records | As long as the law requires (normally six years) |
| Backups | Up to 90 days |
8. Security
We protect personal data with the measures described in the security overview, including encryption in transit and at rest, isolation of every cloud run, least-privilege access and backups.
9. Your rights
You have the right to:
- access the personal data we hold about you;
- have it corrected if it is wrong;
- have it erased;
- restrict how we use it;
- object to our using it on the basis of legitimate interests;
- receive it in a portable format, where we process it under a contract or your consent;
- withdraw consent at any time, where we rely on it.
To exercise a right, write to huanting.w@nice2.io. We reply within one month, or tell you within that month if we need longer.
10. Complaints
If you are unhappy with how we handle your data, please tell us first at huanting.w@nice2.io. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
11. Children
The Service is for businesses and is not directed at anyone under 18.
12. Changes
We will publish any change here with a new version date and, for significant changes, tell account owners by email.
Contact
NICETO LTD, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ · huanting.w@nice2.io