Privacy Policy

Who is responsible for your data

Nikah AI Ltd trading as Cognivault, a company registered in England and Wales (company number 17199968), registered office Office 1216, 60 Tottenham Court Road, London W1T 2EW, ICO registration ZC176381. Privacy questions and data-rights requests go to info@nikah-ai.com.

We are the controller of account data (who you are, how you sign in, billing status) and of the security and support records we keep. Where a business or other organisation uses Cognivault, that organisation is the controller of the content its people put into its workspaces, and we process that content on its behalf under our data processing terms. If you are named in a workspace’s content and want to exercise your rights over it, contact that organisation; we will help it respond.

What we collect

• Account data. Your email address and the date the account was created. Two optional flags are added only if they are ever set: an operator role (for our own staff accounts) and whether you have completed onboarding. Your password is stored only as a hash; we never hold the password itself. We do not ask for your name.
• Workspace content. Everything you choose to type or paste into a workspace: decision briefs and their sources, reasoning-profile sessions, answers and entries, operating-memory records and their revisions, outcome reviews, and Ask threads and messages. There is no file upload or import. This content may contain whatever you type into it, so avoid entering personal data you do not need to record, and do not enter special category data (such as health information) about other people.
• Team data. Workspace names, membership and roles, and the email addresses you invite.
• Billing status. The plan, subscription status, seat count and Stripe customer and subscription identifiers held against your workspace. Card details are never entered on this site — see billing terms.
• Operational records. For each AI request, a record of whether it succeeded, the failure type, timing, token counts and cost, linked to the workspace but holding no question, content or answer. A log of any action our operator takes on an account, and error records. Our server also keeps ordinary web and mail logs.

Cookies and similar storage

The site uses only storage that is strictly necessary: the cookies and browser storage that keep you signed in, and your light/dark theme choice in local storage.

No analytics, advertising or tracking tool runs on this site, and no analytics code is included in it, so there is no cookie banner to answer. If that ever changes, this notice will be updated first and nothing non-essential will be stored without your consent.

Why we use it, and on what basis

• To provide the service you signed up for — accounts, workspaces, briefs, memory and Ask, including the AI analysis you ask for. Lawful basis: performance of a contract.
• To keep the service secure and working, control our AI spending, and answer support requests. Lawful basis: legitimate interests.
• To meet accounting and tax obligations on paid accounts. Lawful basis: legal obligation.

Who we share it with

• OVH — we rent a virtual private server from OVH, located in England, and operate it ourselves. OVH supplies the machine and network.
• Our own Convex backend — the database and sign-in system run on a self-hosted Convex deployment on that same server. Account data and workspace content are stored there, under our control. Convex the company does not receive it.
• Our own mail server — account emails such as password resets are sent directly from our server, without a third-party email service, to your own email provider.
• Stripe — handles payment for a paid plan. Checkout and the billing portal are Stripe’s own hosted pages, so your card details go to Stripe and never reach us. Payment runs through Stripe Managed Payments, so Stripe is the merchant of record and handles the sales tax. Onelink (Stripe’s saved-card checkout, the service formerly called Link) is how the card is presented on the page. Stripe and Onelink use the payment details they collect under their own privacy policies. Stripe returns the plan, subscription status and identifiers, which we store.
• AI analysis: OpenCode Zen, operated by Anomaly (San Francisco, United States) — only when someone in a workspace runs Ask or a grounded Decision Brief review. For Ask we send the question and the text of the workspace records that match it; for a brief review we send the brief’s title and context and the titles and text of its attached sources. We do not send your name, email address or account details. OpenCode passes the request to the DeepSeek V4 Pro model (a model developed by the Chinese company DeepSeek). OpenCode states that all the models it serves are hosted in the United States; it does not name the company that hosts this model for it. OpenCode states that its providers keep no copy of requests and do not train on them, and that it does not store prompt content itself. We have not been able to verify those statements independently.

Transfers outside the UK. Stripe may process payment data outside the UK under the safeguards described in its own privacy policy. AI requests are processed in the United States. OpenCode does not offer written data-processing terms or a UK transfer mechanism (such as the UK International Data Transfer Agreement), and we do not currently have one in place with it. Until we do, do not put personal data into records you ask the AI features to analyse unless you are content for it to be processed in the United States on that basis. Everything else stays on our server in England. We do not sell personal data and we do not use it for advertising.

Automated decisions and AI output

Cognivault does not make decisions about you. AI output is a draft for people to review: it can be wrong, and a decision a team records is taken by that team. Do not use it as the sole basis for a decision with legal or similarly significant effects on a person.

How long we keep it

Account data and workspace content are kept for as long as the account and workspace exist, and are deleted when you delete them — see the account deletion page. Deleted data can remain in our nightly backups for up to 45 days before those backups are removed; backups are only used to recover from a failure. A daily job deletes operational records automatically: AI request records, error records, the log of emails we sent (recipient address and subject) and processed payment-event identifiers after 90 days; team invitations 30 days after they are accepted or expire; expired sign-in sessions and one-time codes once they expire; and the log of actions our operator took on an account after 2 years. Deleting an account removes the Stripe customer and subscription identifiers from our database. The payment records themselves (invoices, payments, refunds and the Stripe customer record, which holds your email address) stay in our Stripe account, where Stripe, as merchant of record, holds them for six years from the end of the accounting period the record falls in, which is the retention HMRC requires of a UK limited company to meet accounting and tax obligations. Onelink, the saved-card checkout, is not a seller and is not a second merchant of record.

Your rights

You have the right to be told what we hold about you and to have a copy of it (access, Article 15), to receive it in a portable machine-readable form (portability, Article 20), to have it corrected (Article 16), to have it deleted (Article 17), to have our use of it restricted (Article 18), to object to it (Article 21), and to withdraw any consent you have given.

Two of those you can exercise yourself, immediately, without contacting us. In the app, under Settings then Delete account, there is a Download my data button that produces a complete JSON file of everything we hold about you — including a manifest naming every table we keep and saying what it contained, what we gave you, and anything we withheld and why. The same screen deletes your account for real, with no “deactivated” flag and no support queue.

For anything else, or if you cannot sign in, use the form on our contact page — it gives you a reference and a date on screen the moment you submit it, so your request is acknowledged without depending on email — or write to info@nikah-ai.com.

How long we take. We respond within one month of receiving your request. The law lets us pause that clock while we are waiting for information we reasonably need in order to identify you or to understand what you are asking for, and it restarts when you reply; we will only ask for what we genuinely need. If the request is genuinely complex we may extend by up to two further months, and if we do we will tell you why within the first month. We do not charge for any of this.

Automated decisions and profiling. We do not make any decision about you by purely automated means that has a legal effect on you or similarly significantly affects you, so the safeguards in Articles 22A to 22D of the UK GDPR do not bite. The AI features produce a draft for a person to read, judge and act on, and the product labels it as such every time. We do not profile you, score you, or use your workspace content to train any model.

Complaining about how we have handled your data. You can complain to us on the form on our contact page, which acknowledges it on screen with a reference and a date, and we will respond within 30 days. You do not have to come to us first: you can complain directly to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113, at any time.

Cookies and browser storage

Every cookie and local-storage entry we set is listed, individually, on our cookies page, with what it is for and how long it lasts. The short version: a handful of cookies that sign you in and keep you signed in, two preferences stored in your own browser, no analytics, no advertising, no tracking, and not a single script, font or image loaded from a third party. Nothing at all is stored before you sign in, which is why there is no banner to answer.

Children

Cognivault is a workplace tool and is not directed at children. You must be 16 or over to create an account.