GALIO GENERAL TRADING - FZCO, registration number 82421 and commercial licence number 89182, is the controller for NITEO account and service information. Registered office: IFZA Business Park, DDP, PO Box 342001, Dubai, United Arab Emirates. Account collection and payment remain unavailable where sanctions, payment-provider rules, or unresolved launch requirements prevent service. Processor and transfer records are completed before each production provider handles member data. Privacy questions can be sent to contact@nite-o.com.
1. Scope and roles
This notice applies to the NITEO website, builder, membership account, dashboard, research delivery, and support interactions. GALIO GENERAL TRADING - FZCO, operating the NITEO service, is the controller of account and service information.
Payment, authentication, hosting, email, and optional Telegram providers may process limited information for NITEO under their own contractual and legal responsibilities. Their roles, data locations, contracts, and transfer safeguards are recorded in NITEO's provider register before activation. Links to third-party sites are governed by their notices.
2. Information we collect
| Category | Examples | Why it is needed |
|---|---|---|
| Account and contact | Name, verified email address, account identifier, country | Create and secure an account; provide notices and support. |
| Membership and payment records | Plan, trial and billing status, invoice details, payment-provider references, checkout disclosure version | Administer recurring access, receipts, tax, cancellation, consent records, and fraud prevention. NITEO does not store full card details. |
| Monitor preferences | Selected market groups, evidence views, attention level, cadence, historical-context threshold, quiet hours, time zone, delivery channel, paused or active state | Provide the configuration you request. These are content preferences, not a suitability profile. |
| Delivery identifiers and history | Email destination and, if enabled, Telegram chat identifier, connection status, channel, delivery state, timestamps, and limited failure reason | Match, deliver, retry, and show the service messages you select. |
| Support and legal requests | Messages, attachments, request category, verification record | Respond, protect accounts, and document compliance. |
| Technical and security | IP address, device/browser data, timestamps, logs, approximate location, consent records | Operate securely, diagnose failures, apply jurisdiction controls, and prevent misuse. |
An anonymous builder draft remains in the browser. After sign-in, the verified email and monitor settings can be stored with the member account. Provider transmission begins only when the relevant production service is enabled.
3. Sources
We obtain information directly from you, automatically from your browser or device, from service providers used to operate the product, and from publicly available sanctions or jurisdiction information where required. We do not ask a financial institution or venue for your account holdings or transaction history.
4. Purposes and legal bases
| Purpose | EEA/UK basis where applicable |
|---|---|
| Create an account, provide the configured service, administer payment, and answer service requests | Performance of a contract or steps you request before a contract |
| Security, abuse prevention, service reliability, record integrity, and product improvement | Legitimate interests, balanced against your rights |
| Tax, accounting, sanctions, regulatory, and lawful authority requests | Legal obligation |
| Optional product updates and non-essential device storage | Consent, where required |
We do not use personal information to make a solely automated decision that produces a legal or similarly significant effect on a customer. AI may assist with organisation or support triage, with human accountability retained.
5. Sharing
The intended production providers are Google/Firebase for authentication, hosting, database, server functions, and App Check; Stripe for hosted payment and subscription administration; Resend for email; and Telegram only when a member chooses that optional channel. Their activation remains subject to the production provider and transfer record. We disclose only what is reasonably needed to:
- hosting, security, authentication, database, email, notification, customer-support, and payment service providers;
- professional advisers, auditors, insurers, and authorities where legally required;
- a successor in a corporate transaction, subject to appropriate confidentiality and notice; or
- another party when you direct us or give valid consent.
NITEO does not exchange personal information for money and does not use it for cross-context behavioural advertising. If that practice changes, we will update this notice and provide any required choice before it begins.
6. International transfers
NITEO is operated from the United Arab Emirates and may use providers in other countries. Where EEA or UK personal data is transferred to a country without an adequacy decision, we will use an approved transfer mechanism such as standard contractual clauses and additional safeguards where required. UAE transfer requirements also apply where relevant.
7. Retention
| Record | Retention approach |
|---|---|
| Account and monitor preferences | While the account is active. A verified deletion request pauses delivery immediately and is targeted for review within 30 days, subject to lawful retention and security exceptions. |
| Market-event and delivery history | Up to 400 days for the Evidence Log, delivery integrity, correction review, and service support. |
| Publication compliance record | Customer-facing publication content and a pseudonymous distribution manifest are retained for eight years from the latest distribution where this control is required. The manifest contains a content hash, channel, country, timestamp, and a per-publication recipient reference that is not reused across publications. |
| Telegram connection | Until disconnected or deletion is requested. One-use link tokens expire after 15 minutes; only a token hash is stored before use. |
| Webhook and abuse-control records | Processed Stripe webhook records are scheduled for deletion after 90 days. Short-lived rate-limit records expire after their control window plus one day. |
| Invoices, checkout consent, and payment records | For the period required by applicable tax, accounting, consumer, anti-fraud, dispute, and legal obligations. |
| Support and privacy requests | For as long as reasonably needed to resolve the matter, demonstrate how it was handled, and meet applicable obligations. |
| Provider security logs | Google Cloud currently retains default operational logs for 30 days and required audit logs for 400 days. Other providers apply their applicable security and abuse-prevention retention terms. |
Operational expiry fields and a scheduled cleanup job enforce the stated 15-minute, 90-day, 400-day, and eight-year periods. Mandatory tax, accounting, consumer, company, dispute, and legal retention may continue where applicable.
8. Your rights
Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object, obtain a portable copy, withdraw consent, or complain to a data-protection authority. UAE law, the EEA GDPR, the UK GDPR, and certain US state laws provide different scopes and exceptions.
Use the Privacy Choices page or email contact@nite-o.com. We may verify identity and authority before acting. We will respond within the period required by the law that applies to the request.
9. Communications
Service, security, billing, and legal messages are necessary for an active account. Promotional email is optional. You can unsubscribe through the message or contact us. Telegram, if selected for delivery, is not the support channel and is governed by Telegram's own privacy terms.
10. Security and children
We use proportionate technical and organisational measures intended to protect personal information. No method is completely secure, so we cannot promise absolute security. The service is not intended for anyone under 18, and we do not knowingly create accounts for children.
11. Changes and contact
We may update this notice when the service, providers, or law changes. Material changes will be highlighted and, where appropriate, notified to members before they take effect.
Privacy contact: contact@nite-o.com. You may also complain to the competent supervisory authority in your location.