How we handle your data

Who is responsible

The data controller is Bastin Mitchell Ltd, registered in England and Wales, company no. 17200634, trading as Nikksi. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Contact us about anything on this page at hello@nikksi.com.

What we collect, and when

When you request an AI Visibility Audit or start the assessment we collect your name or company name, your website address, your work email address, and whether you ticked the optional marketing box. That is all the form asks for, and we do not add to it from other sources.

Your IP address is never stored as itself. It is turned into a salted one-way hash, which lets us recognise repeated automated submissions without being able to recover the address. If the salt is not configured, no hash is stored at all rather than an unsalted one.

The audit itself reads public web pages — your website, as any crawler would. It uses no private or purchased data about you or your customers.

Why we use it

To deliver what you asked for: to run the audit, write the report, and send it to you. To reply to you if you get in touch. And, only if you ticked the box, to send you occasional email about what we publish.

The lawful basis

For delivering the audit and replying to you, our basis is the performance of a contract with you, or our legitimate interest in responding to a request you made of us. For marketing email, our basis is your consent, given by ticking a box that is never pre-ticked. You can withdraw that consent at any time and it does not affect anything else.

Who else processes it

We use a small number of service providers. They act on our instructions and may not use your data for their own purposes.

• Vercel — Hosts the website and runs its server code.
• Supabase — Stores the records described above. Hosted in the EU region.
• Resend — Sends the transactional emails — your confirmation, and our internal notification.
• Kit — Sends marketing email, and only to people who ticked the box.
• Stripe — Takes payment where something is paid for. Card details go to Stripe, never to us.

We do not sell your data, and we do not share it for advertising.

How long we keep it

Audit requests are kept for 24 months, so we can see what was asked for and when, and re-run an audit if you ask us to. Marketing contact details are kept until you unsubscribe, after which we keep only the minimum needed to make sure we do not email you again.

Automated decisions

The audit produces a score from published rules. It is not a decision about you, it produces no legal or similarly significant effect, and a person reads the results and writes every report before it is sent.

Your rights

• Ask for a copy of what we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete it.
• Ask us to stop using it for a particular purpose.
• Withdraw consent for marketing at any time, without affecting anything else.
• Ask for your data in a portable form.

Email hello@nikksi.com and we will action it. You do not have to give a reason.

If you are not happy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would rather you told us first, but you are not obliged to.

Organisations in the Readiness Index

The UK SME AI Readiness Index records observations about organisations, read from material those organisations published themselves. Any organisation can have its record removed without proving who it is, and the record stops resolving from the next request.

Changes

If this policy changes we will update this page. It carries no version history yet; if that matters to you, ask and we will tell you what changed.