On this page
At a glance
- The website contact form sends your enquiry to our team. Its local demonstrations do not read your apps or microphone.
- An installed Ari has a separate Mac/model/tool data flow. Local storage does not mean every connected service is offline.
- You can ask about information we hold and exercise applicable rights without agreeing to marketing or giving us app access.
This overview helps you navigate the document. Read the full sections for the complete explanation.
Who is responsible and which activity this covers
1.1 Website operator
Nightwing Digital Solutions Co., Ltd. is the operator responsible for the website enquiry and website-operation activities described here. Contact info@nightwingdigital.co. The document details panel identifies our business address and country. A brand name is not a substitute for the registered operator.
1.2 Website versus installed-app processing
This policy distinguishes the current public marketing website from Ari’s installed Mac software, privately paired iPhone app and any future managed service. Visiting the website does not connect to your Mac, import your files or create an installed-app account. Before a customer service is supplied, its actual operator roles, providers and processing must be disclosed in the relevant product notice and contract.
1.3 Business customers and processing roles
A business using Ari with employee or customer information may have its own data-controller duties. Where Nightwing processes that information solely for a business customer under a future managed service, an appropriate data-processing arrangement must identify instructions, safeguards, assistance and subprocessors. A general website policy does not replace that arrangement.
Information on the current website
| Activity | Information involved | Purpose and choice |
|---|---|---|
| Enquiry form | Name, email and message/goal; optional company, interest, budget and timeline. | Reply to the request, understand the proposed work and keep the relevant correspondence. Required fields enable a response; optional fields may be left blank. |
| Requests to the website | IP/network address, requested URL, time, browser/device request information and hosting/security events. | Deliver the page, investigate errors and protect the service. The hosting layer may retain operational logs. |
| Form security | Time-limited form token, request identifier, pseudonymised network identifier and delivery reference/status. | Validate a request, limit abuse, avoid duplicate sends and track delivery status. |
| Cookie choices | A first-party choice record with a notice version, decision/expiry times and whether functional preferences are allowed. | Remember acceptance or rejection for up to 180 days. This necessary record contains no name, email, free-text input or unique visitor ID. |
| Optional functional preferences | The selected FAQ category, saved in a separate first-party cookie only after functional preferences are allowed. | Remember your chosen FAQ category for no longer than the cookie choice remains valid. Rejecting or withdrawing deletes this preference. |
| Local demonstrations | The question typed into the hero tour, viewport and pointer interactions used to render the local experience. | Choose and display a scripted website tour in the browser. The audited demo code does not send the question to a model or save it persistently. |
| Optional external links | A fixed public description of Ari embedded in selected external AI links. | Open a third-party service if you choose the link. It is not your private enquiry or hero input. |
Required fields and information to leave out
Submitting an enquiry is voluntary. A name, a reachable email address and a useful message are required by the form so the team can respond. If you do not provide them, you may browse the site without submitting an enquiry or contact us through another available channel. Optional commercial details help us understand scope but are not needed to read the website.
Do not include passwords, secret tokens, financial credentials, government identifiers, health records, biometric samples or confidential records about other people. Describe a use case without sending production data. If a later support task needs a sample, agree a suitable secure method and use the minimum necessary information.
The form does not enrol you into marketing, create a subscription or authorise an app permission. Responding to the enquiry and separate promotional communication are different purposes. Any optional marketing consent must be requested separately with a way to withdraw it.
Purposes and grounds for handling information
We handle enquiries to communicate with the sender, assess a requested service and take steps the sender asks for before a possible contract. We use limited technical information to deliver, secure and maintain the website, prevent abuse and investigate delivery problems. We may also keep records necessary to meet a legal obligation or handle a genuine dispute.
Where a law requires identification of a lawful ground, the appropriate ground depends on the activity: requested pre-contract steps or contract performance for a genuine enquiry/service, a legitimate interest in proportionate website security and communications where permitted, a legal obligation for required records, or consent for a distinct optional activity. A general “I agree” is not used as a substitute for identifying the proper ground.
If we propose a materially different use of personal information, the relevant notice and lawful basis must be established before that use begins. This policy does not grant a broad right to repurpose private enquiries for AI training, profiling or unrelated advertising.
A necessary first-party cookie remembers your cookie choice. The separate functional-preference cookie is optional and remains off until you allow it. Use the Cookies button to reopen the popup, then Cookie settings to change or withdraw that choice. Neither choice is agreement to marketing, analytics, a subscription or installed-app access.
Service providers and who receives website information
The site is hosted on Vercel. Enquiries pass through our same-origin form handler to Resend for delivery to info@nightwingdigital.co, hosted in Microsoft 365. Your email is used as the reply address. Authorised Nightwing team members handling the request can see the correspondence. These providers also process the information needed to deliver, secure and support their services.
The form handler does not create a separate enquiry database in this website. Email delivery records, the destination mailbox and hosting/security records are separate copies with their own processing and retention. A cookie choice is not permission to use an enquiry for unrelated marketing or AI training.
The cookie controls do not upload your choices to a profiling service or a separate server-side consent register. As with other browser cookies, their values can automatically accompany requests to this same host and be received by the hosting infrastructure. Cookie choices are therefore not a promise that no network information reaches the server.
We may disclose relevant information when legally required, to obtain professional advice, protect legal rights or investigate a proportionate security incident. A reorganisation involving personal information needs appropriate safeguards and notification where required; it is not permission to sell data for an unrelated purpose.
| Recipient or activity | What is handled and where |
|---|---|
| Vercel | Website delivery and operational/security information. The form function is configured in Washington, DC, United States; page delivery uses a global network. This function location does not describe every Vercel support, security or infrastructure record. |
| Resend | Enquiry email delivery, message content and delivery records. Resend states that customer data is stored in the United States; the selected sending region does not change the storage location. |
| Microsoft 365 | Destination mailbox and associated recovery, security and service processing. The website does not choose or verify a single-country mailbox location; Microsoft service processing may involve locations outside Thailand. No Thailand-only storage promise is made. |
| Nightwing Digital Solutions | The team in Thailand handles enquiries, follow-up and privacy requests. Access is for the relevant task, not public disclosure of your message. |
Retention, removal and backup limits
| Record | Retention period or criterion |
|---|---|
| Enquiry correspondence | Kept while needed for the request, relevant follow-up, an ongoing relationship or a specific legal/security purpose. This website does not impose an automatic mailbox-deletion deadline. You may request access, correction or deletion through the contact below. |
| Email delivery records | Resend publishes 30-day email/log retention for its standard Free, Pro and Scale plans, with Enterprise arrangements potentially differing. This describes the provider’s policy, not a verified mailbox expiry or a guarantee that all related provider records share one deadline. |
| Mailbox, recovery copies and backups | Microsoft 365 mailbox, recovery and hold policies govern these copies. A message can remain after delivery until removed under the relevant process or policy; clearing website cookies does not remove it. We do not assert an unverified recovery or backup duration. |
| Hosting/security records | Vercel retains operational and security information according to the service, enabled features and applicable requirements. Runtime-log availability is not the deletion deadline for every infrastructure/security record. Website form-token, rate-limit and duplicate-reference lifetimes are described separately above. |
6.1 Purpose-based retention criteria
Our retention criterion is the continuing purpose of the record: responding to your request, handling relevant follow-up or an ongoing relationship, and meeting a specific legal obligation or handling a genuine claim/security issue. When those purposes no longer require identifiable correspondence, it should be deleted or de-identified. A specific exception applies only to the necessary material; it is not a basis for indefinite retention of every enquiry.
6.2 Security lifetimes are not email retention
In the current application code, the form token lasts up to one hour, a pseudonymised network rate-limit bucket lasts ten minutes, and a successful-request deduplication reference may stay in instance memory for up to twenty-four hours. These are security/cache lifetimes, not the retention period for your email, provider records or hosting logs.
6.3 Cookie choices and optional preference expiry
The cookie-choice record is set for up to 180 days, and the optional FAQ preference expires no later than that choice. This is a product-selected lifetime, not a statement that the law requires 180 days. Your browser may remove cookies sooner. A new choice, expiry, clearing cookies or using a different browser may require you to choose again.
6.4 Deletion, legal holds and independent copies
Deleting browser data does not retract delivered email. There is no website-controlled automatic expiry for the destination mailbox and no promise that a message, recovery copy or backup disappears on a fixed day. Send a deletion or retention question to info@nightwingdigital.co; we assess the records we control, applicable rights, any necessary legal hold and provider assistance. Where removal is limited or delayed, we explain the relevant reason rather than claim instant global erasure.
Processing locations and cross-border handling
Nightwing handles website enquiries in Thailand. Hosting, email delivery, mailbox services and provider support/security processing can involve the United States and other countries outside your location, including Microsoft service locations that are not selected by this website. The table identifies the known processing path; it does not promise exclusive local storage.
The relevant providers publish data-processing agreements, subprocessors and transfer provisions. Those provisions do not, by themselves, certify that every transfer or future Ari use meets every country’s requirements. We remain responsible for the arrangements and applicable duties for the processing we control; contact us about a particular record or transfer concern.
The current marketing website does not send your hero-tour question or enquiry to an AI model for a product answer. Model-provider transfers described in the installed-Ari section concern a separately configured app or future service, not a hidden website chat session. Following an optional external AI link is separate navigation to that service.
How installed Ari information differs
8.1 Local Core and configured providers
Ari’s current source design uses a Mac-based Core. Conversations, knowledge and selected saved material can be kept locally. A paired iPhone connects to that Mac. A configured cloud model or online tool can receive the relevant request, page, passage or account information needed for its task. Provider choice and permission settings affect this flow.
8.2 Optional memory, voice and screen data
Optional Cloud Memory syncs selected collections rather than a whole-device backup. A voice profile uses numeric voice signatures; separate opt-in Hearing training keeps encrypted training phrases on the Mac. Screen capture, meeting transcription/recording, game observation and iPhone screen sharing have their own controls. Voice information may require heightened protection under the law applicable to a particular use.
8.3 Release-specific notices and deletion boundaries
These are product architecture disclosures, not a statement that Nightwing’s marketing server receives all of your installed-app data. Before any managed subscription launches, the release-specific notice must identify data actually collected by Nightwing, each service role, diagnostics, destinations, retention and appropriate consent. Website controls cannot erase records from a user’s Mac, phone or independently configured provider.
Requests, choices and regional rights
9.1 Making and verifying a request
Send privacy questions or requests to info@nightwingdigital.co. Identify the relevant activity, such as a website enquiry, without attaching unnecessary identity documents. We may need proportionate verification to avoid giving your information to the wrong person. Any permitted refusal or limit must be explained, and applicable response periods and complaint rights remain available.
9.2 Rights depend on the applicable law
Depending on the law and facts, you may have rights to access/copy, correct, erase, restrict or object to processing, receive portable data, withdraw consent, or stop particular collection/use. These rights are not identical in every country and may have lawful exceptions. Withdrawing consent does not retrospectively invalidate processing that was lawful before withdrawal.
9.3 Thailand, Hong Kong and Taiwan
For Thailand, relevant rights may arise under the Personal Data Protection Act, including complaints to the competent Thai authority. For Hong Kong, the Personal Data (Privacy) Ordinance includes access/correction and the applicable data-protection principles; complaints may be made to the PCPD. For Taiwan, the applicable PDPA includes access/copy/correction and cessation/deletion rights that cannot be waived in advance. We do not require you to give up a statutory right to use the enquiry form.
9.4 Other applicable regional protections
If EU/UK or another jurisdiction’s privacy law applies to a particular activity, its applicable rights and regulator route remain available. This reference does not suggest that every law applies to every visitor; the relevant processing and legal scope determine which protections apply.
Security and sensitive communications
The website uses HTTPS, same-origin delivery, server-side validation, signed short-lived form tokens, request limits, duplicate-send controls and restrictive content/permission policies. Delivery credentials stay on the server. The application’s delivery logs contain a reference/provider status rather than the full submitted message.
Security controls reduce risk but do not eliminate every incident or replace organisational access controls, vendor agreements and training. Share only necessary information. If a breach involving records we control requires notice, we must assess and meet the applicable duties within the deadlines that apply to that incident.
Children and capacity
This is a general product-introduction website, not a children’s service. Planned individual Ari access has a minimum age of 18, together with the legal-capacity conditions in the Terms. Reaching that minimum or possessing a payment card does not override an older local age requirement or required legal-representative involvement. The launch offer must specify any supported process; the present website has no enrolment. No age rule removes a child’s legal rights.
If you believe a child has provided personal information through this site, contact info@nightwingdigital.co so the relevant record and appropriate handling can be assessed. Please do not send more sensitive information about the child than is needed to identify the issue.
Updates and questions
We will keep the effective version identifiable and make material changes prominent where required. A changed policy alone does not create a new consent or authorise an incompatible purpose. Before adding optional tracking, accounts, payments or new managed-app collection, the corresponding notice and controls must be updated.
For a privacy request, accessible explanation or a copy of the policy relevant to your enquiry, contact info@nightwingdigital.co.
Document details
- Status
- Published
- Operator
- Nightwing Digital Solutions Co., Ltd.
- Company registration number
- 0105566075231
- Trading identity
- Ari · Nightwing Digital Solutions
- Country of registration
- Thailand
- Business/contact address
- 46/479 Precha uthit 12, Wiphavadi Rangsit road, Don Muang Subdistrict, Don Muang District, Bangkok 10210, Thailand
- Contact
- info@nightwingdigital.co
- Last reviewed
- 20 October 2026
- Effective date
- 20 October 2026