Image / Video / Audio Generation · creator.nightcafe.studioNightCafe Creator
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
Watch: audit rights dpa residency
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Under Australian Privacy Act APP 8 and GDPR Chapter V, cross-border transfers require appropriate safeguards. The policy acknowledges transfers outside Australia but provides no details on the countries involved, safeguards in place, or mechanisms used to ensure equivalent data protection. This creates risk exposure, particularly for EU/UK users.
Extends the restrictions on Google API data to raw data, aggregated, anonymised, and derived data, ensuring the restrictions cannot be circumvented through data transformation.
The platform delegates ad-serving to Ezoic and by implication shares user personal data with them. The actual data processing terms are governed by Ezoic's external privacy policy, which the platform does not summarise, reducing transparency for users.
Scores derived from 56 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Data handling is conditional — 9 privacy or retention clauses warrant review before using NightCafe Creator at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what NightCafe Creator's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredIP/output assessment pending — terms of service not yet verified This lens receives a band only once its source document has been captured and read in full.
Know where this document lives? Point us to the URL or PDF and the pipeline will verify it.
Based on 123 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 86 citationsLast captured 2026-08-10
- Terms of ServiceVerified - read in full - 0 citationspdf textLast captured 2026-08-24
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Specifies that processing for promotions and competitions relies on legitimate interests (facilitating engagement and business growth), identifying applicable data categories and the GDPR lawful ground.
"| To run promotions, competitions and/or offer additional benefits to you. | - Identity Data<br>- Contact Data<br>- Profile Data<br>- Interaction Data<br>- Marketing and Communications Data | - Legitimate interests: to facilitate engagement..."
This segment specifies that Technical and Usage Data is processed for analytics, profiling, market research, and business development including improving Services and social media platforms, establishing the lawful purpose and scope of automated data processing activities.
"| For analytics including profiling on our website, market research and business development, including to operate and improve our Services, associated applications and associated social media platforms. | - Technical and usage Data |"
Specifies that advertising and marketing processing relies on legitimate interests (growing the business), identifying applicable data categories including marketing communications data and the GDPR lawful ground.
"| For advertising and marketing, including to send you promotional information about our products and experiences and information that we consider may be of interest to you. | - Identity Data<br>- Contact Data<br>- Technical and Usage Data<..."
Imposes an obligation on the company to maintain safeguards for Google API personal information and to ensure employees, agents, contractors, and successors comply with the Google API Services Data Policy.
"We have policies and procedures in place setting out appropriate safeguards for protecting your personal information obtained with the Google APIs. We will also ensure that our employees, agents, contractors and successors comply with the G..."
Specifies that analytics, profiling, and business development processing relies on legitimate interests (keeping the website updated and improving services), identifying applicable data categories and the GDPR lawful ground.
"| For analytics including profiling on our website, market research and business development, including to operate and improve our Services, associated applications and associated social media platforms. | - Technical and Usage Data | - Leg..."
Incorporates the Google API Services User Data Policy, including its Limited Use requirements, by reference as a binding constraint on how Google API data is used, creating an enforceable external standard.
"Our use of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy#additional_requirements_for_specific_api_scopes), including the Lim..."
Permits disclosure of personal information to acquirers in the event of a business or asset transfer, covering both actual and prospective transactions.
"- anyone to whom our business or assets (or any part of them) are, or may (in good faith) be, transferred;"
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
"These restrictions apply to the raw data we obtain from the restricted scopes and data that is aggregated, anonymised or derived from them."
Extends the restrictions on Google API data to raw data, aggregated, anonymised, and derived data, ensuring the restrictions cannot be circumvented through data transformation.
AI-generated interpretation, not legal advice.
"| For advertising and marketing, including to send you promotional information about our products and experiences and information that we consider may be of interest to you. | - Identity Data<br>- Contact Data<br>- Technical and usage Data<br>- Profile Data<br>- Marketing and communications Data |"
Grants the platform permission to use specified categories of personal data (identity, contact, technical, profile, marketing) for advertising, marketing, and promotional communications directed at users.
AI-generated interpretation, not legal advice.
"If you connect your account with us to a social network account, such as Facebook or Google, we will collect your personal information from the social network. We will do this in accordance with the privacy settings you have chosen on that social network."
Describes the procedure by which personal information is collected from linked social network accounts, specifying that collection follows the user's chosen privacy settings on those networks.
AI-generated interpretation, not legal advice.
"We may use cookies on our website from time to time. Cookies are text files placed in your computer's browser to store your preferences. Cookies, by themselves, do not tell us your email address or other personally identifiable information. However, they do recognise you when you return to our online website and allow third parties, such as Google and Facebook, to cause our advertisements to appear on your social media and online media feeds as part of our retargeting campaigns. If and when you choose to provide our online website with personal information, this information may be linked to the data stored in the cookie."
Grants users the right to block cookies via browser settings and discloses that blocking essential cookies may impair access to parts of the website, providing a practical mechanism for user control over cookie-based data collection.
AI-generated interpretation, not legal advice.
"- **Profile Data** including your username and password (including for NightCafe Lounge, our Discord forum), profile picture, purchases or orders you have made with us, designs you have created with us (prior to you deleting them), support requests you have made, content you post, send receive and share through our platform, information you have shared with our social media platforms, your interests, preferences, feedback and survey responses."
This segment defines 'Profile Data' including usernames, passwords, purchases, AI-generated designs (prior to deletion), support requests, and content posted or shared on the platform, identifying categories of personal data — including user-generated content — subject to collection and processing obligations.
AI-generated interpretation, not legal advice.
"| For advertising and marketing, including to send you promotional information about our products and experiences and information that we consider may be of interest to you. | - Identity Data<br>- Contact Data<br>- Technical and Usage Data<br>- Profile Data<br>- Marketing and Communications Data | - Legitimate interests: to develop our Services and grow our business |"
Specifies that advertising and marketing processing relies on legitimate interests (growing the business), identifying applicable data categories including marketing communications data and the GDPR lawful ground.
AI-generated interpretation, not legal advice.
"The personal information that we may receive includes your name, ID, user name, handle, profile picture, gender, age, language, list of friends or follows and any other personal information you choose to share."
Defines the categories of personal information that may be received from social networks, establishing the scope of data collected through social account connections.
AI-generated interpretation, not legal advice.
"- **Technical and Usage Data** including internet protocol (IP) address, your login data, your browser session and geo-location data, device and network information, statistics on page views and sessions, acquisition sources, search queries and/or browsing behaviour, information about your access and use of our website, including through the use of Internet cookies, your communications with our website, the type of browser you are using, the type of operating system you are using and the domain name of your Internet service provider."
This segment defines 'Technical and Usage Data' with an extensive enumeration of data points including IP address, browser data, geo-location, cookies, and usage behaviour, specifying the category of personal data collected through automated means subject to the policy's obligations.
AI-generated interpretation, not legal advice.
"We use Ezoic to serve ads on NightCafe. To see the Ezoic privacy policy, including how they use and process personal data, please [click here"
The platform delegates ad-serving to Ezoic and by implication shares user personal data with them. The actual data processing terms are governed by Ezoic's external privacy policy, which the platform does not summarise, reducing transparency for users.
AI-generated interpretation, not legal advice.
"While we store personal information in Australia, where we disclose your personal information to the third parties listed above, these third parties may store, transfer or access personal information outside of Australia."
Under Australian Privacy Act APP 8 and GDPR Chapter V, cross-border transfers require appropriate safeguards. The policy acknowledges transfers outside Australia but provides no details on the countries involved, safeguards in place, or mechanisms used to ensure equivalent data protection. This creates risk exposure, particularly for EU/UK users.
AI-generated interpretation, not legal advice.
"We use the personal information we receive from the social network to create a profile for you on our website and as applicable, provide you with additional features."
States the purposes for which personal information received from social networks will be used — profile creation and additional features — creating an obligation to limit use to those stated purposes.
AI-generated interpretation, not legal advice.
"| To run promotions, competitions and/or offer additional benefits to you. | - Identity Data<br>- Contact Data<br>- Profile Data<br>- Interaction Data<br>- Marketing and Communications Data | - Legitimate interests: to facilitate engagement with our business and grow our business |"
Specifies that processing for promotions and competitions relies on legitimate interests (facilitating engagement and business growth), identifying applicable data categories and the GDPR lawful ground.
AI-generated interpretation, not legal advice.
"| For analytics including profiling on our website, market research and business development, including to operate and improve our Services, associated applications and associated social media platforms. | - Technical and usage Data |"
This segment specifies that Technical and Usage Data is processed for analytics, profiling, market research, and business development including improving Services and social media platforms, establishing the lawful purpose and scope of automated data processing activities.
AI-generated interpretation, not legal advice.
"- **Marketing and Communications Data** including your preferences in receiving marketing from us and our third parties and your communication preferences."
This segment defines 'Marketing and Communications Data' as preferences regarding marketing from the company and third parties, specifying a category of personal data collected and used for marketing purposes.
AI-generated interpretation, not legal advice.
"**Google Analytics:** We have enabled Google Analytics Advertising Features including Remarketing Features, Advertising Reporting Features, Demographics and Interest Reports, Store Visits and Google Display Network Impression reporting. We and third-party vendors use first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers together."
Describes the platform's use of Google Analytics Advertising Features and the use of first- and third-party cookies and identifiers in conjunction with Google and other vendors, identifying data-sharing practices with a named subprocessor.
AI-generated interpretation, not legal advice.
"**Public Information:** Our Services allow users to discuss their AI art projects using a chat room function. Any information you post on the chat room function may become publicly available. While we strive to protect the Personal Information you provide to us, we cannot guarantee the security of the information you communicate to other users and you do so at your own risk. We recommend that you do not provide any Personal Information that you do not want made public in the chat room function."
Disclaims platform responsibility for the security of personal information posted publicly in the chat room feature, warns users of the risk of public disclosure, and recommends users not share sensitive personal information in that context.
AI-generated interpretation, not legal advice.
"- **Financial Data** including bank account and payment card details (through third party payment processors such as PayPal and Shopify)."
This segment defines 'Financial Data' as including bank account and payment card details, and discloses that such data is collected through named third-party payment processors (PayPal and Shopify), identifying subprocessors involved in financial data handling.
AI-generated interpretation, not legal advice.
"You can opt-out of Google Analytics Advertising Features including using a Google Analytics Opt-out Browser add-on found [here](https://tools.google.com/dlpage/gaoptout/). To opt-out of personalised ad delivery on the Google content network, please visit Google's Ads Preferences Manager [here](https://nightcafe.studio/policies/www.google.com/ads/preferences) or if you wish to opt-out permanently even when all cookies are deleted from your browser you can install their plugin [here](https://support.google.com/ads/answer/7395996). To opt out of interest-based ads on mobile devices, please follow these instructions for your mobile device: On android open the Google Settings app on your device and select “ads” to control the settings. On iOS devices with iOS 6 and above use Apple's advertising identifier. To learn more about limiting ad tracking using this identifier, visit the settings menu on your device."
Grants users the right to opt out of Google Analytics Advertising Features, personalised ad delivery on the Google content network, and interest-based ads on mobile devices, and provides the procedural mechanisms for exercising those rights.
AI-generated interpretation, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from NightCafe Creator's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
20 verified clausesClauses in NightCafe Creator's policies that work in your favour — commitments the platform made to you.
- Audit rights, DPA & residency
“The countries to which we send data for the purposes listed above may be less comprehensive that is what is offered in the country in which you initially provided the information. Where we transfer your personal information outside of the country where you are…”
The clause openly admits data may go to countries with lower protection standards and relies on adequacy findings or SCCs as safeguards. No user audit rights are granted, and no specific subprocessor locations or residen…
📍 Privacy Policy › “Data Transfers”Jump to exact text → - Privacy & data use
“You may request details of the personal information that we hold about you and how we are process it (commonly known as a “data subject request”). You may also have a right in accordance with applicable data protection law to have your personal information rec…”
This segment enumerates specific data subject rights available to EU and UK individuals under applicable data protection law, including rights to access, rectification, deletion, restriction of processing, objection to a…
📍 Privacy Policy › “Extra rights for EU and UK individuals”Jump to exact text → - Privacy & data use
“Under the GDPR individuals located in the EU and the UK have extra rights which apply to their personal information. Personal information under the GDPR is often referred to as personal data and is defined as information relating to an identified or identifiab…”
Defines the regulatory context (GDPR), identifies the personal data definition under GDPR as information relating to an identifiable natural person, and establishes that the appendix grants additional rights to EU and UK…
📍 APPENDIX 1Jump to exact text → - Privacy & data use
“**Correction:** If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the details below. We will take reasonable steps to promptly correct any information found to be ina…”
Grants users the right to request correction of inaccurate, outdated, or misleading personal information, imposes an obligation on the platform to take reasonable steps to correct such data, and specifies the procedure f…
📍 Privacy Policy › “Your rights and controlling your personal information”Jump to exact text → - Privacy & data usesensitive data (biometric/location/health)
“- **Sensitive information** is a sub-set of personal information that is given a higher level of protection. Sensitive information means information relating to your racial or ethnic origin, political opinions, religion, trade union or other professional assoc…”
This segment defines 'Sensitive information' as a legally protected sub-category of personal data (including racial origin, health, biometric, and other sensitive attributes), states the company does not actively collect…
📍 Privacy Policy › “The information we collect”Jump to exact text → - Audit rights, DPA & residency
“The countries to which we send data for the purposes listed above may be less comprehensive that is what is offered in the country in which you initially provided the information. Where we transfer your personal information outside of the country where you are…”
This segment imposes an obligation on the platform to use appropriate safeguards when transferring personal information across borders and to protect transferred data in accordance with the Privacy Policy and Appendix 1,…
📍 Privacy Policy › “Data Transfers”Jump to exact text →
+ 14 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
0 verified clausesWhat NightCafe Creator requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in NightCafe Creator's published policies yet.
What the policies actually cover
6 topics- Product telemetry & usage tracking14 clauses
- Advertising & tracking3 protective16 clauses
- Sale or sharing of personal data1 protective1 clause
- Sensitive data (biometric, location, health)1 protective3 clauses
- Government & law-enforcement disclosure5 clauses
- Terms can change at any time1 clause
46 further verified clauses are cited on this page but not yet assigned a topic.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause appears to reserve or claim ownership rights for the platform.
“false or misleading information about your identity or affiliations on the Site. This includes using an Account to pretend to be someone else or multiple people. Additionally, you are prohibited from creating more than one Account, or creating additional Accounts after your previous Account was suspended or terminated. We reserve the right to suspend or terminate any and all Accounts you have created in violation ...”Open source citation
The clause appears to reserve or claim ownership rights for the platform.
“the right to terminate or suspend your Account. In most cases, we will provide you with a warning or temporary suspension before terminating your Account. During any warning or suspension period, you are solely responsible for downloading or retrieving any User Content, Artworks, data or other information associated with your Account that you wish to retain. We reserve the right to immediately terminate your Accou...”Open source citation
The clause requires defense, indemnity, or hold-harmless obligations.
“- courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;”Open source citation
The clause requires defense, indemnity, or hold-harmless obligations.
“- courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;”Open source citation
The clause requires defense, indemnity, or hold-harmless obligations.
“- courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | audit rights dpa residency | conditional | MEDIUM | 1 |
| All applicable tiers | commercial use | conditional | MEDIUM | 1 |
| All applicable tiers | data retention | worsens | HIGH | 5 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 4 |
| All applicable tiers | moderation enforcement | worsens | HIGH | 1 |
| All applicable tiers | privacy data use | conditional | MEDIUM | 5 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 1 |
| All applicable tiers | training use | worsens | HIGH | 1 |
| Standard | audit rights dpa residency | conditional | MEDIUM | 1 |
| Team / Business | subprocessors data sharing | conditional | MEDIUM | 1 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
Latest stance: platform claims or reserves rights on moderation enforcement
“false or misleading information about your identity or affiliations on the Site. This includes using an Account to pretend to be someone else or multiple people. Additionally, you are prohibited from creating more than one Account, or creating additional Accounts after your previous Account was suspended or terminated. We reserve the right to suspend or terminate any and all Accounts you have created in violation of these Terms.”Open timeline citation
Latest stance: platform claims or reserves rights on data retention
“the right to terminate or suspend your Account. In most cases, we will provide you with a warning or temporary suspension before terminating your Account. During any warning or suspension period, you are solely responsible for downloading or retrieving any User Content, Artworks, data or other information associated with your Account that you wish to retain. We reserve the right to immediately terminate your Account if we have already provided you with a warning or temporary suspension or for continued violations of these Terms and we may permanently delete your Account and all associated data, User Content and Artworks. However, in cases of severe violations, including but not limited to illegal activities, posting of Prohibited Content, threats of violence, exploitation of minors, or repeated violations after previous warnings, we reserve the right to immediately terminate your Account without any prior warning or suspension period. You acknowledge that whether after a warning or suspension period for continued violations, or immediate termination for severe casess, we have no obligation to retain or provide you with any of your User Content, Artworks, data or Account information. We will not be liable for any loss of your User Content, Artworks or data that results from the termination of your Account in accordance with these Terms.”Open timeline citation
Latest stance: third party or vendor sharing on commercial use
“transferred to you and you may use your Artwork for personal or commercial purposes. However, we provide no warranties that you will be able to trade mark or claim copyright ownership of our Artwork or that any trade mark application or copyright claim will not infringe on any third party Intellectual Property Rights;”Open timeline citation
Latest stance: training permitted on training use
“02. You may also train a customised image-generation model on your own”Open timeline citation
Latest stance: third party or vendor sharing on data retention
“You may request details of the personal information that we hold about you and how we are process it (commonly known as a “data subject request”). You may also have a right in accordance with applicable data protection law to have your personal information rectified or deleted, to restrict our processing of that information, to object to decisions being made based on automated processing where the decision will produce a legal effect or a similarly significant effect on you, to stop unauthorised transfers of your personal information to a third party and, in some circumstances, to have personal information relating to you transferred to you or another organisation.”Open timeline citation
Latest stance: indemnity on indemnity liability
“- courts, tribunals, regulatory authorities and law enforcement officers, as required or authorised by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights;”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“While we store personal information in Australia, where we disclose your personal information to the third parties listed above, these third parties may store, transfer or access personal information outside of Australia.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“While we store personal information in Australia, where we disclose your personal information to the third parties listed above, these third parties may store, transfer or access personal information outside of Australia.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-08-10· verified 2026-08-10
- Terms of Service:Last captured 2026-08-24· verified 2026-08-24verified once — not yet re-verified
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 189 more findings this quarter vs last (294 vs 105). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of NightCafe Creator's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from NightCafe Creator's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.