Privacy Notice

i8 AB (org. no. 559147-0470, Sweden) is the data controller for personal data processed through Stillnight. Paddle.com acts as an independent controller for the payment data it collects as our Merchant of Record.

You can listen without signing up. Audio is generated in your browser and is not uploaded; we never use your microphone. Favourites and settings are stored in your browser's local storage on this device only.

• Account data (email address, password stored only as a secure hash, sign-in timestamps) — to create your account and provide Unlimited. Legal basis: performance of contract.
• Subscription data (plan, status, renewal dates, Paddle customer and subscription IDs) — to provide Unlimited across devices. Legal basis: contract; legal obligation for accounting records.
• Technical data (IP address, browser type, error diagnostics) — to deliver the site, keep it secure and prevent fraud. Legal basis: legitimate interests.
• Support messages, if you contact us — to help you. Legal basis: legitimate interests / contract.

Card and billing details are entered directly into Paddle's checkout and are never received or stored by us. Paddle handles payment, tax and invoicing; see Paddle's privacy notice.

• Service providers: hosting, database and authentication providers; the asset hosting service delivering artwork; Google Fonts (receives standard web requests including your IP address).
• Paddle, our Merchant of Record, for sales, subscription management, payments, tax compliance and invoicing.
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law.

We have not added analytics, advertising or tracking code. We use only essential browser storage: local storage for favourites and to keep you signed in. The hosting platform may collect basic error and usage diagnostics. We will update this notice before adding anything else.

Some providers may process data outside the UK/EEA. Where they do, transfers rely on adequacy decisions or Standard Contractual Clauses.

Account and subscription data are kept while your account exists and deleted or anonymised within 30 days after you delete it, except records we must keep for accounting under Swedish law (up to 7 years). Technical logs are kept for a short period for security only.

Under the GDPR you can request access, rectification, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent at any time. We respond within one month. You may also complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local supervisory authority.

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, access controls and row-level permissions so each account can only read its own data.