NicheGaps

Privacy Policy

What we collect, why, who helps us process it, how long we keep it and what you can ask us to do with it.

1. Who we are

NicheGaps ("we", "us"), based in Portugal, runs nichegaps.com and is the controller of the personal data described here. Questions or requests about your data: [email protected], or the chat button on any page. We don't sell personal data and don't show ads.

2. What we collect

  • Account data: your email address, display name, a hashed password (never the password itself) or, with Google sign-in, your Google account id and profile picture.
  • Sign-in sessions: for each signed-in device, the IP address and browser (user agent) it signed in from, so you can be kept signed in and we can spot abuse.
  • Plan and payments: your plan, its dates and payment records (amount, status, Stripe's reference). Card details go straight to Stripe; we never receive them.
  • What you save: opportunities on your watchlist and your settings.
  • Support chats and messages: what you write in the chat or contact form, the page you started from, your account if you're signed in, and any email you leave for a reply.
  • Technical data: server logs with IP addresses, requests and errors, kept for security and debugging. Page views are counted with Cloudflare Web Analytics, which sets no cookies and doesn't follow you across sites. No advertising trackers.

3. Why we use it

  • To provide the Service (your account, plan, watchlist, sign-in, support): needed to perform our contract with you.
  • To take payments and keep accounting records: contract and legal obligations.
  • To keep the Service secure (rate limits, abuse prevention, logs) and to improve it: our legitimate interests.
  • To email you about your account and purchases (confirmations, password resets, renewal reminders). We send no marketing email unless you ask for it.

4. Public posts and reviews we quote

The opportunities on NicheGaps are built from content people published publicly: app store reviews (App Store, Google Play, Shopify App Store), Reddit posts and Hacker News discussions. We collect the text, rating, date and link of posts that describe an unmet need, and analyse them, partly with AI models, to group similar needs. We do this in our legitimate interest in researching market demand, which we think also serves the people who wrote them: their problem gets seen by people who could solve it.

We don't show reviewers' names or usernames on the site and don't build profiles of individuals. To recognise repeat posts we keep a one-way hash of the author's public handle. The original record, as the platform published it, is kept for reference and may include that public handle.

If you wrote something we quote, you can ask us to remove it or object to its use by emailing [email protected] with the link. We'll remove it unless there's a compelling reason not to, and you can also delete it at the source.

5. Support chat

Messages in the chat are first answered by an AI assistant: your messages and, if you're signed in, your email and plan are sent to an AI provider (see below) to write a reply. When a person needs to help, the chat is forwarded to our team's private support group on Telegram, where we read and answer it.

Chats are stored with your account (or, for guests, under a random id your browser remembers) so you can read them later, and are kept for up to 2 years. Please don't share passwords, card numbers or other sensitive data in the chat.

6. Who processes data for us

We use these providers, each under their own terms and data protection commitments:

  • Hosting and network: our server host, and Cloudflare for delivery and protection against attacks.
  • Stripe: payments and invoices.
  • Resend: sending account and support emails.
  • Google: only if you choose "Continue with Google".
  • OpenRouter and Requesty: AI model gateways, used to analyse public reviews and posts and to answer the support chat. They pass requests to the underlying model providers.
  • Telegram: our team's support inbox for chats handed to a person.

Some of these providers are outside your country, including in the United States. Where the law requires it, transfers rely on adequacy decisions or the European Commission's standard contractual clauses.

7. Cookies and local storage

We only use what the site needs to work:

  • gd_session (__Host-gd_session over HTTPS): keeps you signed in. Set when you sign in, lasts up to 30 days, removed when you sign out.
  • gd_oauth: protects Google sign-in against forgery. Lasts 10 minutes.
  • Local storage in your browser: your cookie choice and the ids of your support chats, so the chat survives a reload. It never leaves your device except to fetch those chats.

These are strictly necessary, so they don't need consent; we still ask, and we'll ask again before adding anything optional such as analytics. .

8. How long we keep it

  • Account data: while your account exists; deleted within 30 days of closing it.
  • Expired sign-in sessions: removed after 7 days.
  • Payment records: as long as tax and accounting law requires (usually 6–10 years), even after the account is closed.
  • Support chats and contact messages: up to 2 years.
  • Server logs: rotated out by size, usually within a few weeks. Database backups: the newest 14 nightly copies and the copies taken before each of the last 10 updates.

9. Your rights

Depending on where you live (for example under the GDPR in the EU, EEA and UK), you can ask to access, correct, delete or export your personal data, and object to or restrict how we use it. Write to [email protected] or use the chat; we answer within one month and may need to confirm it's you. You can change your name and password in settings; to delete your account, ask us and we'll do it.

If you think we've handled your data wrongly, please tell us first. You can also complain to your local data protection authority or to Portugal's, the Comissão Nacional de Proteção de Dados (cnpd.pt).

10. Security

Connections are encrypted (HTTPS), passwords are hashed, the database isn't reachable from the internet and access is limited to the people who run the Service. No system is perfectly secure; if a breach puts your data at risk, we'll tell you and the authorities as the law requires.

11. Children

NicheGaps isn't meant for anyone under 16 and we don't knowingly collect their data. If you think a child has given us data, tell us and we'll delete it.

12. Changes to this policy

We'll update this page when what we collect or who processes it changes, and change the date at the top. For significant changes we'll also tell signed-in users on the site or by email.