Privacy Notice
Last updated 28 September 2026.
This notice explains how Nikah AI Ltd, trading as Tarestack, uses personal data when you use tarestack.co.uk, buy Tarestack Pro or use the Tarestack plugins.
Who is responsible
The controller is Nikah AI Ltd, company no. 17199968, Office 1216, 60 Tottenham Court Road, London W1T 2EW. We are registered with the Information Commissioner’s Office, registration number ZC176381. Contact us about privacy at support@tarestack.co.uk.
What we never receive
The Tarestack plugins read your WooCommerce order line items on your own server and store only aggregated packaging weights there. The free plugin sends nothing to us or anyone else. Tarestack Pro sends us only a licence key and your site address (see below). We never receive your orders, products, customers, their names, addresses, postcodes or email addresses, so we are not a processor of your customers’ data.
What we process, why and on what basis
| Data | Purpose | Lawful basis | How long |
|---|---|---|---|
| Purchase and billing details you give at checkout: name, email address, billing country and address details Stripe asks for, payment card (handled by Stripe; we never see full card numbers), and the resulting Stripe customer, subscription and invoice records | To sell and provide your subscription, issue and renew licence keys, recover a key when you give us the invoice number and email, and keep accounting records | Contract; legal obligation (accounting and tax records) | Held in our Stripe account for as long as you are a customer and then for 6 years after the end of the financial year in which the subscription ends, as UK accounting rules require |
| Licence key (it contains your plan, site limit, Stripe subscription ID and expiry date) and your site address, sent by Tarestack Pro when it activates, deactivates, refreshes once a day, is checked by you, or checks for updates (update checks also send the installed version) | To confirm the subscription is active, count the sites a key is used on and deliver updates | Contract; legitimate interests (preventing misuse of licences) | We do not store keys or site addresses. We store a 16-character keyed hash of each activated site address in the subscription’s metadata in Stripe, to count sites; it is removed when you deactivate that site and otherwise kept with the subscription record |
| Web server logs: truncated IP address (the last part is removed), date and time, page address without query parameters, the browser’s own request details (such as browser type and preferred language, but never cookies or the address of the page or site you came from), response code and response size | Security, preventing abuse and fixing faults | Legitimate interests | 7 days, then deleted automatically |
| Licence service application log: date and time, page address without query parameters, response code and, for payment notifications from Stripe, the Stripe event type, the identifiers of the event and of the subscription or invoice it concerns, and its status. It contains no IP address, email address, licence key or checkout session reference | Security and fixing faults | Legitimate interests | Overwritten automatically once about 10 MB of newer entries have been written |
| IP address (for the key-recovery form, the manage-subscription form and the licence API used by Tarestack Pro), and the email address typed into the key-recovery form | Rate limiting, to stop automated guessing and abuse | Legitimate interests | Kept only in memory, as keyed hashes, for up to one hour (IP address) or one day (email address); never written to disk |
| Emails you send us and our replies | To answer your questions and give support | Legitimate interests; contract where the question is about your subscription | Up to 2 years after the conversation ends |
We do not use your data for marketing, profiling or automated decision-making, and we do not sell it.
Who we share it with
- Stripe (Stripe Payments UK Ltd, Stripe Payments Europe Ltd and Stripe, Inc.) processes payments, subscriptions, invoices, receipts and the customer portal. Stripe acts as our processor for some of this and as an independent controller for other parts (for example fraud prevention and, where its checkout names a reseller as the seller, currently shown as “Onelink”, the sale itself); Stripe’s privacy notice applies to those parts.
- OVHcloud hosts the server that runs this website and the licence service, in the United Kingdom.
- Cloudflare (Cloudflare, Inc.) routes emails sent to our support address, and Google (Google Ireland Ltd and Google LLC, Gmail) stores them.
- Professional advisers, and authorities where the law requires it.
International transfers
Stripe, Inc. is in the United States. Transfers to it rely on the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge) and, as a fallback, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in Stripe’s data processing terms. Emails to our support address may be processed in the United States by Cloudflare, Inc. and Google LLC, which rely on the same UK–US data bridge and on their UK data transfer terms. Our server is hosted in the United Kingdom by OVHcloud.
Cookies
This website sets no cookies and uses no analytics. See our Cookie statement.
Your rights
You can ask for access to, correction of or deletion of your personal data, ask us to restrict or stop processing it, object to processing based on legitimate interests, and ask for a copy in a portable format. Some rights have exceptions, for example we must keep accounting records. Email support@tarestack.co.uk; we will reply within one month.
You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to deal with your concern first.
Children
Tarestack is a business tool and is not intended for children.
Changes
We will update this notice if what we do changes, and show the date at the top.