Privacy Notice

Privacy Notice

Effective date: 11 September 2026 · Version: 1.4

Also: Terms of Service · Contact & legal notices · Delete account

1. Who is responsible for your data (the "Controller")

The entity responsible for your personal data (the data controller) is:

Data Protection Officer (DPO): Dominik Moelsen (voluntarily appointed; not required under Article 37 GDPR) · dominik.moelsen@nicheace.ai

Article 27 representative in the EU (the controller is established outside the EU): Dominik Moelsen, Bregenzer Strasse 22, 47249 Duisburg, Germany.

Article 27 representative in the UK: Not applicable — the controller (Moelsen Operations Ltd) is established in the United Kingdom.

Privacy contact: dominik.moelsen@nicheace.ai · General support: dominik.moelsen@nicheace.ai

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a supervisory authority. You may contact the competent supervisory authority in your EU/EEA Member State of habitual residence or place of the alleged infringement, or the UK Information Commissioner's Office (ICO, ico.org.uk). Our lead / point-of-contact authority in the EU is the German federal authority (BfDI, bfdi.bund.de); if a different authority is competent for your case, they will redirect you.

2. What data we process and why

nicheAce is an AI-guided language-learning service. We process the following categories of personal data:

We do not process payment-card data. Purchases are made through Apple App Store or Google Play, which handle all payment information. We only receive the transaction metadata listed above.

3. Legal basis for each purpose (Article 6 GDPR)

Where we rely on consent, you can withdraw it at any time in Settings → Privacy in the app or by contacting us. Withdrawing consent does not affect processing that was done before you withdrew.

4. AI processing and your content

Your guided-practice conversations and responses are processed by our AI language model so we can give you feedback and scoring. For EU users this model is hosted on OVHcloud AI Endpoints in Germany (a pure-EU provider; OVHcloud is a French company operating German data centres), and your conversation text is processed in the EU and does not reach any China-based endpoint. If that model is unavailable, the same request is handled by Mistral AI in France, also a pure-EU provider.

We may use learning data to improve our models, but only after de-identifying it, and only if you have given consent for AI training. De-identification removes the link to your account and to the specific exercise, strips personal identifiers (such as names and contact details) from the text, and coarsens timestamps, so the data can no longer be attributed to you. This anonymised data is no longer personal data and may be kept indefinitely for model training — even if you later withdraw consent or delete your account. Withdrawing consent stops any future use of your still-linked data for training.

Audio Mode. In hands-free voice mode the microphone opens only for short answer windows. The recording is sent to the speech-to-text model of Mistral AI in France, held in memory for as long as the transcription takes, and then discarded — it is never written to storage. We do not create a voiceprint, we do not build a model of how you sound, and your voice is never used to identify you. Only the transcribed text is kept, alongside your other answers. Audio Mode is optional and consent-gated: you switch it on, and you can switch it off at any time in Settings → Privacy. The lesson text the app reads aloud to you is turned into speech by Mistral AI (English and French) or by KugelAudio in Germany (German, Spanish and Italian); both receive only that lesson text, never your voice.

5. Where your data is stored

All EU users' data is stored within the EU/EEA, specifically in Germany, with OVHcloud:

• Primary database — OVHcloud Managed MySQL (Frankfurt, Germany)
• Files and generated content — OVHcloud Object Storage (Germany, de region)
• Caching / rate-limiting — OVHcloud Managed Redis (EU)
• AI model inference — OVHcloud AI Endpoints (Germany)
• Identity / login — Auth0's EU region (data centres in Germany/Ireland)

Our marketing website at nicheace.eu is served separately from the app, from Alibaba Cloud object storage and CDN in the Frankfurt (Germany) region. Visiting the website means that service handles your IP address in order to deliver the page; no account or learning data is held there. Alibaba Cloud International is contracted through its Singapore entity, which belongs to a group headquartered in China. We selected the Frankfurt region so that website data stays in Germany, and we keep this arrangement under review.

The app service does not move your data to our China infrastructure, and the app and China systems are isolated from each other.

6. Who receives your data (recipients / processors)

We share your data only with the following categories of recipients, each acting as a processor under a contract that meets Article 28 GDPR:

We never sell your personal data.

7. International transfers

Your account and learning data are stored and processed in Germany (Section 5), whichever country you use nicheAce from. If you are outside the EEA — in the United States, for example — this means your data is handled in the EEA, which is permitted by the law of your country and gives you the protection of EU standards.

Our core processors are established in the EU/EEA (OVHcloud, Mistral AI, KugelAudio, Auth0 EU, Resend, Plausible). Four functions involve providers with wider infrastructure or ownership:

• Apple/Google in-app purchases — receipt validation is performed by Apple/Google and may involve their global infrastructure. This is necessary to fulfil your purchase (Art. 6(1)(b)) and is carried out under appropriate safeguards (the provider's own DPA / Standard Contractual Clauses where required).
• Cloudflare — operates a global network for the bot/abuse check. We use its EU-region options where available and rely on appropriate safeguards (Standard Contractual Clauses / the EU-US Data Privacy Framework where applicable) for any transfer.
• Alibaba Cloud — serves the marketing website from the Frankfurt region, so website data is handled in Germany. The contracting entity is in Singapore and the group is headquartered in China; the arrangement is covered by the provider's data-processing terms and Standard Contractual Clauses. No account or learning data is stored there.
• Push notifications — only if you allow them. Expo (USA) relays the notification and Google's Firebase Cloud Messaging delivers it to Android devices; both receive the notification token and the generic notification text, nothing about your learning. The transfer to Expo is covered by the European Commission's Standard Contractual Clauses, and the one to Google by its data-processing terms and Standard Contractual Clauses.

There is no transfer of your account or learning data to our China infrastructure.

8. How long we keep your data

You can request earlier deletion at any time (Section 9).

9. Your rights under the GDPR / UK GDPR

You have the following rights:

• Access — get a copy of your data and information about how we use it.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your data.
• Restriction — ask us to limit processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format and reuse it elsewhere.
• Object — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — at any time, for processing based on consent.
• Right relating to solely automated decisions (Section 10).
• Lodge a complaint with a supervisory authority (Section 1).

How to exercise your rights:

• In the app: Settings → Privacy lets you export your data, manage consent, and request deletion of your account.
• By email: dominik.moelsen@nicheace.ai (or the DPO at dominik.moelsen@nicheace.ai).
• Delete your account and data: see our Delete account page for step-by-step instructions (in-app or by request).

We will respond within one month (we may extend by two further months for complex requests, in which case we will tell you why within the first month). We will verify your identity before acting on a request.

10. Automated decision-making

We do not use solely automated processing that produces legal effects concerning you or similarly significantly affects you (Article 22).

We do run automated bot/abuse detection on interaction patterns to protect the integrity of the reward system. This does not by itself produce legal effects, the underlying behavioural data is collected only with your consent, and any action it triggers (such as adjusting credits) can be reviewed by contacting us.

11. Children

nicheAce is not directed at, and not offered to, children under 16. We verify age during onboarding. This is above the 13-year threshold of the US Children's Online Privacy Protection Act (COPPA), so the service is not a child-directed service under that Act either. If we learn we have collected personal data from a child under 16 without verifiable parental/guardian consent, we will delete it. If you believe this has happened, contact dominik.moelsen@nicheace.ai.

12. Security (Article 32)

We protect your data using measures including:

• Encryption in transit (TLS) between your device and our services, and encryption at rest for stored data.
• Strict access controls — access to personal data is limited to authorised personnel on a need-to-know basis.
• Secure token storage on your device.
• Breach response — in the event of a personal-data breach likely to result in a risk to your rights, we will notify the competent supervisory authority without undue delay (and where feasible within 72 hours), and notify you directly where the risk is high.

13. If you are in the United States

This section applies in addition to everything above. It does not replace it: we apply one standard of protection everywhere.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act and comparable state laws. We have never done so. nicheAce shows no advertising on any plan.

Where your data is. Your account and learning data are stored in Germany (Section 5). No US law requires us to hold it in the United States.

What we collect and why. The categories are in Section 2, the purposes in Section 3, the recipients in Section 6, and the retention periods in Section 8. We do not ask you for information about your health, finances, race, religion, sexual orientation, or precise geolocation.

Your rights. Several states — including California, Virginia, Colorado, Connecticut and Texas — give residents rights over their personal information, and each has its own thresholds for which businesses are covered. Rather than make you work out whether we are covered in your state, we extend these rights to every user in the United States:

• Know and access — what we hold about you, and what we do with it.
• Delete — have your data erased.
• Correct — have inaccurate data fixed.
• Portability — receive a copy in a structured, machine-readable format.
• Opt out of sale, sharing, or targeted advertising — there is nothing to opt out of, because we do none of these.
• Limit the use of sensitive personal information — we do not collect it for the purposes this right addresses.
• Non-discrimination — using any of these rights never changes your price, your plan, or the service you get.

How to use them. In the app, Settings → Privacy lets you export your data, manage consent, and delete your account. You can also email dominik.moelsen@nicheace.ai. We respond within 45 days and may extend once by a further 45 days where the law permits, telling you why. We verify your identity before acting on a request. You may use an authorised agent, and we may ask for proof of their authority.

Appeals. Several states give you the right to appeal a refusal. If we decline a request, reply to our answer and we will review it and respond in writing. If we decline again, your state Attorney General can be asked to look at it.

Marketing email. Every marketing email carries a working unsubscribe link and our postal address, and unsubscribes are honoured promptly, as the CAN-SPAM Act requires. Emails that are part of the service — an address-verification link, a security notice, a receipt — are not marketing and continue after you unsubscribe.

Subscriptions. Subscriptions are sold and billed through Google Play, not by us. Renewal terms, the price, and one-tap cancellation are shown in the Play purchase flow and in your Google account. See Section 4 of the Terms.

Biometric information. We do not collect the biometric identifiers that state biometric-privacy laws cover — voiceprints, fingerprints, retina or iris scans, or face or hand geometry. Audio Mode transcribes what you say and then discards the recording; no voiceprint is created, and your voice is never used to identify you (Section 4).

Shine the Light (California). We do not disclose personal information to third parties for their own direct-marketing purposes.

14. If you are in Canada, Australia, New Zealand, Japan, South Korea or Singapore

We apply the standard set out in the rest of this notice everywhere. It meets or exceeds what local law requires in each of these countries. Where your local law gives you a right this notice does not name, you still have it — ask us and we will honour it.

Your account and learning data are stored in Germany (Section 5) wherever you use nicheAce from, and we remain responsible for them there.

Canada. We handle your data under PIPEDA and, in Quebec, Law 25. The privacy officer is the person named in Section 1. You may access and correct your data and withdraw consent at any time. Complaints: the Office of the Privacy Commissioner of Canada (priv.gc.ca), or the Commission d'accès à l'information du Québec if you are in Quebec. Under CASL we send commercial email only with your consent, and every such message carries an unsubscribe link and our postal address.

Australia. We handle your data under the Australian Privacy Principles, and we remain accountable for it after it is stored in Germany (APP 8). Access and correction through Settings → Privacy or Section 16. Complaints: the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand. We handle your data under the Privacy Act 2020, including the cross-border rule in IPP 12, on the basis that Germany provides comparable safeguards. Complaints: the Office of the Privacy Commissioner (privacy.org.nz).

Japan. We handle your data under the APPI. Our name, address and representative are in Section 1, the purposes of use in Section 3, and retention periods in Section 8. Handling in Germany is entrusted processing by the providers listed in Section 6; Japan and the European Union recognise each other's level of protection as equivalent, which is the basis for it. You may request disclosure, correction, or suspension of use through Section 16. Complaints: the Personal Information Protection Commission (ppc.go.jp).

South Korea. We handle your data under PIPA. You may access, correct, delete, or ask us to suspend processing of your data through Settings → Privacy or Section 16. Complaints: the Personal Information Protection Commission (pipc.go.kr) or the KISA privacy call centre on 118.

Singapore. We handle your data under the PDPA. Our Data Protection Officer is named in Section 1. Storage in Germany meets the transfer limitation obligation, because the protection there is comparable to the PDPA's. Access and correction through Section 16. Complaints: the Personal Data Protection Commission (pdpc.gov.sg).

This notice is published in English and German. If you would prefer it in another language you use the app in, write to us and we will help.

15. Changes to this notice

We may update this notice to reflect changes in our service or the law. We will change the Effective date above, and where a change is material we will notify you in the app and, where appropriate, ask you to re-confirm your consent. The current version is always available at https://nicheace.eu/legal/privacy/.

16. Contact us

• Privacy questions: dominik.moelsen@nicheace.ai
• Data Protection Officer: dominik.moelsen@nicheace.ai
• General support: dominik.moelsen@nicheace.ai
• Legal contacts and postal address: see our Contact page