Privacy Policy

Last Updated: October 29, 2026

1. Controller and EU Representative

This Privacy Policy applies to the nicheace.eu website. The controller is Moelsen Operations Ltd, registered in the United Kingdom (registered office: 124 City Road, London EC1V 2NX, United Kingdom; Companies House no. 17336104). Because the controller is outside the EU, our EU representative under Article 27 GDPR is Dominik Moelsen, Bregenzer Strasse 22, 47249 Duisburg, Germany — reachable via our Contact page.

2. We Process Very Little Data — Here Is the Full Picture

We built this site to process as little personal data as possible:

No accounts, no cookies, no advertising, no cross-site tracking. The site sets no cookies and runs nothing that follows you around the web. The only place we ask for an email address is the voluntary entry test (next bullet).
Entry test / competition (the /challenge page). If you choose to take the work-language entry test, we process: your email address (stored only as a cryptographic hash on our EU backend; the address itself is used transiently to send you your registration code and to limit attempts), your one-sentence job description and your written answers (processed by an AI grader to produce your score, kept at most 7 days), and — if you pass — your score and registration code (kept for the code’s 90-day validity, then deleted automatically). If you opt into the competition leaderboard, your self-chosen username and score are shown publicly. A security check protects the form from bots: it normally runs entirely in your browser (a small proof-of-work puzzle) and sends nothing to a third party; where a third-party check is used instead, it is Cloudflare Turnstile.
Server / IP logs. To deliver the site to your browser, our host Scaleway (Paris, France) processes technical request data — including your IP address — and keeps short-term access logs. This is the minimum needed to serve and secure a website; we do not use it to profile or track you.
Cookieless visit statistics. We measure aggregate site usage with our own analytics, which sets no cookies and stores no IP addresses — see section 3 below.
If you contact us, we process the information you give us (e.g. name, email, message) for the sole purpose of replying.
Your light/dark theme preference is stored only in your browser’s local storage. It is not personal data and never leaves your device; clear it any time via your browser settings.

That is everything — and everything beyond serving the page is either aggregate-only (the statistics) or happens solely because you chose to write to us.

3. Cookieless Website Analytics

We run our own analytics (the open-source software Umami) on our own server at OVHcloud in France, under stats.nicheace.eu. No analytics company receives your data. It records the page you view, the page or campaign link that brought you here, your country, region and city, your browser, operating system, device type, screen size and language, and a few actions such as tapping a store button. It sets no cookies, uses no storage on your device, and does not follow you across sites. Your IP address is used only at the moment of your visit, to look up the location and to form a visit identifier (a one-way hash of your IP address, your browser and a random value that changes every day), and is never stored; we cannot recognise you from one day to the next. We look at aggregate numbers, never at a profile of you. The statistics are deleted after 25 months. Legal basis: our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR). Because no cookies or device storage are used, no consent banner is required under the ePrivacy rules.

4. Where Your Data Is Processed

Hosting, the backend and our analytics are in the European Union (France and Germany), so EU visitors’ data is processed in the EU and is not transferred to China. The controller is established in the United Kingdom, which is covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2021/1772).

5. Legal Basis

The server/IP logs, aggregate analytics, and any contact messages are processed on the basis of our legitimate interest in operating, securing, and improving the site and responding to you (Article 6(1)(f) GDPR), and, where you contact us about our products, to take steps at your request before a contract (Article 6(1)(b) GDPR). The entry test is likewise processed to take steps at your request prior to entering into a contract — passing it is a prerequisite for registering an app account (Article 6(1)(b) GDPR). The site relies on no consent-based processing — it sets no cookies — and uses no automated decision-making with legal or similarly significant effects; the AI test grading only determines whether you may create a free account, and you can retake the test daily.

6. Recipients and Retention

Our processors are Scaleway SAS (Paris) for hosting this website, its domain and DNS, OVHcloud (Frankfurt)for the EU backend at api.nicheace.eu that runs the entry test and for the server in France that runs our own statistics; the entry-test form’s bot check normally runs in your browser and involves no further processor (where a third-party check is used instead, it is Cloudflare Turnstile). Emails from the site, such as your entry-test registration code, are sent from our EU backend through our transactional email provider, Scaleway Transactional Email (France), which processes the recipient address and message solely to deliver it. We do not sell personal data. Server logs are kept by the host per its configuration, contact messages are kept only as long as needed to reply and meet any legal obligations, and entry-test data follows the retention in section 2 (answers at most 7 days; passes and codes at most 90 days, then deleted automatically).

7. Your Rights

Under the GDPR you may request access, rectification, erasure, restriction, data portability, and objection (Articles 15–21) by contacting us. You may lodge a complaint with a supervisory authority — in Germany, your state data-protection authority (Landesdatenschutzbeauftragte(r)). The site is not directed at children, and we do not knowingly collect personal data from minors.

To exercise any right or ask a question, visit our Contact page or our EU representative, Dominik Moelsen.

8. Third-Party Data Attribution

Some IP-geolocation data used across our products is provided by DB-IP.com, licensed under CC BY 4.0. Attribution: “Geolocation data by DB-IP.com.”

9. Changes to This Policy

We may update this Privacy Policy from time to time; material changes update the “Last Updated” date above.