Privacy Policy

1. Controller and EU Representative

This Privacy Policy applies to the nicheace.eu website. The controller is Moelsen Operations Ltd, registered in the United Kingdom (registered office: 124 City Road, London EC1V 2NX, United Kingdom; Companies House no. 17336104). Because the controller is outside the EU, our EU representative under Article 27 GDPR is Dominik Moelsen, Bregenzer Strasse 22, 47249 Duisburg, Germany — reachable via our Contact page.

2. We Process Very Little Data — Here Is the Full Picture

We built this site to process as little personal data as possible:

• No accounts, no cookies, no advertising, no cross-site tracking. The site sets no cookies and runs nothing that follows you around the web. The only places we ask for an email address are the voluntary entry test and the optional newsletter (next two bullets).
• Entry test / competition (the /challenge page). If you choose to take the work-language entry test, we process: your email address (stored only as a cryptographic hash on our EU backend; the address itself is used transiently to send you your registration code and to limit attempts), your one-sentence job description and your written answers (processed by an AI grader to produce your score, kept at most 7 days), and — if you pass — your score and registration code (kept for the code’s 90-day validity, then deleted automatically). If you opt into the competition leaderboard, your self-chosen username and score are shown publicly. A security check protects the form from bots: it normally runs entirely in your browser (a small proof-of-work puzzle) and sends nothing to a third party; where a third-party check is used instead, it is Cloudflare Turnstile.
• Newsletter (optional). If you subscribe, we process your email address, the page you subscribed from, your interface language, whether you asked to be told about the iOS release, the time of your request, and a one-way hash of your IP address (kept only as proof of consent). Nothing is sent until you click the confirmation link we email you (double opt-in); unconfirmed requests are deleted after 14 days. Every email carries a one-click unsubscribe link, and unsubscribing removes you from the list. The same bot check as the entry test protects the form.
• Server / IP logs. To deliver the site to your browser, our host Alibaba Cloud (Frankfurt, Germany) processes technical request data — including your IP address — and keeps short-term access logs. This is the minimum needed to serve and secure a website; we do not use it to profile or track you.
• Cookieless visit statistics. We measure aggregate site usage with Plausible Analytics, which sets no cookies and stores no personal identifiers — see section 3 below.
• If you contact us, we process the information you give us (e.g. name, email, message) for the sole purpose of replying.
• Your light/dark theme preference is stored only in your browser’s local storage. It is not personal data and never leaves your device; clear it any time via your browser settings.

That is everything — and everything beyond serving the page is either aggregate-only (the statistics) or happens solely because you chose to write to us.

3. Cookieless Website Analytics (Plausible)

We use Plausible Analytics (Plausible Insights OÜ, Estonia — an EU company) to understand aggregate site usage: page views, referrers, countries, and device types. Plausible is built for privacy: it sets no cookies, stores no persistent identifiers, and does not follow you across sites; IP addresses are used transiently to derive aggregate statistics and are not stored. We see only anonymous aggregate numbers, never a profile of you. Legal basis: our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR). Because no cookies or comparable identifiers are used, no consent banner is required under the ePrivacy rules.

4. Where Your Data Is Processed

Hosting is in the European Union (Frankfurt, Germany), and analytics is EU-based, so EU visitors’ data is processed in the EU and is not transferred to China. The controller is established in the United Kingdom, which is covered by the European Commission’s adequacy decision (Implementing Decision (EU) 2021/1772).

5. Legal Basis

The server/IP logs, aggregate analytics, and any contact messages are processed on the basis of our legitimate interest in operating, securing, and improving the site and responding to you (Article 6(1)(f) GDPR), and, where you contact us about our products, to take steps at your request before a contract (Article 6(1)(b) GDPR). The entry test is likewise processed to take steps at your request prior to entering into a contract — passing it is a prerequisite for registering an app account (Article 6(1)(b) GDPR). The newsletter is sent only with your consent (Article 6(1)(a) GDPR), which you give by clicking the confirmation link and can withdraw at any time via the unsubscribe link in every email. Apart from the newsletter, the site relies on no consent-based processing — it sets no cookies — and uses no automated decision-making with legal or similarly significant effects; the AI test grading only determines whether you may create a free account, and you can retake the test daily.

6. Recipients and Retention

Our processors are Alibaba Cloud (Frankfurt) for hosting (including the EU backend at api.nicheace.eu that runs the entry test) and Plausible Insights OÜ (EU)for aggregate statistics; the entry-test form’s bot check normally runs in your browser and involves no further processor (where a third-party check is used instead, it is Cloudflare Turnstile). Newsletter and confirmation emails are sent from our EU backend through our transactional email provider, Resend (EU data residency), which processes the recipient address solely to deliver the message. We do not sell personal data. Server logs are kept by the host per its configuration, contact messages are kept only as long as needed to reply and meet any legal obligations, and entry-test data follows the retention in section 2 (answers at most 7 days; passes and codes at most 90 days, then deleted automatically), and newsletter data is kept until you unsubscribe (unconfirmed requests: 14 days).

7. Your Rights

Under the GDPR you may request access, rectification, erasure, restriction, data portability, and objection (Articles 15–21) by contacting us. You may lodge a complaint with a supervisory authority — in Germany, your state data-protection authority (Landesdatenschutzbeauftragte(r)). The site is not directed at children, and we do not knowingly collect personal data from minors.

To exercise any right or ask a question, visit our Contact page or our EU representative, Dominik Moelsen.

8. Third-Party Data Attribution

Some IP-geolocation data used across our products is provided by DB-IP.com, licensed under CC BY 4.0. Attribution: “Geolocation data by DB-IP.com.”

9. Changes to This Policy

We may update this Privacy Policy from time to time; material changes update the “Last Updated” date above.