1. Controller and Contact Information
The Data Controller in accordance with the General Data Protection Regulation (GDPR) is:
Luis Kleemann, LT Digital Concepts
Engelbergerstrasse 3
79106 Freiburg im Breisgau, Germany
Email: kontakt@nolies-app.com
No Data Protection Officer (DPO) is appointed, as the legal requirements for a mandatory appointment under German law (§ 38 BDSG) are not met (fewer than 20 employees).
2. General Information on Data Processing
Using the NOlies app requires registering a user account (minimum age: 16 years). We collect and process personal data only insofar as it is necessary to provide a functional app, our content, and our services. We do NOT use tracking, analytics, advertising, or non-essential cookies.
The processing of your personal data regularly takes place only with your consent or when the processing is permitted by legal regulations, in particular the GDPR (e.g., for the performance of a contract pursuant to Art. 6(1)(b) GDPR).
3. Types of Data Processed, Purposes, and Legal Basis
- Account data: Email address and password. Passwords are never stored in plaintext, only as Argon2id hashes. (Legal basis: Art. 6(1)(b) GDPR)
- Authentication data: Optional Google OAuth Subject ID, hashed OTP (One Time Password) codes, and hashed refresh tokens. (Legal basis: Art. 6(1)(b) GDPR)
- Security and usage data: IP addresses and device fingerprints (random installation ID, platform/screen information) are never stored in plaintext. We solely store HMAC-SHA256 hashes to prevent abuse and ensure security. (Legal basis: Art. 6(1)(f) GDPR)
- App usage data: Submitted video URLs, analysis results, chat messages, and daily usage quotas. All URLs and chat contents are encrypted at rest (AES-256-GCM) using per-user encryption keys. (Legal basis: Art. 6(1)(b) GDPR)
- User preferences: UI settings (dark mode, language) and source configurations (user whitelists). (Legal basis: Art. 6(1)(b) GDPR)
- Voice inputs: Audio recordings for voice chat are processed temporarily and are not stored permanently. (Legal basis: Art. 6(1)(b) GDPR)
- Security logs: Failed logins and blocked registrations (only with hashed email/IP address). (Legal basis: Art. 6(1)(f) GDPR)
4. Recipients of Data and Third-Party Processors
Our servers are located in Germany (Hetzner). Internal services like SearXNG, Stalwart Mail, and Redis are self-hosted (no data transfer to third parties). However, to provide the app's functions, we use the following service providers (data processors), which may involve data transfers outside the EU (specifically to the USA). Transfers to the USA are based on the EU-US Data Privacy Framework or Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR as a fallback.
- OpenAI (OpenAI, L.L.C., USA): For vision analysis, fact-checking, chat, and transcription. Data sent: video frames, transcripts, and chat messages. API data is explicitly not used by OpenAI to train AI models.
- Groq (Groq, Inc., USA): For fast chat models, search queries, and Whisper transcription, including voice input in the chat. Data sent: chat messages, transcripts, and short audio clips. We do not store the recordings.
- Google (Google Ireland Limited, Ireland): For Google OAuth sign-in (authentication).
The legal basis for these processing activities is Art. 6(1)(b) GDPR (performance of a contract).
5. Data Retention and Deletion
Your data is stored only for as long as necessary for the stated purposes:
- Account data, analysis results, analysis images, and chat messages: Until you delete the account in the app under Settings, or until you ask us at kontakt@nolies-app.com.
- Security logs: 90 days.
- OTP codes: Expire automatically after a short period.
- Sessions: Until expiration or revocation.
6. Your Rights (Data Subject Rights)
If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights vis-à-vis us:
- Right of Access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.
- Right to Rectification (Art. 16 GDPR): You can immediately request the correction of incorrect or incomplete personal data stored by us.
- Right to Erasure (Art. 17 GDPR): You can request the deletion of your personal data stored by us.
- Right to Restriction of Processing (Art. 18 GDPR): You have the right to demand the restriction of the processing of your personal data.
- Right to Data Portability (Art. 20 GDPR): You can request to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to Withdraw Consent (Art. 7(3) GDPR): You have the right to revoke your once given consent to us at any time.
- Right to Object (Art. 21 GDPR): If your personal data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to the processing.
You can delete the account, chats, analyses, and their images yourself in the app under Settings. A running plan ends immediately when you do. For access, correction, or a deletion you do not make in the app, contact us at kontakt@nolies-app.com.
7. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Website: www.baden-wuerttemberg.datenschutz.de