This privacy policy applies to the Nuprep app for Android and iOS and the services behind it (together, the “app”), operated by Eclipt UG (haftungsbeschränkt) (“we”, “us”).
In short
- No ads, no analytics, no tracking. We sell no data.
- We don’t record your voice. Speaking exercises are a live conversation with an AI partner.
- What you write and say goes to AI providers to grade it and to hold the conversation.
- You can download your data and delete your account in the app, in Profile.
- Nuprep is for people aged 18 and over.
Who is responsible for your data?
Eclipt UG (haftungsbeschränkt) Kolonnenstr. 8, 10827 Berlin, Germany VAT ID: DE463814871 [email protected]
We are the controller of your personal data under the GDPR.
What information does the app collect, and why?
For each purpose we name the legal basis in Art. 6(1) GDPR. Most of what the app does, it does because you asked for it: that is the performance of our contract with you, point (b).
- Your account. Your email address and, if you choose one, your password, which we store only as a hash it cannot be recovered from. If you sign in with Google, we also receive your name and profile picture; if with Apple, only an email address, which may be a relay address Apple creates for you. We keep the sign-in keys Google or Apple issue, encrypted. We record the day you last used the app. Contract.
- Your plan. The exam you prepare for, its date, your daily practice time, your reminder times, and your phone’s time zone, so that “today” is your day. Contract.
- Your practice. Your answers, exercises, scores, the texts you write, the grades you receive, and your readiness estimate. Contract.
- Plus. Google Play or the App Store sells the subscription and takes the payment. We never see your payment details; we keep the store’s reference to the purchase and the period it covers. Contract.
- Reports about an exercise. If you report a problem, we keep what you wrote, the exercise and the time. Our legitimate interest in correct content, point (f).
- Mail from us. Only what your account needs: confirming your address, resetting your password, confirming a new address, and a warning before we delete an account nobody uses. We send no marketing mail; if we ever want to, we will ask for your consent first. Contract.
- Mail to us. If you write to [email protected], we use your message and address to answer you. Our legitimate interest in answering, point (f).
- The waitlist. If you ask to hear when an exam we don’t offer yet becomes available, we keep your address and that exam to send you that one mail. Your consent, point (a).
- Server logs. Our server logs each request with your network address and the address requested, to keep the service secure and find faults. Our legitimate interest in a secure, working service, point (f).
- Improving readiness. Each time you are scored, we keep the score beside the score we had predicted, to make predictions more accurate. These records hold no name or address, and once your account is deleted they can no longer be linked to you. Our legitimate interest in accurate estimates, point (f).
You need an email address to have an account. Everything else is up to you, though some features need it: without a text there is nothing to grade.
Does the app use Artificial Intelligence?
Yes, for two features, and only for these:
- Speaking. Your conversation partner is an AI, not a person. During a speaking exercise your phone connects directly to OpenAI, which receives your voice live and your phone’s network address. When the conversation ends, the same model grades it from what it heard, and we keep the grade, which includes a short written account of the conversation. We don’t record the audio and keep no transcript.
- Writing. When you hand in a text for correction, we send the text and the task to Anthropic, whose model grades it. Nothing else about you is sent: no name, no address, no account identifier.
Your readiness estimate is calculated from your scores, without AI.
Does the app make automated decisions about me?
Grades and the readiness estimate are produced automatically, which is profiling in the GDPR’s sense. No decision with legal or similarly significant effect is based on them (Art. 22 GDPR): they are practice, and your real exam is graded by its provider.
What does the app keep on my phone?
Your sign-in, in the phone’s secure storage; a text you are writing, until you hand it in; the copy of your data you last downloaded; and your reminders, which the phone shows itself — we send no push messages. The app asks for the microphone, for speaking exercises, and for notifications, for reminders. It reads no device identifier and no location. This storage is strictly necessary for the service you asked for, so it needs no consent (§ 25(2) no. 2 TDDDG). Signing out removes your sign-in and reminders.
Who else receives my information?
These companies process data on our behalf, under contracts that bind them to our instructions and to protect it as this policy does (Art. 28 GDPR):
| Company | What for | Where |
|---|---|---|
| Amazon Web Services | Runs our server | Frankfurt, Germany |
| Aiven Oy | Our database | EU |
| Cloudflare, Inc. | Delivers the audio of listening exercises, and so sees your network address | EU |
| Scaleway SAS | Sends our mail | France |
| Fastmail Pty Ltd | Our mailbox, for mail you send us | EU, with a replica, logs and backups in the US |
| OpenAI Ireland Ltd | The speaking partner | US |
| Anthropic Ireland, Limited | Grading what you write | US |
OpenAI and Anthropic keep what they receive for a limited time to detect misuse of their services, as their own privacy policies describe.
When you sign in with Google or Apple, or buy Plus through Google Play or the App Store, that company acts on its own account under its own privacy policy.
We disclose data to authorities only where the law obliges us to.
Is my information transferred outside the EU?
Yes, to the companies above marked US or with a part in the US. Each transfer is covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which are part of our contracts with them. You can ask us for a copy.
How long do you keep my information?
| What | How long |
|---|---|
| Your account and everything in it | Until you delete it, or until it has gone unused for 24 months with no Plus running; we warn you by mail 30 days before, and signing in keeps it |
| Mail you send us | As long as we need it to answer you, then up to 12 months |
| Waitlist address | Until we send the one mail, or 24 months if the exam never comes |
| Server logs | 14 days |
| Database backups | 30 days at our database provider; our own encrypted copies normally 14 days, longer only while a backup is failing |
How do I delete my information?
In the app: Profile, then delete your account. Everything it holds is deleted at once, and if you signed in with Apple we ask Apple to end the app’s access. You can also write to us.
Some things remain outside our reach or for a short time after deletion: backups and logs, for the periods above; mail already delivered; what OpenAI and Anthropic keep under their policies; your purchase record at Google Play or the App Store; and, if you signed in with Google, the app’s access to your Google account, which you can end in your Google account settings.
Uninstalling the app stops it collecting anything, but does not delete your account.
What are my rights?
Under the GDPR you have the right to:
- Access your data (Art. 15). Profile gives you a copy of everything we hold.
- Rectification of inaccurate data (Art. 16).
- Erasure (Art. 17). Profile deletes your account.
- Restriction of processing (Art. 18).
- Data portability (Art. 20). The copy from Profile is machine-readable.
- Withdraw consent at any time, without affecting what was done before.
- Object (Art. 21): you may object at any time, on grounds relating to your situation, to processing based on our legitimate interests.
Write to [email protected] for anything the app does not do itself. We answer within one month, free of charge; for complex requests the law allows two more months, and we would tell you why.
You may complain to a data protection authority, for example ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.
How is my information kept secure?
Everything between the app and our server is encrypted in transit. Passwords are stored only as hashes, sign-in keys from Google and Apple are encrypted, and our own backups are encrypted. Only the people who run Nuprep have access to its systems. No system is immune to breaches; if one puts your rights at risk, we notify the supervisory authority within 72 hours, and you without undue delay if the risk is high.
Children
Nuprep is for people aged 18 and over. If you believe someone younger has an account, write to us and we will delete it.
Changes to this policy
We update this policy when what we do changes. Before a change to what we do with your data takes effect, we tell you in the app or by mail. Earlier versions are available on request.
Effective: [date of publication]