Last updated: 12 August 2026

Privacy Policy / Datenschutzerklärung

This policy explains how NISUS processes personal data (GDPR Art. 12-14), with regional addenda for the United States, the UK and Asia. Values marked in yellow are placeholders to be completed before launch.

1. Controller

{{LEGAL_ENTITY_NAME}}, {{STREET_AND_NUMBER}}, {{POSTCODE}} {{CITY}}, Germany. E-Mail: {{SUPPORT_EMAIL}}

2. Data protection officer

{{APPOINTED: NAME + CONTACT}} / {{NOT APPOINTED}} - state one of the two plainly. A DPO is not required for most small operators; saying so is still better than silence.

3. What we collect

• Telegram user ID, first name, username, language code
• Chat message content and coach responses
• Selected track, check-in responses, streaks, productivity scores
• Payment metadata from Stripe (we never see or store card numbers)
• Website analytics, only if enabled: {{ANALYTICS_TOOL}} (cookieless, EU-hosted)

4. Purposes and legal bases

• Art. 6(1)(b) - performing the coaching contract: delivering daily actions, check-ins and coach replies, billing.
• Art. 6(1)(f) - legitimate interests: service security, abuse prevention, aggregate product analytics.
• Art. 6(1)(a) - consent: marketing emails, only where you opted in. You can withdraw consent at any time.

5. AI processing disclosure

NISUS is an AI system. The content of your messages is sent to a large language model provider, {{LLM_PROVIDER, e.g. Anthropic}}, in order to generate coach responses. Your data is not used to train models: {{CONFIRM IN PROVIDER TERMS AND LINK THEM}}. You are always informed that you are interacting with an AI system, as required by Article 50 of the EU AI Act (applicable since 2 August 2026).

6. Sub-processors

7. International transfers

Transfers to the USA rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, depending on the provider. Data processing agreements: {{LINK EACH DPA}}.

8. Retention

State concrete durations, not "as long as necessary":

• Chat messages and coach responses: {{e.g. 24 months}}
• Check-ins, streaks, scores: {{e.g. 24 months}}
• Billing records: 10 years (§ 147 AO, § 257 HGB)
• Support email: {{e.g. 12 months}}
• Aggregated, non-identifying analytics: {{e.g. 26 months}}

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent, as well as the right to lodge a complaint with a supervisory authority. Competent authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

10. How to exercise your rights

Write to {{SUPPORT_EMAIL}}. We respond within one month. {{IN-BOT COMMAND, e.g. /deletemydata, IF IMPLEMENTED}}

11. Children

NISUS is not intended for anyone under 18. We do not knowingly collect data from minors, and accounts identified as belonging to minors are deleted.

12. Regional addenda

California (CCPA / CPRA)

Notice at collection: we collect the identifiers, commercial information and internet activity described in section 3, for the purposes in section 4. You have the right to know, delete and correct your personal information, and the right to non-discrimination for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising, so no "Do Not Sell or Share My Personal Information" mechanism is required. If that ever changes, this section and a dedicated opt-out link will be added first.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana)

Residents may request access, deletion, correction and portability of their personal data, and may appeal a refused request. Requests and appeals: {{SUPPORT_EMAIL}}, attention {{NAMED_APPEAL_CONTACT}}. We confirm the outcome of an appeal in writing.

Japan (APPI)

Purpose of use: as stated in section 4. Personal data is provided to the third parties listed in section 6, including cross-border transfers to recipients in the USA, Ireland and {{OTHER COUNTRIES}}. We obtain consent where required for third-party provision and cross-border transfer.

South Korea (PIPA)

We obtain itemised consent per purpose, retain data for the periods listed in section 8 and destroy it without delay afterwards. Privacy officer: {{NAMED_PRIVACY_OFFICER + CONTACT}}. A Korean-language version of this policy will be published before any dedicated Korean launch.

Singapore (PDPA)

Data Protection Officer: {{NAMED_DPO + CONTACT}}. You may withdraw consent at any time by writing to that address; we will explain the consequences for the service before acting on it.

India (DPDP Act 2023)

This policy serves as the notice required under the DPDP Act, and processing is based on your consent. Grievance Officer: {{NAMED_GRIEVANCE_OFFICER + CONTACT}}.

United Kingdom

UK users have the same rights as described in section 9. The supervisory authority is the Information Commissioner's Office (ICO).

Mainland China

Telegram is not accessible in mainland China and NISUS is not offered or marketed there.

13. Changes

Last updated 12 August 2026. Changelog: {{FIRST PUBLISHED - RECORD FUTURE CHANGES HERE}}