Privacy Policy

1. Who we are (controller)

The controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR is:

2. Scope of this policy

This policy explains what personal data NaKlar processes when you use the NaKlar mobile and desktop apps (iOS, iPadOS, macOS, Android), including cloud AI features, accounts, subscriptions, letter post, usage statistics, error reports, server counts and feedback you send on answers, as well as this website at naklar.app.

Where a feature is provided by a third party (for example an AI model provider or the App Store), that provider's own privacy terms apply in addition — we link them below.

3. On-device first: how NaKlar handles your data

NaKlar is designed so that your paperwork never has to leave your hands:

• Scanning, text recognition, and document organisation happen locally on your device.
• Your documents, recognised text, and chat conversations are stored locally on your device — not in our backend databases. The one exception is feedback you choose to send on an answer (section 9).
• Cloud AI processing happens only when you ask for it. When you ask NaKlar about a document, the query and the document excerpts needed to answer it are transmitted to the AI provider you selected, Mistral AI or Google Gemini (see sections 5 and 6). If Gemini can't answer, Mistral AI answers instead.
• Nothing is sent without you. Draft replies always open in your own email app for review — NaKlar never sends email on your behalf. A letter is posted only when you order and pay for it (section 11).

4. Data we process, and why

5. Cloud AI of your choice: Mistral AI (EU)

When you choose to interact with the assistant using Mistral AI, or Gemini can't answer your request (section 6), your query and relevant document excerpts are transmitted to our third-party processing provider:

• Provider: Mistral AI SAS, 15 rue des Halles, 75001 Paris, France.
• Purpose: Processing natural-language chat queries, document explanations, and formal German draft correspondence.
• Legal basis: Art. 6(1)(b) GDPR (performance of contract / service requested by user) and Art. 6(1)(a) GDPR (explicit consent when selecting the cloud AI model).
• Data handling and retention: Data transmitted via the commercial API is processed on servers located within the European Union. The provider maintains temporary operational logs solely for automated security and abuse prevention in accordance with its commercial Data Processing Addendum (currently up to 30 rolling days), after which they are deleted.
• No model training: Our commercial API agreement contractually prohibits the provider from using your queries or document excerpts to train AI models.
• Further information: The provider's Data Processing Addendum is the authoritative source for its current security measures and sub-processing details: Mistral AI Privacy Policy and Mistral AI Data Processing Addendum.

6. Cloud AI of your choice: Google Gemini (global / USA)

When you choose to interact with the assistant using Google Gemini, your query and relevant document excerpts are transmitted to Google:

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for EEA users; parent entity: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
• Purpose: Processing natural-language chat queries, document explanations, and formal German draft correspondence.
• Legal basis: Art. 6(1)(b) GDPR (performance of contract / service requested by user) and Art. 6(1)(a) GDPR (explicit consent when selecting the cloud AI model).
• Data handling and retention: We access the Gemini API via Google's commercial Paid Services tier. Prompts and responses are logged transiently for a limited period solely for system integrity and abuse prevention, as described in Google's Paid Services terms.
• No model training: Our commercial agreement contractually prohibits Google from using your prompts or generated responses to train Google AI models, and human reviewers do not read submissions.
• International data transfers: Processing may take place on Google infrastructure globally, including in the United States. Data transfers to the USA are safeguarded under the EU-U.S. Data Privacy Framework (DPF) and Google's Standard Contractual Clauses (SCCs).
• When Gemini can't answer: If it fails or takes too long, Mistral AI in the EU answers your request instead (see section 5). We never send a request to Gemini unless you chose Gemini.
• Further information: Google's terms are the authoritative source for its current security measures and sub-processing details: Gemini API Additional Terms of Service, Google Cloud Data Processing Addendum, and Google Privacy Policy.

7. Backend and cloud infrastructure (EU; sign-in in the USA)

Our app uses Google's cloud infrastructure to manage sign-in, entitlement quotas and service availability. Our backend functions and database run in the European Union (Frankfurt, Germany); sign-in runs in the United States (see below):

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Purpose: Relaying API requests, managing subscription status and credit balances, and preventing service abuse.
• Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Sign-in (Firebase Authentication): You can sign in with your email address and a password, or with Apple or Google. Firebase Authentication, part of this backend, keeps your email address and gives your account a user ID. With Apple or Google, it receives the email address and name they share with us (Apple lets you hide your email address). With email, your password goes from the app straight to Firebase Authentication, which stores it only as a salted one-way hash. Our servers never receive your password, and we can't see it. Before you sign in, the app uses an anonymous account without a name or email address. Your sign-in is kept while your account exists and is deleted with it; Google then removes it from its systems, backups included, within 180 days. Firebase Authentication also uses your IP address and user agent (which browser or device you use) to protect sign-up and sign-in from abuse, and keeps logged IP addresses for a few weeks. It runs only in Google's US data centers, so your sign-in data is processed in the United States. These transfers are safeguarded by the EU-U.S. Data Privacy Framework (DPF), under which Google LLC is certified, and by Google's Standard Contractual Clauses for Firebase.
• Account emails: When you create an account with your email address, ask for the confirmation again, or reset your password, our backend creates a one-time link and sends you one email from [email protected]. It goes out through our email host, Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, which processes it for us under a data processing agreement (Art. 28 GDPR) and hands outgoing mail to its sub-processor MailChannels for delivery. The link opens our page at naklar.app/auth/action (section 12). The email has no tracking pixels and no tracked links. For a password reset, your address waits in our task queue until the email goes out, usually a few seconds. To stop abuse, we count requests and sent emails under keyed hashes of your user ID, email address and IP address, never under the ID, address or IP itself, and delete these counts after 2 days. Our own logs note only the kind of email, its language and whether it went out. If our email service can't send, the app may ask Firebase Authentication to send the email instead; that email links to Firebase's own page. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Free AI actions belong to the device (iPhone and iPad): With each AI request, the app sends a short-lived token from Apple's DeviceCheck service. Our backend uses it only on the free plan: it asks Apple whether this device has already used its free AI actions, and tells Apple when it has. Apple keeps this note for our app as a single on/off value for your device. It holds no name, no account and nothing from your documents or chats. We store neither the token nor any device identifier; on your account we only note that it got its free start, and when. If no token arrives or Apple can't be reached, you get the free actions anyway. The Mac and Android apps send no token. The note at Apple stays when you delete your data, your account or the app. It stops counting six months at the latest after this device last used a free AI action. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a free plan that can't be claimed again and again).
• Zero document and prompt storage: Backend request processing is designed to be stateless. Document scans, recognised text, and chat conversations remain stored locally on your device and are not stored in our backend databases, except feedback you choose to send on an answer (section 9). Our own diagnostic logs record only technical telemetry (such as token counts and latency). Google Cloud also logs every request to our backend: the time, your IP address and user agent, which function was called, the response status and how long it took. Neither kind of log contains prompts, document contents or message text. We use these logs for security, to prevent abuse and to find faults (Art. 6(1)(f) GDPR, our legitimate interest in a secure, working service). They are deleted after 30 days. Google may store them outside the EU; the safeguards for sign-in data above apply. A letter you post passes through it only in memory and is not stored (section 11).
• Administrative data stored: Apart from feedback you send (section 9), persistent records are limited to non-content administrative data: remaining credit balances, active subscription status, purchase validation tokens, temporary rate-limiting counters and letter-post orders (section 11). They are kept under your account's user ID, which Firebase Authentication links to your sign-in, so they are linked to you.
• Right to erasure (Art. 17 GDPR): You can delete your account directly within the app at any time. This permanently deletes your sign-in (with your email address and password hash), your account records and your entitlement balances. Apple's note that your device has used its free AI actions stays (see above). Letter-post orders lose your user ID and keep only their booking data (section 11). If you bought credits, a record of counters only, kept under a double hash of your user ID, stays unusable for 12 months so that a late refund or chargeback can be settled, and is then deleted. Statutory retention requirements remain unaffected.
• Governing agreement: Google Cloud Data Processing Addendum.

8. Usage statistics, error reports and server counts (TelemetryDeck)

The app uses TelemetryDeck to learn which features help and when something fails. You decide about usage statistics; error reports and server counts are always on, because we need them to keep the app working and to see which features are used.

• Provider: TelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg, Germany. Data is stored on servers in the EU.
• Usage statistics (only with your consent): which features you use (for example that a letter was scanned or an export finished, never what it says), where something gets cancelled or fails, when the Pro screen opens and whether a purchase goes through, plus app version, device type and language. They are counted per app installation under an identifier that is hashed twice, and never linked to your name or account. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent).
• Off until you agree: Usage statistics stay off until you agree in the app. You can turn them off at any time in Settings → Usage statistics; sharing stops immediately.
• Error reports (always on): When something fails or the app closes unexpectedly, the app sends a short report: what failed, the app and system version, and the device model. A report contains no content and no identifier for your device or installation. Legal basis: § 25(2) No. 2 TDDDG (strictly necessary to provide the app you asked for) and Art. 6(1)(f) GDPR (our legitimate interest in an app that works).
• Server counts (always on): When you use Ask NaKlar or send a letter by post, our server receives the request anyway. It counts it and sends TelemetryDeck labels only: the task, the language, free or paid, Apple or Android, roughly how long ago the account first signed in (for example “first week”) and whether it worked; for letters, the step (for example paid or posted), whether it went registered and the number of sheets. Counts carry no user, account or device identifier and no content, and nothing is read from your device for them. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing which features are used and whether they work).
• Never collected: Letter text and photos, file names, your chats with NaKlar, redacted text, names, email addresses, account IDs and payment details. IP addresses are not stored.
• Retention: Statistics, reports and counts are deleted after 24 months at the latest.

9. Feedback you send on an answer

Now and then, under an answer, NaKlar asks how the chat is going: Bad, Fine or Good. You can close the question. After Bad, a short form lets you choose what went wrong and tell us more. The same form opens from “Report a problem…” in every answer's menu. Nothing is sent until you choose Bad, Fine or Good, or press Share.

• What is sent: your rating (Good, Fine or Bad), whether you gave it to the question or from an answer's menu, and how often NaKlar was asking at the time (below); from the form, the reasons you chose and what you wrote. Sharing the form also sends the chat up to the rated answer: your messages as you typed them, NaKlar's answers and any draft NaKlar wrote (as NaKlar wrote it), the redacted letter text NaKlar read for that answer, and which pages of the letter that was. The form says this above its Share button. “Report a problem…” sends nothing until you press Share.
• What stays on your device: your original pages and photos, the letter before redaction, and your changes to a draft. Your messages go as you typed them, without redaction, so leave out anything you do not want to share.
• How often NaKlar asks: at most once in each chat. Your device remembers which chats NaKlar has asked or skipped, how many times in a row you closed the question (each close makes it wait longer) and whether NaKlar has asked since you last opened the app. This stays on your device, is never sent, and “Delete all my data” erases it. So that NaKlar asks only as often as it needs to, our server sets for each language the share of chats in which it asks, from the number of ratings it already holds in that language. The share is the same for everyone and comes with each answer.
• Purpose: finding where answers are wrong, incomplete or unclear, and improving them.
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in correct, useful answers). You decide each time whether to send feedback.
• Storage and access: our backend on Google Cloud in Frankfurt, Germany (section 7). Feedback is stored under a one-way hash of the answer's request number, without your account or user ID. Only the NaKlar team reads it, to review answers. A separate counter that limits how much feedback one account can send per day is kept under a one-way hash of your user ID and deleted after two days.
• Statistics: TelemetryDeck receives labels only: the rating, where you gave it, the reasons, whether a note or the chat came with it, and the answer's task, language, model and platform; never the note or the chat (section 8). If you agreed to usage statistics, the app also counts whether the question appeared, was answered (with the rating) or was closed.
• Retention: deleted automatically 90 days after it is sent. As feedback is stored without your account, deleting your account does not reach it; it is deleted after 90 days in any case.

10. In-app purchase verification

For managing in-app subscriptions and credit purchases made through the Apple App Store or Google Play:

• Provider: RevenueCat, Inc., 680 Green St, San Francisco, CA 94133, USA.
• Purpose: Verifying purchase receipts, validating active subscriptions, and restoring purchases.
• Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Data transmitted: Your account's user ID, store transaction identifiers, purchase timestamps, and subscription and credit product IDs. Document content, letter text, and chat queries are not shared with RevenueCat.
• Governing terms: Covered under RevenueCat's Data Processing Agreement incorporating Standard Contractual Clauses (SCCs).

11. Letters you post with NaKlar

You can have a reply printed and posted from the app. A print and mail service in Germany prints it, puts it in an envelope and hands it to Deutsche Post. Nothing is posted until you confirm the order and pay for it.

• To the print and mail service: the letter as a PDF, as you approved it (your text, your sender address, the recipient's address and any pages you attach), and whether it goes as an Einschreiben (registered mail). The service processes the letter on our behalf in Germany under a data processing agreement (Art. 28 GDPR) and deletes it 60 days after posting. We tell you its name on request (Art. 15 GDPR).
• To Stripe: the amount, the payment details you enter in Stripe's payment form (card details, Apple Pay or Google Pay) and the email address for your receipt. On the Mac you pay on Stripe's own page. Your card details go to Stripe directly; we never see them. Provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes the payment for us, and also uses payment data for its own purposes, such as preventing fraud and meeting financial regulation: Stripe Privacy Policy.
• Through our backend: the letter and the recipient's address lines pass through our backend (section 7) in memory only, to hand them to the print and mail service and to check that the address it reads is the one you wrote. Our order record holds no names, addresses, letter text, PDF or email address: only the order number, your user ID, the price, the number of sheets, whether it is an Einschreiben, its dates and status, and the payment and print-job numbers. The tracking number of an Einschreiben is deleted 90 days after posting.
• Legal basis: Art. 6(1)(b) GDPR (the order you place). A letter can hold health or social data, so you also give your explicit consent on the order form (Art. 9(2)(a) GDPR). Order and payment records are kept under Art. 6(1)(c) GDPR, for the retention duties of German commercial and tax law (§ 147 AO, § 257 HGB).
• International data transfers: The print and mail service works in Germany. Stripe may process payment data outside the EU, including in the United States; these transfers are safeguarded by the EU-U.S. Data Privacy Framework (DPF), under which Stripe's US companies are certified, and by the European Commission's Standard Contractual Clauses.
• Retention: order records are kept as long as German commercial and tax law requires (up to ten years). When you delete your account, your orders lose your user ID and keep only their booking data. Stripe keeps payment data as its own legal duties require.

12. Data on this website

This website is a static information page. We do not run analytics, tracking pixels, advertising, or third-party cookies here, and we load no remote fonts or scripts.

• Local preferences only. Your language, theme, and zoom choices are stored in your browser's local storage on your own device. They are never transmitted to us.
• Hosting and delivery. Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, hosts this website. Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, runs its domain and delivers the pages. Both necessarily process technical connection data (such as IP address, date and time, and requested URL) to deliver the pages securely. Cloudflare also asks your browser to report failed connections to it. Cloudflare may process this data in the United States; these transfers are safeguarded by the EU-U.S. Data Privacy Framework (DPF), under which Cloudflare is certified. This processing is based on Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).
• Account links (naklar.app/auth/action). The links in our account emails open this page. It sends the one-time code from the link, and a new password if you set one, straight to Firebase Authentication (section 7), and it stores nothing on your device. If a reset link has expired or was used, you can ask for a new one there: your email address and the page's language go through a Cloudflare gate to our backend, which emails you as described in section 7. To stop floods, the gate counts requests per network (IP address) for one minute. Legal basis: Art. 6(1)(b) GDPR (performance of contract).

13. Your rights

Under the GDPR you have the following rights concerning your personal data:

• Access (Art. 15) — confirmation of whether we process your data, and a copy of it.
• Rectification (Art. 16) — correction of inaccurate data.
• Erasure (Art. 17) — deletion, including full account deletion inside the app.
• Restriction (Art. 18) — limited processing in certain circumstances.
• Data portability (Art. 20) — receiving your data in a portable format.
• Objection (Art. 21) — objecting to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)) — withdrawing opt-in consent (for example for usage statistics) at any time with future effect.

To exercise any of these rights, contact us at [email protected]. We respond within one month as required by Art. 12(3) GDPR.

14. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — in particular in the EU member state of your residence, your workplace, or the place of the alleged infringement. A list of EU supervisory authorities is published by the European Data Protection Board at edpb.europa.eu.

15. Children

NaKlar is not directed at children under 16, and we do not knowingly process personal data of children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

16. Security and retention

• Security. All network connections use TLS encryption. Backend access follows the least-privilege principle, and document content is excluded from server logs by design.
• Retention. We keep personal data only as long as necessary for the purposes above: account records persist while your account exists and are deleted when you delete it; feedback you send on an answer is deleted 90 days after it is sent (section 9); server logs are deleted after 30 days (section 7); the counts that limit account emails are deleted after 2 days, and Apple's free-start note for your device stops counting six months at the latest after its last free AI action (section 7); letter-post orders are kept as long as German commercial and tax law requires, and the print and mail service deletes your letter 60 days after posting (section 11); provider-side retention (for example Mistral's abuse-monitoring window) is governed by each provider's terms linked above. Statutory retention obligations (for example tax law) remain unaffected.

17. Changes to this policy

We may update this policy when our processing or the law changes. The current version is always published at this address with its effective date. If a change materially affects your rights, we will notify you in the app before it takes effect.

18. Contact

Questions about this policy or your data? Reach us at [email protected].

Our provider details are in the legal notice (Impressum, in German).