Back to home
Privacy Policy for the "Nachhilfe Mentor" App
This is an English translation provided for convenience. In case of
discrepancies, the German version (available at
https://nachhilfe-mentor.de/datenschutzerklaerung.html) prevails, unless
mandatory law provides otherwise.
1. Introduction
We are pleased that you are using our tutoring app "Nachhilfe Mentor". The
protection of your personal data is very important to us. This Privacy Policy
informs you about which data we collect, how we use it, and which rights you
have with regard to your data. The controller responsible for data processing
is Thümmler AI GmbH, Leonardo-da-Vinci-Straße 15, 14467 Potsdam, Germany, e-mail:
support@nachhilfe-mentor.de. Please direct all data protection enquiries to
support@nachhilfe-mentor.de.
This Policy complies with the requirements of the EU General Data Protection
Regulation (GDPR) and the German Federal Data Protection Act (BDSG), as well
as – where applicable – the German Telecommunications Digital Services Data
Protection Act (TDDDG, formerly TTDSG). It applies to the use of our app on
all platforms (web, Android, iOS) as well as to our website
nachhilfe-mentor.de.
Our app and website can be used worldwide. The GDPR is our uniform,
globally applied standard of protection – it is one of the strictest data
protection laws in the world, and we apply its safeguards to all users,
regardless of where they live. Supplementary information for users outside
Germany (e.g. United Kingdom, Switzerland, USA, Brazil, Canada and other
countries) can be found in Section 11 of this Policy. Information on the
protection of children and minors can be found in Section 10. This Privacy
Policy is available in German and English; in case of doubt, the German
version prevails.
2. Data We Collect
In the course of using our app "Nachhilfe Mentor", we collect certain
personal and non-personal data in order to ensure the functionality of the
app, improve the user experience and provide our service. Below we
transparently inform you about which data we collect, how we collect it and
for what purpose. The collection and processing of your data always takes
place in accordance with the GDPR and the BDSG.
2.1 Personal Data
Personal data is information relating to an identified or identifiable
natural person. We collect the following personal data:
• 2.1.1 E-mail address: When registering via e-mail and password or via
Google or Apple sign-in, your e-mail address is collected in order to create
and manage your user account.
• 2.1.2 Username: You may choose a username that is displayed in your
profile and when interacting with other users.
• 2.1.3 Password (only for e-mail registration): Your password is stored
in encrypted form and is used for authentication.
• 2.1.4 Profile information: Optionally, you may add further information
such as your name or a profile picture.
• 2.1.5 Content data: In projects, flashcards, test questions and chat
messages, you may upload texts, images or other content that may contain
personal data (e.g. names, addresses or other identifiable information).
• 2.1.6 Communication data: Within the chat function, messages that you
send to the AI or to other users are stored. These may contain personal data
if you voluntarily share such information.
2.2 Non-Personal Data
Non-personal data is information that does not allow any conclusions to be
drawn about your identity. We collect the following non-personal data:
• 2.2.1 Device information: To optimise the app, we collect information
about your device, such as operating system, device type and app version.
• 2.2.2 Usage data: We collect data about your interaction with the app,
such as pages visited, features used and learning activities (e.g. streak
counter), in order to improve the user experience and further develop the
app.
• 2.2.3 Analytics data: With your consent, we may collect aggregated data
about the use of the app (e.g. via Firebase Analytics) in order to create
statistical evaluations and improve the app.
• 2.2.4 Log data (including IP address): When using the app, technical
log data such as your IP address is recorded. This is done to ensure
security (e.g. to detect misuse) and to document consents (GDPR proof of
consent).
• 2.2.5 Website analytics data: When you visit our website
nachhilfe-mentor.de and its blog, we use PostHog to collect technical and
aggregated usage data, e.g. page views, clicks on download links, scroll
depth, referrer, device and browser information, and interactions with blog
articles. Website analytics is configured cookieless, so PostHog does not
set cookies or local storage in your browser for this website analytics.
In addition, we use Google Analytics 4 on the website – but only if you
have previously consented via our cookie banner (details in Section 4.1.9).
2.3 How Data Is Collected and Stored
Data is collected in the following ways:
• 2.3.1 Direct input: When you register, create a profile, create
projects, flashcards or test questions, send chat messages or upload other
content.
• 2.3.2 Automatic collection: Device information and usage data are
collected automatically when accessing the app.
• 2.3.3 External services: We use external services such as Firebase
(authentication, Firestore database) and Google Gemini (generative AI,
including the analysis of uploaded images) as well as OpenAI (AI features).
These services may process data in accordance with their own privacy
policies.
2.4 Purpose of Data Collection
The collection and processing of your data serves the following purposes:
• 2.4.1 Provision of app features: To enable the core functions of the
app such as projects, flashcards, test questions and chat.
• 2.4.2 Authentication and account management: To create, manage and
secure your user account.
• 2.4.3 Personalisation: To track your learning progress (e.g. streak)
and offer you a personalised experience.
• 2.4.4 Communication: To provide you with notifications or support if
required.
• 2.4.5 Improvement of the app: To optimise the app, fix errors and
develop new features.
2.5 Legal Basis
The processing of your data is based on the following legal bases:
• 2.5.1 Consent (Art. 6(1)(a) GDPR): For optional features such as
uploading images or the use of analytics tools.
• 2.5.2 Performance of a contract (Art. 6(1)(b) GDPR): For the provision
of the app services, e.g. saving projects and flashcards.
• 2.5.3 Legitimate interest (Art. 6(1)(f) GDPR): For improving the app
and ensuring its functionality, e.g. by collecting device information.
2.6 Data Minimisation
We only collect the data required for the provision and improvement of the
app. You can use the app without disclosing unnecessary personal data. All
personal data that you voluntarily share (e.g. in chat messages) is used
only for the stated purpose.
3. How We Use Your Data
In the following, we explain how we use the data collected in the "Nachhilfe
Mentor" app to provide our services, support your learning goals and ensure
the functionality of the app. Your data is always processed in strict
compliance with the GDPR and the BDSG. We attach particular importance to
using your data only for the stated purposes and protecting your privacy.
3.1 Provision of App Features
The main use of the collected data is to provide the core functions of the
app:
• 3.1.1 Account management: Your e-mail address and username are used to
create, authenticate and manage your user account. This enables you to
securely access your projects, flashcards, test questions and chats.
• 3.1.2 Learning content: Content that you upload in projects (e.g.
titles, descriptions, summaries, flashcards), test questions or chats is
stored and processed to offer you a personalised learning environment. For
example, flashcards with questions and answers are used to help you study,
and test questions are used to create multiple-choice tests.
• 3.1.3 Chat function: Your messages in the chat (including uploaded
images or files) are processed to provide you with interactive support
through the integrated AI (OpenAI). Uploaded images are transmitted to our AI
service Google Gemini for analysis (e.g. text recognition) in order to
answer your requests. In addition, in voice chat
mode (after you grant microphone access), your speech input is recorded and
converted into text by AI speech recognition (e.g. OpenAI Whisper), which is
then processed like a normal chat message. Note: You can deactivate camera
and microphone access at any time in your device settings.
• 3.1.4 AI-generated learning content and premium features: Features such
as automatically created summaries, flashcards, learning paths, "Learning
While You Sleep" (which processes your content for audio playback) or
AI-powered answers in the Mentor chat use our AI services (OpenAI and Google
Gemini). Your inputs (e.g. texts, questions or documents) are transmitted to
these services in order to generate or read out the requested learning
content. The results are then made available to you directly in the app.
3.2 Personalisation and Learning Progress
We use your data to tailor your learning experience:
• 3.2.1 Streak feature: Usage data, such as the frequency of your
activities (e.g. creating projects, studying with flashcards), is used to
calculate and display your learning streak. This serves to motivate you and
track your progress.
• 3.2.2 Rating and adaptation: Ratings that you give to flashcards or
vocabulary (scale 1–5) are stored in order to adapt the order of learning
content. Difficult content is shown more frequently to optimise your
learning.
3.3 Technical Functionality and Improvement
Your data helps us to operate the app technically and improve it
continuously:
• 3.3.1 Error resolution: Device information (e.g. operating system) and
usage data are used to identify and fix technical problems, e.g. via
Firebase Crashlytics.
• 3.3.2 Optimisation: Aggregated usage data is used for analysis to
optimise the app, develop new features and increase usability. Personal data
is not used for this purpose without your consent.
• 3.3.3 Security: Passwords (encrypted) and authentication data (e.g. via
Firebase Authentication) are used to ensure the security of your account. In
addition, we use log data (such as IP addresses) to detect misuse, prevent
unauthorised access and verifiably document the consents you have given
(e.g. for analytics).
3.4 Payment Processing
If you take out a subscription (e.g. premium features) via in-app purchases:
• 3.4.1 Transaction data: Purchase details (e.g. product ID, purchase
date) are processed to manage your subscription and grant you access to
premium features. This data is handled via Firebase Functions and the
respective app store services (Google Play, Apple App Store).
3.5 Communication
Your data may be used to communicate with you:
• 3.5.1 Notifications: Your e-mail address may be used to send you
important information about your account (e.g. e-mail verification, password
reset) or updates about the app, unless you have deactivated this.
• 3.5.2 Push notifications: With your consent, we send you push messages
(e.g. learning reminders or important notices about the app) to your device.
These messages are delivered via your device's services (Google Firebase
Cloud Messaging for Android or Apple Push Notification Service for iOS). You
can deactivate push notifications at any time via your device settings.
3.6 Legal Basis for Use
The use of your data is based on the following legal bases under the GDPR:
• 3.6.1 Performance of a contract (Art. 6(1)(b)): Processing is necessary
to provide you with the app's services (e.g. storage of projects and
flashcards, handling of subscriptions).
• 3.6.2 Legitimate interest (Art. 6(1)(f)): For technical improvements,
security measures and anonymised analyses, provided your interests do not
override ours.
• 3.6.3 Consent (Art. 6(1)(a)): For optional features such as uploading
images or the use of analytics tools that you actively trigger.
3.7 Storage Period
Your data is stored only as long as necessary for the stated purposes:
• 3.7.1 Account data: Until you delete your account.
• 3.7.2 Learning content: Until you delete projects, flashcards or test
questions, or remove your account.
• 3.7.3 Usage data: Anonymised after a reasonable analysis period, unless
statutory retention obligations apply.
3.8 Data Minimisation
We use your data only to the extent necessary to fulfil the stated purposes.
For example, we do not store unnecessary device information and process
uploaded content only to provide you with the requested features (e.g.
flashcard generation).
4. Sharing of Data
We take the protection of your data seriously and share your personal
information only in specific, clearly defined cases. Any sharing always
takes place in strict compliance with the GDPR and the BDSG.
4.1 With Whom Do We Share Your Data?
To operate the "Nachhilfe Mentor" app and provide you with all features, we
work with trusted service providers. These providers process your data only
on our behalf and according to our instructions:
• 4.1.1 Firebase (a Google service): We use Firebase for secure sign-in,
storage of your data (e.g. projects and flashcards), sending push
notifications and error resolution. Firebase is committed to protecting your
data in accordance with strict data protection standards. More in the
Firebase Privacy Notice: https://firebase.google.com/support/privacy
• 4.1.2 Image analysis via Google Gemini: When you upload images to have
text or content extracted from them, these images are transmitted to the AI
service Google Gemini (see also 4.1.5). Your images may be temporarily sent
to Google in the process.
• 4.1.3 OpenAI: For the creation of summaries, flashcards and other
content, we use OpenAI. Your text inputs are sent to OpenAI to enable these
features. OpenAI's privacy policy is available at:
https://openai.com/policies/privacy-policy
• 4.1.4 Payment processing: If you take out a subscription, your payment
data is processed via Google Play or the Apple App Store. These platforms
are responsible for the secure processing of your payments.
• 4.1.5 Google Gemini: For certain AI features (e.g. generated learning
paths or summaries), we use Google's generative AI service "Gemini". Your
corresponding inputs are transmitted to this service to generate the
requested content. Google is committed to protecting your data in accordance
with strict data protection standards.
• 4.1.6 Google Sign-In: If you use sign-in via Google, Google processes
data for identity verification as part of OAuth authentication. We receive
from Google only the information required for account registration (such as
your name and e-mail address). No further data is exchanged. Google's
privacy terms apply to the sign-in process.
• 4.1.7 Apple Sign-In: If you use "Sign in with Apple", Apple processes
your data for authentication. We receive from Apple a unique user ID and,
depending on your Apple settings, your e-mail address. Beyond this, we do
not share any further data with Apple. Apple's privacy policies apply to the
sign-in process.
• 4.1.8 PostHog: For website and product analytics, we use PostHog
(PostHog, Inc.). The website nachhilfe-mentor.de sends usage events to
PostHog's EU instance at https://eu.i.posthog.com. We use PostHog to
understand the use of the website, the blog and the app download links and
to improve our offering. For the website, PostHog is configured cookieless.
• 4.1.9 Google Analytics 4: On our website nachhilfe-mentor.de, we use
Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland; parent company: Google LLC, USA) to statistically
evaluate the use of the website. Google Analytics is only loaded after you
have expressly consented via our cookie banner (Art. 6(1)(a) GDPR in
conjunction with Section 25(1) TDDDG). Without your consent, no Google
Analytics cookies are set and no data is transferred to Google. If consent
is given, Google Analytics processes, among other things, truncated IP
addresses, device and browser information, pages visited and interactions;
data may be transferred to the USA in the process (see Section 7 for
safeguards). You can withdraw your consent at any time with effect for the
future by clicking the cookie icon (🍪) at the bottom left of the website
and selecting "Decline". More information:
https://policies.google.com/privacy
4.2 When Are We Required to Share Your Data?
In rare cases, we are legally obliged to share your data, e.g. when
requested by an authority. We will also share your data if necessary to
protect our rights or to ensure the safety of our users.
4.3 No Sharing for Advertising
We do not sell or share your data for advertising purposes unless you have
given us your express permission to do so.
4.4 Data Transfers Abroad
Since some of our service providers (such as Google, OpenAI, PostHog and
Apple) are based in the USA, your data may be transferred to countries
outside the EU. We ensure that these transfers are protected by appropriate
safeguards, e.g. by Standard Contractual Clauses that comply with EU data
protection standards.
5. Your Rights and Options
Your rights regarding your personal data are important to us. Our goal is to
offer you full transparency and control over your data. Below we explain
your rights under the GDPR and how you can exercise them in the "Nachhilfe
Mentor" app.
5.1 Right of Access (Art. 15 GDPR)
You have the right to request confirmation as to whether we process personal
data about you. If this is the case, you can request information about:
• the categories of data processed,
• the purposes of processing,
• the recipients or categories of recipients to whom your data has been
disclosed,
• the planned storage period or the criteria for determining it,
• and further details in accordance with Art. 15 GDPR.
How to exercise your right: Send an e-mail to support@nachhilfe-mentor.de
with the subject "Access request". We will process your request promptly,
usually within one month, and provide you with the requested information.
5.2 Right to Rectification (Art. 16 GDPR)
You can request that inaccurate or incomplete personal data we have stored
about you be corrected or completed without undue delay.
How to exercise your right:
• For changes to your username or e-mail address, use the profile
settings directly in the app.
• For further corrections, contact us at support@nachhilfe-mentor.de with
a description of the desired changes.
5.3 Right to Erasure (Art. 17 GDPR)
You have the right to request the erasure of your personal data ("right to
be forgotten") if one of the grounds set out in Art. 17 GDPR applies, e.g.:
• the data is no longer necessary for the purposes for which it was
collected,
• you withdraw your consent and there is no other legal basis for
processing,
• or the processing is unlawful.
Erasure does not take place if statutory retention obligations exist.
How to exercise your right:
• Use the "Delete account" function in the app settings to remove your
account and the associated data.
• Alternatively, send an e-mail to support@nachhilfe-mentor.de with the
subject "Erasure request". Please note that we may be legally obliged to
retain certain data (e.g. invoice data) for a prescribed period.
5.4 Right to Restriction of Processing (Art. 18 GDPR)
You can request the restriction of the processing of your data, e.g. if:
• you contest the accuracy of the data (for the duration of the review),
• the processing is unlawful but you refuse erasure,
• we no longer need the data but you need it to establish, exercise or
defend legal claims.
How to exercise your right: Send an e-mail to support@nachhilfe-mentor.de
with the subject "Restriction of processing" and state the reason for your
request. We will implement the restriction if the requirements are met.
5.5 Right to Data Portability (Art. 20 GDPR)
You have the right to receive the personal data you have provided to us in a
structured, commonly used and machine-readable format. You can also request
that we transfer this data directly to another controller, where technically
feasible.
How to exercise your right: Send an e-mail to support@nachhilfe-mentor.de
with the subject "Data portability". We will provide your data in a suitable
format (e.g. CSV or JSON).
5.6 Right to Object (Art. 21 GDPR)
You can object to the processing of your data if it is based on a legitimate
interest (Art. 6(1)(f) GDPR), in particular in the case of direct marketing.
However, no direct marketing takes place in the "Nachhilfe Mentor" app.
How to exercise your right: Send an e-mail to support@nachhilfe-mentor.de
with the subject "Objection" and explain the reasons for your objection. We
will review your case and implement the objection unless compelling
legitimate grounds prevail.
5.7 Withdrawal of Consent (Art. 7(3) GDPR)
If you have given us consent to process your data (e.g. for optional
features such as uploading images), you can withdraw it at any time. The
withdrawal applies only to the future and does not affect the lawfulness of
processing carried out before the withdrawal.
How to exercise your right:
• Adjust the corresponding settings in the app to withdraw your consent.
• Alternatively, contact us at support@nachhilfe-mentor.de with a short
message.
5.8 Right to Lodge a Complaint (Art. 77 GDPR)
If you believe that the processing of your data violates the GDPR, you have
the right to lodge a complaint with a data protection supervisory authority
– in particular in the EU member state of your habitual residence, your
place of work or the place of the alleged infringement. The supervisory
authority responsible for us is:
The State Commissioner for Data Protection and the Right of Access to
Records of the State of Brandenburg (LDA Brandenburg)
Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany
Web: https://www.lda.brandenburg.de
Alternatively, you can contact us at support@nachhilfe-mentor.de for
assistance.
5.9 Automated Decision-Making and Profiling
In the "Nachhilfe Mentor" app, we do not use automated decision-making or
profiling within the meaning of Art. 22 GDPR that produces legal effects
concerning you or similarly significantly affects you.
6. Data Security
We use technical and organisational measures to protect your personal data
against unauthorised access, loss, misuse or alteration. This section
describes how we ensure the security of your data in the "Nachhilfe Mentor"
app, in accordance with Art. 32 GDPR.
6.1 Technical Security Measures
We use state-of-the-art technologies to protect your data:
• 6.1.1 Encryption:
• All data transmissions between your device and our servers are
encrypted via HTTPS with TLS (Transport Layer Security). This protects your
data from eavesdropping or manipulation during transmission.
• Passwords are stored in encrypted form (e.g. via Firebase
Authentication), so that they are not accessible in plain text even in the
event of a data breach.
• 6.1.2 Access controls:
• Access to your data is restricted to authorised systems and services
required for the operation of the app (e.g. the Firebase database).
Unauthorised access is prevented by authentication mechanisms.
• Your user ID (UID) is used to securely separate data in Firestore by
user account.
• 6.1.3 Secure storage:
• Your data (e.g. projects, flashcards, chat messages) is stored in
Firebase's cloud database, which complies with strict security standards,
including encryption at rest.
6.2 Organisational Measures
In addition to technical measures, we also implement organisational steps:
• 6.2.1 Selection of service providers:
• We only work with trusted third-party providers (e.g. Google Firebase,
OpenAI) who commit to complying with the GDPR and implementing appropriate
security measures. These partners are bound to our data protection standards
by data processing agreements (pursuant to Art. 28 GDPR).
• 6.2.2 Training:
• If employees or developers have access to systems that process your
data, they receive regular training in data protection and data security to
minimise risks.
• 6.2.3 Security protocols:
• We have established internal processes to quickly detect, respond to
and remediate security incidents. This includes regular reviews of our
security measures.
6.3 Specific App Features
Your data is protected differently depending on the app feature:
• 6.3.1 Chat function:
• Messages that you send in the chat are stored in Firestore and
protected by Firebase security rules. Only you (via your UID) have access to
your messages.
• Images that you upload are stored in Firebase Storage and are also
encrypted. Access is restricted to authenticated users.
• 6.3.2 File uploads:
• If you upload files (e.g. PDFs), they are stored locally on your device
and, where necessary, securely stored in Firebase Storage. Access is
restricted to your account.
• 6.3.3 Payment data:
• Payment data (e.g. for subscriptions) is not stored by us but processed
directly by Google Play or the Apple App Store, which apply their own
security measures.
• 6.3.4 Local storage:
• The app stores certain data (e.g. downloaded learning content, offline
data or your settings) locally on your device to enable offline use and
improve app performance. This data remains on your device and is not
transmitted to us unless required for synchronisation with your account.
• Access to locally stored data is restricted to your device and subject
to the security mechanisms of your operating system.
6.4 Protection Against Data Loss
• 6.4.1 Backup:
• Your data is regularly backed up by Firebase to prevent data loss.
These backups are also encrypted and accessible only for authorised
purposes.
• 6.4.2 Error reporting:
• We use Firebase Crashlytics to identify technical errors. Only
pseudonymised data (e.g. device information) is transmitted, not direct
personal data.
6.5 Limitations and Risks
Despite all measures, we cannot guarantee absolute protection against cyber
attacks. However, we commit to:
• 6.5.1 Response to security incidents:
• In the event of a data breach, we will inform you without undue delay
in accordance with Art. 33 and 34 GDPR and take measures to minimise the
damage.
• 6.5.2 User responsibility:
• You are responsible for keeping your password secure and not using the
app on insecure devices (e.g. rooted or jailbroken devices).
6.6 Contact for Security Questions
If you have questions about the security of your data or want to report a
security incident, contact us at support@nachhilfe-mentor.de. We respond quickly and
transparently to your concerns.
7. International Data Transfers
Since the "Nachhilfe Mentor" app uses third-party services, some of which
are based outside the European Union (EU) or the European Economic Area
(EEA), your data may be transferred to countries that may offer a different
level of data protection than the EU. This section explains how we ensure
that your data remains protected even in the event of international
transfers, in accordance with the GDPR (in particular Art. 44–50).
7.1 Purposes of Data Transfers
International data transfers take place to ensure the functionality of the
app:
• 7.1.1 Use of external services:
• Firebase (Google LLC): Our authentication, database (Firestore),
storage solutions (Firebase Storage), push notifications and error reporting
(Crashlytics) are provided by Google, a company based in the USA.
• OpenAI: The AI features for generating flashcards, test questions and
summaries are provided by OpenAI, a company based in the USA.
• Google Gemini: Certain additional AI features (e.g. generated learning
paths or content in the AI Mentor chat) are provided via Google's AI service
Gemini, a service based in the USA.
• Google/Apple Sign-In: If you sign in via Google or Apple,
authentication involves communication with Google or Apple servers in the
USA.
• 7.1.2 Payment processing:
• Payment data for in-app purchases is processed by Google Play or the
Apple App Store, which may involve servers in the USA.
7.2 Legal Basis for Transfers
The transfer of your data to third countries is based on the following
grounds:
• 7.2.1 Performance of a contract (Art. 6(1)(b) GDPR):
• The transfer is necessary to provide you with the app's services, e.g.
storing projects in Firestore or generating learning content through our AI
services.
• 7.2.2 Consent (Art. 6(1)(a) GDPR):
• For optional features (e.g. uploading images for text recognition or
using the voice feature), we ask for your express consent before data is
transferred to third countries.
• 7.2.3 Legitimate interest (Art. 6(1)(f) GDPR):
• In exceptional cases, the transfer may serve our legitimate interest
(e.g. error analysis via Crashlytics), provided your rights do not prevail.
7.3 Safeguards for Transfers
To ensure that your data is adequately protected in third countries as well,
we take the following measures in accordance with Art. 46 GDPR:
• 7.3.1 Standard Contractual Clauses (SCC):
• Our third-party providers (Google, OpenAI) have committed to complying
with the EU Commission's Standard Contractual Clauses. These clauses
guarantee a level of data protection comparable to that of the EU.
• 7.3.2 Additional security measures:
• Data is transmitted (TLS) and stored in encrypted form (see Section 6).
Our service providers implement technical and organisational measures to
protect your data (e.g. access controls, regular security reviews).
• 7.3.3 Data processing agreements:
• We have concluded data processing agreements (DPAs) with our service
providers, which ensure that your data is processed only in accordance with
our instructions and the statutory requirements.
7.4 Countries of Data Transfer
Your data may be transferred in particular to the following countries:
• 7.4.1 United States (USA):
• Firebase, Google Gemini, OpenAI and Apple are based in
the USA. Following the invalidation of the Privacy Shield, we rely on
Standard Contractual Clauses and additional security measures to ensure the
protection of your data. Since 2023, the EU-U.S. Data Privacy Framework also
exists; to the extent that our US service providers are certified
accordingly (e.g. Google), transfers may also take place on this basis.
• 7.4.2 Other countries:
• Depending on the server locations of our service providers, data may
also be transferred to other countries in which these providers operate. In
such cases, the same safeguards apply.
7.5 Risks of Data Transfers
Despite our safeguards, risks may exist:
• 7.5.1 Different levels of data protection:
• Countries such as the USA may not offer a level of data protection
fully equivalent to that of the EU. Authorities may request access to your
data under local laws (e.g. the U.S. CLOUD Act).
• 7.5.2 Transparency:
• We hereby inform you of these risks so that you can make an informed
decision about using the app.
7.6 Your Rights in the Event of International Transfers
You retain all rights set out in Section 5 (e.g. access, erasure, data
portability) even in the event of international data transfers:
• 7.6.1 Requesting information:
• You can request information at any time about where your data has been
transferred and which safeguards apply (see 5.1).
• 7.6.2 Objection or withdrawal:
• You can object to the transfer or withdraw your consent by contacting
us (see 5.6 and 5.7). Please note that this may restrict the use of certain
features (e.g. AI-generated content).
7.7 Contact for Questions About Data Transfers
If you would like further information about the international transfer of
your data, please contact us at support@nachhilfe-mentor.de. We are happy to answer
your questions and support you in exercising your rights.
8. Changes to This Policy
We reserve the right to amend this Privacy Policy of the "Nachhilfe Mentor"
app to adapt it to legal, technical or functional changes. This section
explains how and when changes are made and how you will be informed about
them, in accordance with the requirements of the GDPR.
8.1 Reasons for Changes
Changes to this Privacy Policy may be necessary for the following reasons:
• 8.1.1 Legal adjustments:
• If legal requirements change (e.g. new requirements under the GDPR or
BDSG), we adapt the Policy accordingly.
• 8.1.2 Functional updates:
• When new features are introduced in the app (e.g. additional services
such as new AI features or extended payment options), adjustments may be
necessary to reflect the new data processing operations.
• 8.1.3 Technical improvements:
• Changes to our security measures (e.g. new encryption methods) or
third-party providers (e.g. Firebase, Google Gemini) may require an update.
8.2 Change Process
We ensure that changes are transparent and traceable:
• 8.2.1 Review:
• Changes are carefully reviewed to ensure that they comply with data
protection regulations and do not unreasonably affect your rights.
• 8.2.2 Update:
• The revised Privacy Policy is made available in the app, e.g. via a
dedicated area in the settings or as a popup at the next sign-in.
8.3 Notifying Users
You will be informed about changes as follows:
• 8.3.1 Direct notification:
• In the event of material changes (e.g. new data processing purposes or
third-party providers), we will notify you by e-mail to the address provided
during registration or via an in-app notification.
• 8.3.2 Timing of notification:
• You will receive the notification at least 14 days before the changes
take effect, where possible, so that you have sufficient time to review the
new terms.
• 8.3.3 Consent for material changes:
• If the changes require your consent (e.g. new optional features such as
extended analytics), we will actively ask for your consent before these
changes take effect.
8.4 Effect of Changes
• 8.4.1 Validity:
• The new version of the Privacy Policy takes effect on the stated date
and replaces the previous version. The current version is always available
in the app under the settings or on our website.
• 8.4.2 Continued use:
• By continuing to use the app after the changes take effect, you agree
to the updated Privacy Policy, unless express consent is required.
8.5 Your Rights in the Event of Changes
You retain all rights set out in Section 5, even in the event of changes:
• 8.5.1 Objection:
• If you do not agree with the changes, you can object to the processing
(see 5.6) or delete your account (see 5.3).
• 8.5.2 Requesting information:
• You can request information about the changed processing operations at
any time (see 5.1).
8.6 Archiving of Previous Versions
• 8.6.1 Access to old versions:
• Upon request, we will provide you with previous versions of the Privacy
Policy to ensure full transparency. Contact us at
support@nachhilfe-mentor.de.
8.7 Contact for Questions About Changes
If you have questions about changes to this Privacy Policy, please contact
us at support@nachhilfe-mentor.de. We are happy to answer your questions and
support you in exercising your rights.
9. Contact Information
We want to ensure that you can easily reach us with questions, concerns or
to exercise your data protection rights. This section contains all necessary
contact information in accordance with Art. 13 GDPR for the "Nachhilfe
Mentor" app so that you can exercise your rights effectively.
9.1 Controller
The controller within the meaning of the GDPR is the natural or legal person
who decides on the purposes and means of processing personal data. For the
"Nachhilfe Mentor" app, this is:
• 9.1.1 Name and address:
Thümmler AI GmbH,
Leonardo-da-Vinci-Straße 15, 14467 Potsdam, Germany
• 9.1.2 Electronic contact details:
E-mail: support@nachhilfe-mentor.de
Phone: +49 1575 8249014
9.2 Data Protection Contact
We are not legally required to appoint a data protection officer (Art. 37
GDPR, Section 38 BDSG). Your point of contact for all data protection
questions, in particular for exercising your rights (see Section 5) such as
access, rectification or erasure, is:
Thümmler AI GmbH – Data Protection
E-mail: support@nachhilfe-mentor.de
Phone: +49 1575 8249014
9.3 How to Reach Us
We offer you simple ways to get in touch with us:
• 9.3.1 By e-mail:
Send your request to support@nachhilfe-mentor.de. Please use subject lines
such as "Access request" or "Erasure request" to specify your request.
• 9.3.2 By post:
Write to Leonardo-da-Vinci-Straße 15, 14467 Potsdam, Germany. We recommend using
e-mail for faster processing.
• 9.3.3 In-app contact:
In the app, you will find an option in the settings to contact us directly.
This feature uses your e-mail address stored in Firebase Authentication to
enable quick communication.
9.4 Processing Time
• 9.4.1 Response time:
We are committed to responding to your requests within one month in
accordance with Art. 12(3) GDPR. In exceptional cases (e.g. complex
requests), this period may be extended by a further two months, of which we
will inform you in good time.
• 9.4.2 Free of charge:
Exercising your rights is generally free of charge. However, in the case of
manifestly unfounded or excessive requests, we may charge a reasonable fee
or refuse to process the request (Art. 12(5) GDPR).
9.5 Support with Your Concerns
• 9.5.1 Help with your rights:
If you need support in exercising your rights (e.g. information about your
data or deletion of your account), we are happy to help. Contact us with a
short description of your concern.
• 9.5.2 Complaints:
If you are dissatisfied with our response, you can contact a data protection
supervisory authority (see 5.8).
9.6 Responsibility for Third-Party Providers
• 9.6.1 External contact:
For data processing by third-party providers such as Firebase,
OpenAI, Google Gemini or Apple (Sign-In), we refer to their privacy
policies (see Section 4). If you have questions about them, you can still
contact us and we will support you in forwarding your request.
10. Privacy of Children and Minors
Since our app is aimed at school students, we take the protection of minors'
data particularly seriously.
10.1 Minimum Age and Consent
• 10.1.1 Under Art. 8 GDPR in conjunction with German law, children in
Germany may only give valid consent to the processing of their personal data
themselves from the age of 16. For younger users, the consent or
authorisation of the holder of parental responsibility (usually the parents)
is required.
• 10.1.2 Other countries may have different age thresholds (between 13
and 16 within the EU; 13 in the USA under the Children's Online Privacy
Protection Act, COPPA). The age threshold applicable at the child's habitual
place of residence applies.
• 10.1.3 If you are younger than the age threshold applicable in your
country, please use the app only with the consent of your parents or legal
guardians. Parents and guardians may contact us at any time to obtain
information about their child's data or to request its rectification or
erasure.
10.2 Data Minimisation for Minors
We do not collect any information from minor users beyond the data described
in Section 2, do not display personalised advertising, do not sell data of
minors and do not use minors' data for profiling within the meaning of
Art. 22 GDPR.
10.3 Deletion
If we become aware that personal data of a child has been collected without
the required consent of the parents or guardians, we will delete this data
without undue delay. Please contact us in such cases at
support@nachhilfe-mentor.de.
11. Supplementary Information for Users Outside Germany
Our app and website can be used worldwide. We apply the GDPR's standards of
protection to all users worldwide. In addition, to the extent that the
respective law applies to you, the following applies.
11.1 European Union / European Economic Area
For users in the EU and the EEA, this Privacy Policy applies directly on the
basis of the GDPR. You may contact the data protection supervisory authority
of your member state (see 5.8).
11.2 United Kingdom (UK GDPR)
For users in the United Kingdom, the UK GDPR and the Data Protection Act
2018 apply. You have essentially the same rights as described in Section 5.
Complaints may be addressed to the Information Commissioner's Office (ICO),
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, https://ico.org.uk.
We safeguard data transfers from the UK using the mechanisms recognised by
the UK government (e.g. the UK Addendum to the EU Standard Contractual
Clauses or the UK International Data Transfer Agreement, IDTA).
11.3 Switzerland (revFADP)
For users in Switzerland, the revised Swiss Federal Act on Data Protection
(revFADP/revDSG) applies. The controller within the meaning of the revFADP
is the entity named in Section 9. You have the rights to access,
rectification, erasure, data release and objection. The competent
supervisory authority is the Federal Data Protection and Information
Commissioner (FDPIC), https://www.edoeb.admin.ch. We safeguard data
transfers to countries without an adequate level of data protection through
guarantees recognised by Switzerland.
11.4 United States (US State Privacy Laws)
For users in US states with comprehensive privacy laws (e.g. California –
CCPA/CPRA, Colorado, Connecticut, Virginia, Utah, Texas and others), the
following applies:
• 11.4.1 We do not "sell" personal information and do not "share"
personal information for cross-context behavioural advertising within the
meaning of the CPRA.
• 11.4.2 Depending on your state, you have the right to know, the right
to delete, the right to correct, the right to data portability and the right
to non-discrimination when exercising your rights.
• 11.4.3 The categories of data we collect, the purposes and the
recipients can be found in Sections 2 to 4. We do not collect "sensitive
personal information" within the meaning of the CPRA unless you voluntarily
provide such information in your content.
• 11.4.4 To exercise your rights, contact us at
support@nachhilfe-mentor.de. You may designate an authorized agent; in this
case, we may require proof of authorisation and identity verification.
11.5 Brazil (LGPD)
For users in Brazil, the Lei Geral de Proteção de Dados (LGPD, Law No.
13.709/2018) applies. Processing is based on the legal bases provided for in
Art. 7 LGPD (in particular performance of a contract, consent and legitimate
interest). You have the rights under Art. 18 LGPD (including confirmation,
access, rectification, anonymisation, erasure, data portability, withdrawal
of consent). Complaints may be addressed to the Autoridade Nacional de
Proteção de Dados (ANPD). The contact person (encarregado) is the person
named in Section 9.2.
11.6 Canada (PIPEDA)
For users in Canada, the Personal Information Protection and Electronic
Documents Act (PIPEDA) and, where applicable, provincial law apply. We
process personal information only with your knowledge and – where required –
consent, and only for appropriate purposes. You have the right to access
your data and have it corrected. Complaints may be addressed to the Office
of the Privacy Commissioner of Canada (OPC), https://www.priv.gc.ca.
11.7 Australia (Privacy Act 1988)
For users in Australia, we observe the Australian Privacy Principles (APPs).
You have the right to access and correct your data and may lodge complaints
with the Office of the Australian Information Commissioner (OAIC),
https://www.oaic.gov.au.
11.8 Other Countries
Even if your country is not expressly mentioned above, we apply the
standards of protection described in this Policy (at GDPR level) to your
data. To the extent that you are entitled to further or different rights
under your local law, we respect them; please contact us at
support@nachhilfe-mentor.de. Should individual provisions of this Policy be
incompatible with mandatory local law, the mandatory local law prevails.
12. Language Versions
This Privacy Policy is provided in German, English and French. The German
version is available at
https://nachhilfe-mentor.de/datenschutzerklaerung.html, the French version
at https://nachhilfe-mentor.de/politique-de-confidentialite.html. In case
of discrepancies or questions of interpretation, the German version
prevails, unless mandatory law provides otherwise.
(Version of this Privacy Policy: July 2026)