Privacy policy

This English version is provided for convenience. In case of any discrepancy, the German version prevails.

Protecting your personal data matters to us. This privacy policy explains how we collect, use and protect your data when you use Noola.

Noola is a platform for organising contacts, communication and follow-ups, in particular in connection with messaging services such as WhatsApp.

Controller within the meaning of the GDPR

For data protection enquiries, please contact the email address above.

What data we collect

We collect the following information when you use Noola:

• Personal data such as name, email address and phone number
• Contact data that you store in the platform
• Communication data, e.g. message content, timestamps and interactions
• Usage data, e.g. activity within the platform
• Technical data, e.g. IP address, browser type and device data

How we use your data

We use your data to:

• provide and operate the platform
• structure your communication and follow-ups
• improve features and the user experience
• enable support and troubleshooting
• inform you about relevant updates or changes

Legal bases for processing

Processing is based on:

• Art. 6(1)(b) GDPR (performance of a contract)
• Art. 6(1)(f) GDPR (legitimate interest)
• Art. 6(1)(a) GDPR (consent)

Disclosure of data

We do not sell your data.

We only share data with:

• technical service providers that enable the operation of the platform (e.g. hosting, databases)
• third-party integrations (e.g. WhatsApp) if you actively use them
• authorities, where we are legally obliged to do so

Account deletion

You can delete your account and all associated personal data at any time directly in the app. To do so, go to: Settings → Account → Delete account.

After confirmation, your data is deleted completely unless statutory retention obligations prevent this (e.g. tax requirements for transaction data). In that case, the data is deleted automatically once the statutory period has expired.

Alternatively, you can request deletion by email to [email protected].

Service providers (processors)

To provide our platform, we use:

• DigitalOcean LLC (USA) – hosting of the application and related data. The server location is Frankfurt am Main (EU). Transfers to the USA are based on standard contractual clauses (Art. 46(2)(c) GDPR). More information: digitalocean.com/legal/privacy-policy.
• MongoDB, Inc. (USA/EU) – database infrastructure for storing user data. Depending on the configuration, processing takes place in the EU; transfers to the USA are secured by standard contractual clauses. More information: mongodb.com/legal/privacy-policy.
• Redis / Valkey – in-memory data store for caching and session data. Processing takes place exclusively on the hosting infrastructure named above and does not leave it independently.
• Brevo (Sendinblue SAS, EU) – sending emails and optional newsletter functions. Brevo processes email addresses and sending metadata as a processor under Art. 28 GDPR. This service is only used if you have activated such communication. More information: brevo.com/legal/privacypolicy.
• Firebase (Google LLC) – push notifications and app analytics. Processing in the USA based on standard contractual clauses (Art. 46(2)(c) GDPR).
• Sentry (Functional Software, Inc.) – error monitoring and crash reports for the technical quality assurance of the app. Processing in the USA based on standard contractual clauses.
• Apple Push Notification Service (APNs, Apple Inc.) – delivery of push notifications on iOS devices. For this, Apple receives a device-bound push token that does not allow direct identification. More information: apple.com/legal/privacy.

Unless stated otherwise, these providers process data on our behalf in accordance with Art. 28 GDPR.

Purchases via the App Store and Google Play

Subscriptions for Base and Premium are concluded exclusively as in-app purchases via the Apple App Store (Apple Distribution International Ltd., Ireland) or Google Play (Google Ireland Ltd., Ireland). Payment processing, renewal, cancellation and refunds are handled by the respective store as an independent controller under its own privacy policy. We do not receive any payment data, only the purchase information needed for activation (e.g. product, transaction ID, term and status of the subscription). The legal basis is Art. 6(1)(b) GDPR.

More information: apple.com/legal/privacy and policies.google.com/privacy.

WhatsApp integration

In the Premium plan and during the trial, Noola can be connected to WhatsApp Business (Meta). The connection is voluntary and can be ended at any time. No connection is established in the Free and Base plans; there, Noola merely opens WhatsApp via a direct link without transferring message content.

The following data may be processed:

• phone numbers
• message content
• timestamps and communication history

This data is processed via Meta’s infrastructure.

WhatsApp’s privacy policy also applies: whatsapp.com/legal/privacy-policy

Noola community on WhatsApp and webinars

Via our website you can voluntarily join our community on WhatsApp. In doing so, Meta Platforms Ireland Ltd processes your phone number, your WhatsApp profile name and, where applicable, your profile picture; this information is visible to us as administrators. We use the community to share practical tips, product news and links to live webinars and their recordings. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by leaving the community. We do not transfer this data into our own systems.

The webinars take place via Zoom (Zoom Communications, Inc., USA) or Google Meet (Google Ireland Ltd., Ireland). Their privacy policies also apply when you take part: zoom.com/trust/privacy and policies.google.com/privacy.

Links to social networks

Our website contains simple links to our profiles on Instagram and Facebook (Meta Platforms Ireland Ltd). No plugins are embedded; data is only transferred when you click a link and visit the respective platform.

International data transfers

Some providers process data outside the EU (e.g. USA).

We ensure that:

• standard contractual clauses (SCCs) are in place
• an adequate level of data protection is guaranteed

Cookies and consent

Without your consent our website sets no cookies and loads no content from third-party servers. We store your choice in the cookie banner in your browser's local storage (localStorage) so the banner does not reappear on every visit; we also remember there if you close the notice about the German or English version. This storage is strictly necessary for the function you requested (Section 25(2) no. 2 TDDDG). You can change or withdraw your consent at any time via “Cookie settings” in the footer; withdrawal applies for the future.

Meta Pixel

Only if you agree in the cookie banner do we load the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (“Meta”). The pixel sets cookies (e.g. _fbp, _fbc) and transmits information about your visit to Meta: pages viewed, clicks on “Try” with the selected plan and the origin of the click, start and result of the quiz including the recommendation, video views and joining the community, as well as IP address and browser and device information. We use this data to measure the effectiveness of our advertising on Facebook and Instagram and to build advertising audiences. Meta may link the data to your Facebook or Instagram account and use it for its own purposes.

We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing. Meta may transfer data to the USA; Meta is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, no connection to Meta is made. More information: facebook.com/privacy/policy.

Website hosting

The website noola.one is hosted by DigitalOcean, LLC (USA) via the DigitalOcean App Platform and delivered through its content delivery network. A data processing agreement is in place with DigitalOcean; for transfers to the USA we rely on the EU-US Data Privacy Framework or the EU standard contractual clauses (Art. 45, 46 GDPR). When the website is accessed, technically necessary data (e.g. IP address, time, page accessed, browser type) is processed in server log files in order to provide the website securely and reliably (Art. 6(1)(f) GDPR). Fonts are loaded locally from our server; no connection to Google servers is made.

Data security

We use technical and organisational measures:

• HTTPS encryption
• access controls
• secure infrastructure

Storage period

Data is only stored for as long as:

• it is necessary for use
• statutory obligations exist

Your rights

You have the right to:

• access
• rectification
• erasure
• restriction
• objection
• data portability
• lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority:

Office of the Commissioner for Personal Data Protection (Cyprus)

Data processing agreement

If you use Noola for business purposes, we process data on your behalf.

A data processing agreement can be provided on request.

Changes to this privacy policy

We may update this privacy policy.

We will inform you of material changes.

Contact

If you have questions about data protection, you can reach us at:

[email protected]