Privacy Notice for Nuance

1. Controller

The controller for Nuance is:

Tizian-Frank Ramspoth trading as TR Studio Lab Marianne-Cohn-Straße 6 68167 Mannheim Germany

Email: trstudio.lab@gmail.com

2. Scope of this Privacy Notice

This Privacy Notice explains how personal data is processed when you use the mobile application Nuance.

Nuance is a relationship-aware communication coach. It helps you create authentic and constructive drafts for opening messages, replies, follow-up messages and revisions, and it helps you reflect on communication patterns.

Nuance does not send messages automatically. You decide whether to use, edit, share or send any suggestion.

3. Data we process

3.1 Account and authentication data

When you register and sign in, we may process:

• your email address;
• an internal user ID;
• the time your account was created;
• authentication and session information;
• the status of your legal acknowledgements and acceptances;
• your selected language;
• local account and application settings.

This data is necessary to provide your account, secure access and associate your content with the correct account.

3.2 Relationship and communication data

Depending on the features you use, we may process:

• relationship names and relationship types;
• relationship background information;
• boundaries and communication preferences;
• long-term communication goals;
• how you would like to be perceived by the other person;
• preferred communication style;
• emotional triggers and recurring patterns;
• conversation titles and summaries;
• messages entered or imported manually;
• copied message snippets;
• uploaded screenshots or attachments;
• current emotional state;
• desired tone;
• desired conversation outcome;
• existing or edited drafts;
• feedback on drafts;
• generated reply alternatives;
• communication examples;
• Pattern Review suggestions and confirmed relationship context.

This data is processed only when you enter, import or upload it, or when you expressly use a Nuance feature that generates it.

3.3 Data about other people

Imported messages, screenshots, attachments and relationship descriptions may contain personal data about other people.

Please provide only data that is necessary for your purpose and that you are legally entitled to process. Remove or anonymise names, telephone numbers and other identifying information where they are not needed.

Nuance does not ask you to provide special categories of personal data. In particular, do not enter unnecessary health information, religious or political beliefs, sexual-orientation information or other highly sensitive data.

You may provide confidential or highly sensitive information about another person only where you are legally entitled to do so. Nuance does not currently offer a separate consent mechanism for processing special categories of personal data.

Nuance is not intended for medical, therapeutic, legal, regulatory or other high-impact decisions.

3.4 Technical, security and usage data

To provide Nuance securely and reliably, we may process:

• request and operation IDs;
• times and statuses of AI operations;
• technical error and timeout information;
• usage counters;
• rate-limit information;
• information about active, completed or failed AI requests;
• plan and entitlement information;
• credit balances;
• credit reservations, consumption and releases;
• metadata required for security, abuse prevention and reliability;
• the versions and timestamps of legal acknowledgements.

Metadata used for credits, abuse prevention and technical reliability is designed not to contain complete messages, relationship descriptions, screenshots, prompts or complete AI responses.

3.5 Data stored locally on your device

Nuance stores certain technically necessary information locally on your device, including:

• your authentication session;
• your selected language;
• theme settings;
• tutorial and notice status;
• account-related acknowledgements used to avoid unnecessarily repeating notices.

This local data supports the application features you request. Account-specific Nuance data stored locally is removed after confirmed account deletion. A general theme preference may remain on the device.

4. Purposes and legal bases

4.1 Providing the account and application functions

We process personal data to:

• register and authenticate users;
• store relationships and conversations;
• generate, store and revise drafts;
• perform Pattern Reviews;
• process text and screenshot imports;
• provide file and attachment features;
• administer credits and entitlements;
• provide account deletion;
• perform our contractual obligations.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide the service you request.

4.2 AI-assisted processing

When you expressly initiate an AI feature, selected information required for that operation is processed to produce the requested reply, extraction, revision or pattern analysis.

The legal basis is generally Article 6(1)(b) GDPR.

Nuance does not automatically transmit all stored information. Only application-selected and limited context is transmitted for a particular operation.

4.3 Security, abuse prevention and reliability

We process limited technical and operational metadata to:

• prevent unauthorised access;
• enforce rate limits and concurrent-request limits;
• detect abuse and fraud;
• avoid incorrect or duplicate credit charges;
• finalise failed operations correctly;
• investigate security incidents;
• maintain application reliability;
• enable secure and complete account deletion.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests include providing Nuance securely, reliably and with controlled resource use, and protecting users and systems.

4.4 Legal obligations and legal claims

Where necessary, we process data to:

• comply with legal obligations;
• handle data-protection requests;
• process account-deletion requests;
• establish, exercise or defend legal claims.

The legal bases are Article 6(1)(c) GDPR and, where applicable, Article 6(1)(f) GDPR.

5. AI processing by OpenAI

Nuance uses the OpenAI API for AI-assisted functions.

Depending on the feature, the following may be transmitted to OpenAI:

• selected relationship information;
• Coach context;
• relevant conversation messages;
• desired tone and desired outcome;
• existing drafts;
• feedback on drafts;
• selected screenshots or extracted image content;
• technical output formats;
• trusted Nuance instructions.

Nuance does not necessarily transmit the entire stored relationship or conversation history.

Our OpenAI Responses API requests use store: false. This means that we do not request persistent Responses API application-state storage for those requests.

OpenAI may nevertheless process content and technical metadata in abuse-monitoring and security logs. Under OpenAI’s standard controls, such logs may generally be retained for up to 30 days, unless different approved retention controls apply or longer retention is legally required.

According to OpenAI, API data is not used to train or improve OpenAI models by default unless the customer expressly opts in.

For customers based in the European Economic Area, OpenAI Ireland Ltd. is generally the relevant contracting OpenAI entity under the current contractual terms. OpenAI may use affiliates and subprocessors in several countries.

6. Other recipients and service providers

6.1 Supabase

We use Supabase for:

• authentication;
• the PostgreSQL database;
• access controls and Row Level Security;
• private file storage;
• Edge Functions;
• server-side business, security and deletion logic.

The primary project region is West Europe, Ireland.

The publishable key used in the mobile application is a public, low-privilege project key. Personal data is protected through authentication, Row Level Security and server-side authorisation. Service-role and secret keys are used only on the server.

6.2 Expo Application Services

Nuance uses Expo Application Services for:

• creating application builds;
• technical project infrastructure;
• potentially delivering compatible application updates.

Expo may process technical data such as:

• IP addresses;
• operating-system and device information;
• randomised technical tokens;
• error and performance information;
• information concerning application-update retrieval.

6.3 Google Play

When you install or update Nuance through Google Play, Google processes data under its own responsibility and privacy terms.

This may include:

• device information;
• installation and update data;
• store and account data;
• security and diagnostics data;
• technical usage data.

Nuance does not currently use Google Sign-In or Google Play Billing.

6.4 Google Forms for external account-deletion requests

A Google Form made available through the Google Play listing may be used for external account-deletion requests.

The form may collect:

• the email address used for your Nuance account;
• your preferred language;
• confirmations about account ownership and permanent deletion;
• your express deletion request;
• optional additional information.

Do not provide passwords, conversation content, screenshots, relationship information or unnecessary sensitive data through the form.

TR Studio Lab uses the submitted information only to:

• review the request;
• verify your identity;
• carry out account deletion;
• resolve questions;
• document the process;
• confirm completion.

We may contact the email address stored for your Nuance account to verify the request.

Google may process technical connection, device and usage data under its own privacy terms when Google Forms is used.

Form responses are retained only as long as necessary to process, verify and document the request or comply with legal obligations.

6.5 Email communications

When you contact us by email, we process:

• your email address;
• your message;
• other contact information you voluntarily provide.

We process this data to respond to your request.

7. Transfers outside the EEA

Some service providers or subprocessors may process personal data outside the European Economic Area.

Where required, such transfers rely on:

• an adequacy decision;
• Standard Contractual Clauses adopted by the European Commission;
• supplementary technical or organisational safeguards;
• another transfer mechanism permitted under Chapter V GDPR.

We cannot guarantee that all processing takes place exclusively in Germany.

8. Retention

We retain personal data only as long as necessary for the purposes described in this Privacy Notice.

In general:

• account and profile data is retained until account deletion;
• relationships, conversations, messages, attachments and Coach data are retained until you delete them or delete the account;
• generated replies and related operation data are retained until they or their parent conversations or relationships are deleted;
• Pattern Review information is retained where you apply or confirm it as relationship context;
• credit, entitlement, security and usage metadata is generally retained until account deletion or while required for security, abuse prevention, correct operation or legal claims;
• legal acknowledgements are retained while the account exists and while documentation of the accepted version is required;
• external deletion-request information is retained until the request is completed and afterwards only while required for documentation or legal obligations;
• account-specific local settings are removed after confirmed account deletion;
• data held by service providers is also subject to their technical and contractual retention cycles;
• data may remain temporarily in technical backups or security logs until overwritten or deleted in accordance with the relevant retention cycle;
• OpenAI abuse-monitoring logs may generally be retained for up to 30 days.

9. Account deletion

You can permanently delete your Nuance account inside the application:

Relationships → Account and data → Delete account

This deletes the authentication account and associated Nuance application data, including:

• relationships;
• conversations;
• messages;
• attachments and stored files;
• generated replies;
• Coach information;
• Pattern Review information;
• relationship context;
• account-related credit and entitlement data;
• application-related usage and security metadata;
• legal acknowledgement records.

Deletion cannot be undone.

A Google Form made available through the Google Play listing may be used for external account-deletion requests.

Alternatively, contact:

trstudio.lab@gmail.com

Submitting the form does not automatically delete your account. We may first verify that you own the identified Nuance account. Once verified, we process the request manually.

Certain technical security logs, provider records or backup copies may be deleted later in accordance with the retention cycles described above.

10. Image selection, camera, microphone and sharing

Nuance can process existing images or files from your device library after you expressly select them.

Nuance does not currently request camera or microphone permission, take photographs or record audio.

Dictation provided by your keyboard is operated by the keyboard or operating-system provider rather than by Nuance.

When you share a message, Nuance opens the device’s native sharing interface. The destination application you select then processes the shared text under its own responsibility.

Nuance cannot reliably determine whether the text was actually sent or delivered through the destination application.

11. Automated decision-making

Nuance does not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

AI-generated drafts and Pattern Review suggestions are non-binding and editable. You may change, reject or ignore them.

12. Security

We use appropriate technical and organisational safeguards, including:

• authentication;
• user-specific access controls;
• Row Level Security;
• private file storage;
• encrypted transmission;
• privileged server-side functions;
• separation of public and secret keys;
• input and size limits;
• rate limits;
• credit reservations and secure releases;
• duplicate-request safeguards;
• server-side account deletion;
• blocking new writes while account deletion is in progress.

No internet-based system can guarantee absolute security.

13. Your rights

Subject to applicable legal requirements, you may have the right to:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent with effect for the future;
• lodge a complaint with a supervisory authority.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact:

trstudio.lab@gmail.com

14. Right to complain

You may lodge a complaint with a data-protection supervisory authority.

The authority generally responsible for the controller’s place of establishment is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg Heilbronner Straße 35 70191 Stuttgart Germany

Email: poststelle@lfdi.bwl.de

You may also contact the supervisory authority of your habitual residence, workplace or the place of the alleged infringement.

15. Children

Nuance is intended only for people aged 18 or older.

We do not knowingly collect account data from people under 18. Contact trstudio.lab@gmail.com if you believe that a minor has created an account.

16. Changes to this Privacy Notice

We may update this Privacy Notice when:

• Nuance changes;
• our service providers change;
• our processing changes;
• legal requirements change.

The current version and last-updated date are shown at the beginning of this Notice.

Where a new version requires renewed acknowledgement, Nuance will inform you before you continue using the affected features.