PRIVACY POLICY - nuuvo App

Last updated October 05, 2026

This Privacy Notice applies only to the nuuvo app for iOS. Our website nuuvoapp.com has its own privacy policy. This Privacy Notice for nuuvo, operated by nuuvo app – Lea Gerstenberger und Marcel Pfitzner GbR (see the section 'HOW CAN YOU CONTACT US ABOUT THIS NOTICE?' below) ('we', 'us', or 'our'), describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our app ('Services'), including when you:

• download and use the nuuvo app to collect stamps and rewards at local businesses
• list and manage your business in the app as a business owner
• take part in a beta test of the app via Apple TestFlight

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@nuuvoapp.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find out more details about any of these topics in the full sections below, using the table of contents.

What personal information do we process? When you use the app, we process your account data (display name, email address), an optional profile picture, your stamps and rewards, data and photos of businesses listed in the app, and technical data. Learn more in section 1.

Do we process any sensitive personal information? Some information may be considered 'special' or 'sensitive' in certain jurisdictions, for example your racial or ethnic origins, sexual orientation and religious beliefs. We do not process sensitive personal information.

Do we collect any information from third parties? We only receive information from Apple about the use of test versions of the app if you take part in a beta test. Otherwise, we do not collect any information from third parties.

How do we process your information? We process your information to provide the app and the loyalty programme, to let you reset your password, to keep the app secure and prevent misuse, to give businesses anonymous statistics, and to comply with law. Learn more in section 2.

In what situations and with which parties do we share personal information? We share information with a small number of service providers. Your display name and profile picture are visible to other registered users. Businesses never see your name or email address when they give you a stamp. Learn more in section 4.

How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. Learn more in section 7.

What are your rights? You have rights to access, rectification, erasure, restriction, data portability and objection. Learn more in section 9.

How do you exercise your rights? The easiest way is to email us at info@nuuvoapp.com. You can also delete your account yourself at any time in the app.

What we do not do: no advertising, no advertising trackers, no third-party analytics, no push notifications, no sale of personal data.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?

2. HOW DO WE PROCESS YOUR INFORMATION?

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

5. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

6. HOW LONG DO WE KEEP YOUR INFORMATION?

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

8. DO WE COLLECT INFORMATION FROM MINORS?

9. WHAT ARE YOUR PRIVACY RIGHTS?

10. WHICH DEVICE PERMISSIONS DOES THE APP USE?

11. DO WE MAKE UPDATES TO THIS NOTICE?

12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us when you use the app.

We collect personal information that you voluntarily provide to us when you create an account, add a profile picture, collect stamps, list a business, or contact us by email.

Personal Information Provided by You. The personal information we collect may include the following:

• Account data: display name, email address and password. Your password is processed to log you in and is stored by our authentication service only as a secure cryptographic hash; we never store passwords in plain text.
• Profile picture (optional): a photo you add to your profile, taken with the camera or chosen from your photo library
• Business data (business owners only): name, address, map location, category, description and opening hours of the business, and the rewards you set up
• Business photos (business owners only): photos of the business, taken with the camera or chosen from your photo library
• Communication data: emails you send us

Sensitive Information. We do not process sensitive information.

Information automatically collected

In Short: Some information is generated automatically when you use the app.

• Loyalty data. How many stamps you have collected at which business, when you received them, which rewards you have redeemed, and single-use reward codes.
• Guest account data. If you use the app without signing up, a random account ID linked to your device and no more than one stamp.
• Log and Device Data. IP address, device type, operating system, app version, time of access and error reports.
• Email delivery data. Whether the emails we send you (confirmation of your email address when you sign up, and password reset emails) were delivered.

Information from beta testing

If you take part in a beta test via Apple TestFlight, what we receive depends on how you join. If we invite you directly by email, we receive your name and email address for the invitation. If you join through a public TestFlight link, Apple does not share your name or email address with us. In both cases, Apple passes on usage data of the test version (such as number of sessions, device model and operating system), crash reports, and any feedback, screenshots or comments you choose to send.

We do not collect payment data, contacts or a location history. Photos are only uploaded if you add them yourself as a profile picture or business photo. How the app uses your location is described in section 10.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide the app and the loyalty programme, to keep the app secure, and to comply with law.

We process your personal information for a variety of reasons, depending on how you use the app, including:

• To create and manage your account. We register you, log you in and provide the functions of the app. (Retention period: until you delete your account)
• To let you use the app without an account. If you show your stamp code without an account, we create a guest account to record one stamp. If you sign up later, the stamp is moved to your new account. (Retention period: until you convert the guest account into a full account, or until it is deleted at your request)
• To record stamps and redeem rewards. We record stamps on our server, show your stamp cards, and let you redeem rewards with reward codes that are valid for 15 minutes and can only be used once. (Retention period: until you delete your account)
• To list and manage businesses. We show businesses publicly in the app and let business owners manage rewards and give out stamps. (Retention period: until the business or the account is deleted)
• To show profile pictures and business photos. We store the profile picture you add and the photos business owners add to their business, and show them in the app. (Retention period: until you remove the photo, or until your account or the business is deleted)
• To send account emails. When you sign up, we send you an email to confirm your email address. If you request a new password, we send you an email with a reset link. We do not send newsletters or marketing emails. (Retention period of delivery data: 30 days)
• To respond to user inquiries and offer support. We answer emails you send us and help with any problems. (Retention period: 12 months after the inquiry has been resolved)
• To provide anonymous statistics to businesses. Business owners see summary statistics, such as how many stamps were given out in a week. These statistics do not identify you, and businesses do not see your name, email address or other personal details when they give you a stamp. (Statistics are anonymous)
• To keep the app secure and prevent misuse. We use technical and loyalty data to prevent misuse, such as fake stamps or misuse of guest accounts, and to fix errors. (Retention period of logs: 1 day, unless needed to investigate a security incident)
• To run beta tests. We use the data described above to invite testers and to find and fix errors before release. (Retention period: until the end of the beta test or until you leave, at the latest 6 months after the public release; crash reports and feedback until the error has been fixed)
• To comply with legal obligations. For example, to keep records required by tax law. (Retention period: as required by law)

We do not make decisions about you based solely on automated processing, including profiling.

Do you have to provide your data? To create an account, you need to give us a display name, email address and password. Without them, you can only use the app to a limited extent as a guest. A profile picture is optional. There is no legal obligation to provide personal data.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like to comply with laws, to provide you with services under our contract with you, or to fulfil our legitimate interests.

The General Data Protection Regulation (GDPR) requires us to explain the valid legal bases we rely on in order to process your personal information. We rely on the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR). We process your personal information where it is necessary to fulfil our contract with you, i.e. our terms of use. We rely on this basis to create and manage your account and guest account, record stamps and redeem rewards, list and manage businesses, store and show profile pictures and business photos, send account emails, answer questions about your use of the app, and run beta tests you have signed up for.
• Legitimate Interests (Art. 6(1)(f) GDPR). We process your information where it is reasonably necessary to achieve our legitimate interests and those interests do not outweigh your interests and fundamental rights and freedoms. We rely on this basis to keep the app secure and prevent misuse, to provide businesses with anonymous statistics about their loyalty programme, to answer general inquiries, and to analyse crash reports from beta tests.
• Legal Obligations (Art. 6(1)(c) GDPR). We process your information where it is necessary to comply with our legal obligations, such as tax record-keeping or cooperating with authorities.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information with a small number of service providers and in the specific situations described in this section.

Vendors, Consultants, and Other Third-Party Service Providers. We share your data with third-party service providers who perform services for us or on our behalf and require access to such information to do that work. We have data processing agreements in place with them (Art. 28 GDPR). This means that they cannot do anything with your personal information unless we have instructed them to do it, and they will not share your personal information with any organisation apart from us.

The third parties we share personal information with are as follows:

• Database, user accounts and login: Supabase
• Sending of account emails (email confirmation and password reset): Brevo (Sendinblue SAS)
• Email hosting and business communications: Ionos
• Website hosting, including the page that forwards password reset links to the app: Cloudflare

Apple. The app is distributed through the Apple App Store and, for beta testing, through TestFlight. Apple processes data related to downloading and installing the app, and to beta testing, under its own responsibility and privacy policy. The map in the app is shown using Apple Maps. When you use the map, search for an address or convert a position into an address, Apple also processes the map, search and geocoding requests needed for this through Apple Maps and its location services.

We also share your personal information in the following situations:

• Other users. Your display name and profile picture are visible to other registered users.
• Businesses. Businesses only see anonymous statistics. Information about businesses listed in the app, including their photos, is public.
• Authorities. We only pass on personal information to authorities if we are legally required to do so.
• Change of legal form. nuuvo is currently operated by nuuvo app – Lea Gerstenberger und Marcel Pfitzner GbR. If we convert or transfer our business to a company with a different legal form (for example a UG, GmbH or Lda.), we may transfer your personal information to that company. We will inform you of any such transfer by updating this Privacy Notice, and the company will continue to process your information in accordance with it.

5. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

We do not operate our own servers. Your information is processed on the servers of the service providers listed in section 4: Supabase primarily processes the app's data in the United Kingdom (region eu-west-2, London); Brevo stores its primary service data within the European Union; Ionos hosts our email in Germany; Cloudflare delivers our website through its global network of data centres, which includes locations outside the EEA.

Supabase stores and primarily processes this information in the region we have selected, the United Kingdom. The United Kingdom is not part of the EU or the EEA; transfers to the United Kingdom are based on an adequacy decision of the European Commission pursuant to Article 45 GDPR, which confirms that the United Kingdom ensures an adequate level of protection for personal data. Our contractual partner, Supabase Pte. Ltd., is based in Singapore, for which there is no adequacy decision. In the course of support, operations and the use of sub-processors, information may also be transferred to or accessed from other countries outside the selected region. For such transfers, Supabase provides appropriate safeguards, including the European Commission's Standard Contractual Clauses.

Adequacy decisions, EU–US Data Privacy Framework and Standard Contractual Clauses. Where information is transferred to a country outside the European Economic Area, we protect it on the basis of an adequacy decision of the European Commission (Art. 45 GDPR), as for the United Kingdom, because the provider is certified under the EU–US Data Privacy Framework (Art. 45 GDPR), or by using the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). These require all recipients to protect personal information originating from the EEA in accordance with European data protection laws. You can obtain a copy of the applicable safeguards, including the Standard Contractual Clauses, or further information about them by contacting us at info@nuuvoapp.com.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). See section 2 for our retention periods by purpose.

You can delete your account at any time in the app (see section 13). When we have no ongoing legitimate need to process your personal information, we will either delete or anonymise it, or, if this is not possible, we will securely store it and isolate it from any further processing until deletion is possible. We may keep anonymous statistics that can no longer be linked to you.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate technical and organisational security measures designed to protect the personal information we process (Art. 32 GDPR). These include encrypted transmission, storing passwords only in hashed form, database access rules that ensure each user can only access their own data, and processing stamps and reward redemptions on our server. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorised third parties will never be able to defeat our security. If a data breach occurs that is likely to put your rights at risk, we will inform the data protection authority and, where required, you.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from children under 16 years of age.

The app is not intended for children under 16 years of age. We do not knowingly collect personal information from children below this age. If we learn that personal information from users under 16 years of age has been collected, we will promptly delete it. If you become aware of any data we may have collected from children under age 16, please contact us at info@nuuvoapp.com.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Under the GDPR, you have rights that allow you greater access to and control over your personal information.

You have the right (i) to request access and obtain a copy of your personal information (Art. 15 GDPR), (ii) to request rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR), (iii) to restrict the processing of your personal information (Art. 18 GDPR), (iv) to data portability (Art. 20 GDPR), and (v) not to be subject to automated decision-making (Art. 22 GDPR). You can make such a request by contacting us using the contact details in section 12. We will respond within one month, and exercising your rights is free of charge. We may ask you to confirm your identity, for example by writing from the email address linked to your account.

Right to object (Art. 21 GDPR)

Where we process your personal information on the basis of our legitimate interests, you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process your information for this purpose, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to complain (Art. 77 GDPR). If you believe we are unlawfully processing your personal information, you have the right to complain to a data protection authority. We are based in Germany. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany. You can also complain to the data protection authority in the EU country where you live or work; in Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. We would appreciate it if you contacted us first, so we can try to resolve the matter.

If you have questions or comments about your privacy rights, you may email us at info@nuuvoapp.com.

10. WHICH DEVICE PERMISSIONS DOES THE APP USE?

In Short: The app only asks for access to functions of your device when a feature needs it.

You can grant or withdraw these permissions at any time in your device settings:

• Camera: used by business owners to scan stamp codes, and to take a profile picture or photos of a business. When scanning, images are processed on the device and are neither stored nor sent anywhere. Photos you take for your profile or a business are uploaded and stored (see section 2).
• Photo library: used to choose a profile picture or photos of a business. Only the photos you select are uploaded and stored. On iOS, the app uses the system photo picker and does not get access to the rest of your library.
• Location: used to show your position on the map and, for business owners, to set the location of a business. Your position on the map is processed on your device. When you create or edit a business, the coordinates you choose are stored as the business location. Address search and converting a position into an address use Apple's location services, which receive the address or position for this purpose.

The app does not send push notifications and does not use advertising identifiers or tracking.

11. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this Privacy Notice. If we make material changes, we will let you know in the app before they take effect.

12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at info@nuuvoapp.com or contact us by post at:

nuuvo app – Lea Gerstenberger und Marcel Pfitzner GbR
Represented by: Lea Gerstenberger, Marcel Pfitzner
c/o Lea Gerstenberger
Rittersbachstr. 15a
77815 Bühl
Germany

We are not required by law to appoint a data protection officer and have not done so. The processing of personal information is governed by the GDPR and the German Federal Data Protection Act (BDSG).

13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You can change your display name and profile picture yourself in the app. You can delete your account at any time in the app under Profile. Before you confirm, the app shows you which data will be deleted. Deleting your account permanently removes your profile, stamp cards, reward history and check-ins. Business owners can delete their business in the same way, which also removes its rewards and stamp records.

To request access to your data, a copy of it, or any other change, please email us at info@nuuvoapp.com.