Privacy policy
Last updated: October 28, 2026
This English version is provided for convenience. The German version is authoritative.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Nickle AI – Oreshin, Platon und Scheffler, Daniel GbR
Ludwig-Erhard-Straße 10
34131 Kassel
Germany
Email: info@nickle.ai
This privacy policy covers our website nickle.ai, our business contacts and job applications. How we handle personal data that we process on behalf of our customers is governed by our data processing agreement (see section 6).
We have not appointed a data protection officer, as the statutory requirements for doing so are not met.
2. Visiting our website
2.1 Delivery, server logs and abuse prevention
Our website is delivered via the global edge network of our hosting provider Cloudflare. When you access it, technically required data is processed: IP address, date and time, browser, operating system, referrer URL, pages and files requested, access status and volume of data transferred.
Cloudflare processes this data on our behalf to deliver the site, for edge request logs used for troubleshooting and security, for bot and attack defence, and for rate limiting of our contact form and chat. For rate limiting, the IP address is checked against a request counter for 60 seconds; no profile is created.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable provision of the website and its protection against misuse.
Storage period: in accordance with Cloudflare's retention rules for edge log data. We do not keep a log archive of our own.
2.2 Cookies and storage on your device
We store strictly necessary entries without consent on the basis of § 25(2) no. 2 TDDDG. All other entries are set only after you have actively consented (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR).
Without consent (strictly necessary):
- Your consent decision – as a cookie for 12 months and as a local copy in browser storage until you delete it, so the banner does not reappear and optional services stay off.
- A local log of your consent changes – in browser storage until you delete it, as a record on your own device.
- Your chat session – conversation ID and messages of the current chat, only from your first message, on your device only, until the end of the browser session.
Further processing is based on Art. 6(1)(c) GDPR (proof of consent) for the consent entries and on Art. 6(1)(f) GDPR (a functioning website) for the chat.
Only with consent: Google Tag Manager and Google Analytics (section 2.5). Without consent, these services are not loaded. If you withdraw consent, we delete the analytics cookies from your browser as far as technically possible.
Withdrawal: you can change your decision at any time with effect for the future via the cookie settings (Art. 7(3) GDPR). The lawfulness of processing carried out until then remains unaffected.
2.3 Contact form
We process the information you enter in the form in order to handle your enquiry:
- Required: subject, first name, last name, email address and message. Without them we cannot receive the enquiry.
- Optional: telephone number and company.
- Transmitted automatically: the address of the page from which you submit the form and your browser identifier (user agent).
Route of the data: your entry goes to our server at Cloudflare, from there to our automation systems at Hetzner in Helsinki (Finland), and is delivered via Brevo as an email to our mailbox at Google Workspace. Your IP address is processed only for rate limiting (section 2.1) and is not forwarded.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or, where the enquiry is not aimed at a contract, Art. 6(1)(f) GDPR (legitimate interest in answering it).
Storage period: the processing record in our automation systems is deleted automatically after 14 days; Brevo keeps delivery logs according to its own retention periods. The email containing your enquiry remains in our mailbox until we delete it. We delete it when you ask us to or when the purpose no longer applies, unless statutory retention obligations (§ 257 HGB, § 147 AO) prevent this.
2.4 Chat
The chat answers questions about our services. When a page is opened, the chat program and its pictures are loaded from our subdomain chat.nickle.ai, which is also delivered via Cloudflare; section 2.1 applies to this. Further data is processed only once you send a message: the content of your messages and of the replies, a random conversation ID, the address and language of the page you are chatting on, and the time.
Please do not enter sensitive data (Art. 9 GDPR) or data of third parties in the chat.
Route of the data: your message goes to our server chat.nickle.ai at Cloudflare and from there to our chat backend at Hetzner in Helsinki, where the conversation history and knowledge base are also stored. To generate the reply, it is sent to Microsoft Azure OpenAI in the Sweden Central region (EU). Your IP address is processed only for rate limiting and is not passed on to the AI service.
Legal basis: Art. 6(1)(b) GDPR where the conversation concerns the initiation of a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries promptly). Use is voluntary.
Storage period: the conversation history and the processing record are deleted automatically after 14 days; the copy in your browser at the end of the session.
Replies are generated by an AI system. They may be incorrect and are not a legally binding statement by us. No automated decision-making within the meaning of Art. 22 GDPR takes place.
2.5 Google Tag Manager and Google Analytics 4
Only if you consent to analytics do we load Google Tag Manager and, through it, Google Analytics 4, to evaluate the use of our website statistically and improve it.
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by Google LLC in the USA is possible.
- Data: pseudonymous identifiers (cookies with a lifetime of up to 24 months), usage and event data, browser and device information, approximate location, referrer and time. We also record events on the use of the contact form and chat (e.g. submission, opening) – never their content.
- Configuration: Google Signals and advertising features are disabled.
- Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR.
- Storage period: event data 2 months, user-level data 14 months.
3. Contact by email, telephone and other channels
If you contact us by other means, we process your information and the communication metadata to handle your request. Emails are stored in our mailbox at Google Workspace.
Legal basis: Art. 6(1)(b) or (f) GDPR. Storage period: as described for emails in section 2.3.
4. Job applications
We process applications sent by email in order to decide on establishing an employment relationship (Art. 6(1)(b) GDPR, § 26 BDSG). Please send us only information that is necessary for the application.
The application remains in our mailbox until we delete it manually. We do so after the procedure has ended, once the documents are no longer needed to defend against claims (in particular under the German General Equal Treatment Act, AGG) – usually six months after a rejection. If employment follows, the documents become part of the personnel file. We keep applications longer for future vacancies only with your consent.
5. Business relationships
We process data of prospects, customers, contact persons, service providers and partners – in particular names, business contact details, company and position, offer, contract, project and invoice data, and communication content – in order to initiate, perform and manage business relationships.
Legal basis: Art. 6(1)(b) GDPR; for general business communication and legal enforcement Art. 6(1)(f) GDPR; for statutory retention obligations Art. 6(1)(c) GDPR.
We prepare offers, invoices and accounts with Lexware Office (Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany). Where necessary, we also pass data to tax advisors, banks and payment service providers, and to legal advisors, courts and authorities (Art. 6(1)(b), (c) and (f) GDPR).
We collect recurring fees, e.g. for hosting and operating websites or chatbots, via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). When a customer takes out a subscription, Stripe processes name, email address, billing address, payment data and transaction data. We do not receive full card or account details. Stripe processes some of the data as an independent controller, e.g. for fraud prevention and to meet legal obligations. Processing by Stripe, Inc. in the USA is possible; this is based on the EU-US Data Privacy Framework and standard contractual clauses (Art. 6(1)(b) and (c) GDPR).
6. Our agency services
Where we process personal data solely on behalf of and on the instructions of our customers (e.g. when operating websites, contact forms or chatbots for customers), we are a processor under Art. 28 GDPR. The customer is then the controller; our data processing agreement applies, and its Appendix 3 lists the subprocessors used.
7. Processors
We have concluded a data processing agreement under Art. 28 GDPR with each of the following service providers:
| Provider | Purpose | Location / third-country transfer |
|---|---|---|
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Hosting, DNS, media storage, logs, attack defence, rate limiting, database backups | Media and backups within the EU jurisdiction; otherwise USA possible – EU-US Data Privacy Framework and standard contractual clauses |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers for the contact form, chat backend, databases and content management | Helsinki (Finland), no third-country transfer |
| Brevo (Sendinblue SAS), 7 rue de Madrid, 75008 Paris, France | Delivery of form emails | EU, no third-country transfer |
| Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | AI replies in the chat (Azure OpenAI); not used for training | Sweden Central region (EU), no third-country transfer |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Email, calendar and documents (Google Workspace); Tag Manager and Analytics only with consent | USA possible – EU-US Data Privacy Framework and standard contractual clauses |
| Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany | Offers, invoices, accounting (Lexware Office) | Germany, no third-country transfer |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland | AI assistant (Claude) for internal work, e.g. handling enquiries and project documents, drafting texts and software development; not used for training | Storage in the USA, processing in other countries possible – standard contractual clauses |
Cloudflare, Inc. and Google LLC are certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR); standard contractual clauses under Art. 46(2)(c) GDPR apply in addition. For Anthropic, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).
8. Storage periods
| Data | Storage period |
|---|---|
| Form and email enquiries in our mailbox | until we delete them, at your request or when the purpose ceases |
| Job applications | usually up to six months after the procedure ends |
| Processing records (form and chat) | 14 days |
| Chat history | 14 days |
| Database backups | 30 days |
| Entries on your device | see section 2.2 |
| Google Analytics | 2 months (events) / 14 months (user-level) |
| Edge logs | according to Cloudflare's rules |
| Contract, invoice and accounting data | 6 or 10 years (§ 257 HGB, § 147 AO) from the end of the calendar year |
Deleted data may remain in backups until the backup period expires.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). An informal message to info@nickle.ai is sufficient.
Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint (Art. 77 GDPR): you may complain to a data protection supervisory authority. The authority competent for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de
10. Social media presences
We maintain profiles on Instagram, LinkedIn, X and YouTube. If you interact with us there, we process your messages and comments in order to respond (Art. 6(1)(f) GDPR). The operators also process your data for their own purposes.
Where the operators provide us with statistics about our profiles, we are joint controllers with them in this respect (Art. 26 GDPR). You can also exercise your rights directly with the operator that processes the data (Meta for Instagram, LinkedIn, X, and Google for YouTube).
11. Changes
We update this privacy policy when our processing or the legal situation changes. The version published on this page applies.