Draft: highlighted fields are still to be completed.
Nella privacy notice
Last updated: [[LAURA: publication date]]
Nella is an AI voice character for adult women. This notice has two parts: A. the website and waitlist (live now) and B. the app (applies only when you use the app).
In short
- Nella is an AI, not a person. For people aged 18 and over only.
- The website uses no cookies and no analytics, and fonts are self-hosted.
- The waitlist stores your e-mail, first name and quiz character only at Brevo (France, EU).
- We don't sell your data and there are no charges in this phase.
1. Controller
Laura Bonomini (private individual)
[[LAURA: street and number]], [[LAURA: postcode]] Munich, Germany
E-mail: [[LAURA: privacy e-mail address]]
2. Data protection officer (DPO)
[[LAURA: DPO name and contact, or "DPO being appointed; until then write to (e-mail)"]]
A. Website and waitlist
3. Visiting the website
The website is hosted on Cloudflare Pages (Cloudflare, Inc., USA). To deliver pages and protect the site, Cloudflare processes your IP address and technical request data (browser, page, date and time).
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in a secure, working website.
Transfer to the US: Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); EU standard contractual clauses are in place as well (Art. 46(2)(c) GDPR).
Fonts are self-hosted: your browser does not contact external font services.
4. Cookies and analytics
The website uses no cookies and no analytics or tracking tools, so there is no banner.
5. Age confirmation
Before entering, we ask you to confirm you are at least 18. This confirmation (and the related consent checkbox) stays only in your browser and is not stored by us.
6. Waitlist
| Data | Why | Where | Legal basis |
|---|---|---|---|
| E-mail, first name, quiz character | Tell you when Nella opens | Brevo only (Sendinblue SAS, Paris, France, EU) | Art. 6(1)(a) GDPR, your consent |
Brevo processes the data on our behalf (Art. 28 GDPR). The website stores this data nowhere else. You can unsubscribe at any time via the link in every e-mail or by writing to [[LAURA: privacy e-mail address]].
Retention: until launch, at most 12 months from sign-up, or until you unsubscribe.
Providing data is optional, but without an e-mail we can't add you.
B. The app
This part applies only when you use the app, not when you visit the website.
7. Data processed in the app
| What | Data | Provider and location | Legal basis |
|---|---|---|---|
| Conversations with Nella | Your voice in real time, the transcript during the session, Nella's replies, your IP address | OpenAI (USA), United States | Art. 6(1)(b) GDPR; Art. 9(2)(a), explicit consent, for special-category data |
| Nella's memory | Short notes about you (e.g. names, appointments, preferences) | Supabase Inc. (USA), database in Frankfurt | Art. 6(1)(a) and Art. 9(2)(a), explicit consent |
Transfer to OpenAI in the US: OpenAI is not certified under the EU-US Data Privacy Framework; the transfer relies on EU standard contractual clauses (Art. 46(2)(c) GDPR). For Supabase, EU standard contractual clauses cover any access from outside the EU. You can ask for a copy of the safeguards at [[LAURA: privacy e-mail address]].
Voice: we don't use your voice to identify you and don't analyse emotions from it. Training: we don't use your data to train AI models; OpenAI states it doesn't train on API data, but may keep abuse-monitoring logs (audio and text) for up to 30 days.
8. Health and other special-category data (Art. 9 GDPR)
While talking with Nella you might share things about your health, mood, sex life, religion or political views. This data is processed only with your explicit consent. You can withdraw it at any time by writing to [[LAURA: privacy e-mail address]]; withdrawal doesn't affect processing done before.
9. Nella is an AI and not an emergency service
Nella is an artificial intelligence, not a person and not a therapist (Art. 50 EU AI Act). If you are in danger, call 112.
10. Deleting Nella's memory
You can ask us to delete single notes or the whole memory [[LAURA: describe how it actually works in the app (button, voice command), or only "by writing to (e-mail)"]]. We delete within [[LAURA: deadline, suggested 7 days]]. OpenAI's logs are deleted on its schedule (up to 30 days).
Retention: memory until you delete it or your account; audio not stored by us; other app data [[LAURA: period]].
Both parts
11. Automated decisions
We make no automated decisions with legal or similarly significant effects on you (Art. 22 GDPR).
12. Your rights
You have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time (Art. 15–21 GDPR). Write to [[LAURA: privacy e-mail address]]. We reply within one month.
13. Complaints
You can complain to a supervisory authority (Art. 77 GDPR), in particular:
- Lead authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany · www.lda.bayern.de
- In Italy: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome · www.garanteprivacy.it
14. Adults only
Nella is only for people aged 18 and over. If we learn that a minor has signed up, we delete her data. Reports to [[LAURA: e-mail address]].
15. Changes
We publish every new version here, for example when the UG becomes controller or if we add analytics or payments.