Privacy Policy

Last updated: February 24, 2026

1. Data Controller

This Privacy Policy applies to the Noxu mobile app and related cloud services provided by Ordiia Software.

Ordiia Software
Owner: Pascal Fan Wetzel
Luisenstrasse 25
65185 Wiesbaden
Germany
Email: [email protected]

2. Categories of Personal Data

• Account and authentication data (for example email, authentication provider identifiers, account IDs)
• Contract data and related files you store in the app (including encrypted sync payloads, snapshots, and attachment blobs)
• Subscription and billing status metadata received via payment/subscription providers
• Device and technical data required for service operation (for example app/device identifiers, push token, security and sync metadata)
• Operational service metadata (for example model name, token counts, latency, timestamps)
• Feedback/support data you submit (for example feedback category, message, optional diagnostics, contact email)
• Document text sent to cloud AI only when AI processing is enabled by you

3. Data Sources

We primarily receive personal data directly from you, from your use of the app, and from integrated service providers (for example authentication, subscription/billing, and cloud infrastructure providers).

4. Purposes and Legal Bases (GDPR)

• Account management, synchronization, contract tracking, and core app operation: Art. 6(1)(b) GDPR
• Subscription lifecycle handling and payment status synchronization: Art. 6(1)(b) GDPR
• Security, fraud/abuse prevention, technical reliability, and service integrity: Art. 6(1)(f) GDPR (legitimate interest)
• Compliance with legal obligations (for example accounting, tax, and mandatory legal records): Art. 6(1)(c) GDPR
• Cloud AI scan/summary processing: Art. 6(1)(a) GDPR (consent/opt-in) and, where applicable for requested functionality, Art. 6(1)(b) GDPR
• Support and feedback handling: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR

Our legitimate interests under Art. 6(1)(f) include secure operation of the service, incident response, abuse prevention, and ongoing service quality and reliability improvements.

5. AI Cloud Processing

AI cloud processing is optional and requires explicit opt-in. When used, data is transmitted over HTTPS/TLS. By default, we configure AI processing to use an EU-based provider (currently Mistral). For continuity and incident response, we may manually switch AI providers (for example if the default provider is unavailable for an extended period). Server-side usage collections (ai_extractions, ai_summaries) store operational metadata only and do not store raw contract text.

6. Security Measures

• Encrypted transport (HTTPS/TLS)
• Access-control checks for account/vault operations
• Default log sanitization and redaction controls
• Technical and organizational measures designed to protect confidentiality, integrity, and availability

7. Processors and International Transfers

• Google Firebase / Google Cloud (Auth, Firestore, Storage, Functions, App Check, FCM)
• OpenAI (AI inference when feature is used)
• Mistral (AI inference; default provider configuration)
• RevenueCat (subscription management)
• Firebase Crashlytics (stability telemetry)
• Notification/webhook provider for support alerts (minimal metadata only, such as feedback category, ticket ID, and timestamp)

We engage processors under data processing agreements pursuant to Art. 28 GDPR. Some processors may process data outside the EEA. Where this occurs, we rely on an adequacy decision (Art. 45 GDPR) where available, or otherwise on appropriate safeguards under Art. 46 GDPR (in particular Standard Contractual Clauses), with supplementary measures where required. You can request information about the applicable transfer safeguards by contacting [email protected].

8. Retention

We retain personal data only as long as necessary for the stated purposes, unless longer retention is required or permitted by law. Retention may vary by data type and legal context.

• Account, contract, and attachment data: retained while your account is active; deleted or anonymized after account deletion subject to technical deletion windows and legal obligations
• Subscription/billing records: retained according to contractual and statutory retention duties
• Push token and device notification metadata: retained while needed for notification delivery and removed when invalid, replaced, or no longer required
• Feedback/support records: retained for up to 90 days to process and follow up on support requests and product quality issues
• Crash/stability telemetry: retained according to configured provider retention settings and operational necessity
• AI usage logs (ai_extractions, ai_summaries): 14 days
• GDPR export logs: 90 days
• Deletion audit and tombstones: 14 days
• Short-lived reservation and rate-limit records: minutes to hours, then cleanup/TTL

9. Required Data and Consequences of Not Providing It

Some data is required to provide core app functionality (for example account/authentication data, sync/security metadata, and subscription status data for paid features). If such data is not provided, certain features or the service as a whole may not function.

10. Your Rights

You can request access, rectification, deletion, restriction, objection, and portability where applicable. You can also withdraw consent for AI cloud processing at any time (without affecting processing carried out before withdrawal).

To exercise your rights, contact [email protected]. We may request information necessary to verify your identity before fulfilling your request.

11. Automated Decision-Making

We do not use solely automated decision-making, including profiling, that produces legal effects or similarly significant effects on you within the meaning of Art. 22 GDPR.

12. Contact and Complaints

For privacy requests, contact [email protected]. You may also lodge a complaint with your supervisory authority.