Privacy Policy

Version 2.8 — Last updated: October 25, 2026

NegotiateIt ("we", "us", "the Service") is an AI-powered negotiation practice platform. This policy explains what data we collect, why, how long we keep it, and your rights. We collect only the data necessary to provide the Service (data minimization).

The Service is not intended for the processing of sensitive personal data (e.g., health, biometric, political, religious data). Users should not submit such data during gameplay.

1. What We Collect

2. How We Use Your Data

• Providing the Service: Account and game result data powers your profile, progress, technique mastery, and session history. This is necessary to perform our contract with you (Art. 6(1)(b)).
• Product improvement: Where you have opted in to recording, transcripts may be processed in aggregated and pseudonymized form to improve system performance, AI opponent behavior, and difficulty calibration. We do not use your data to train general-purpose AI models.
• Safety and abuse detection: Minimal metadata about AI interactions (e.g., turn count, error flags, hostility classification) may be logged for abuse detection and system safety. Full conversation transcripts are only stored where you have opted in to recording (Art. 6(1)(f) — legitimate interest for metadata; Art. 6(1)(a) — consent for transcripts).
• Communication: We may send transactional emails (password reset, verification, subscription receipts). We do not send marketing emails without your explicit opt-in.

3. Conversation Recording Details

When you opt in to conversation recording:

• Your negotiation messages, AI responses, technique detections, emotional state changes, and game decisions are stored.
• Player text is automatically deleted after 90 days. AI dialogue and aggregate metadata (emotional trajectories, technique frequencies) are retained for the duration of your account.
• Detection evidence that quotes your messages is also purged at 90 days.
• Transcripts are stored securely in our database with encryption in transit (TLS).

If you revoke consent, future games will not be recorded. Existing transcripts remain on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in maintaining product quality, detecting abuse, and debugging the system, until the 90-day auto-purge applies to player text and the rest is deleted on account deletion. You may request immediate deletion of all your transcripts at any time — see Section 6.

4. AI Processing

During gameplay, the following data is sent to our AI model providers to generate opponent dialogue and game decisions:

• What is sent: Your message text and game context (scenario, emotional state, turn history). Your email, name, or account identifiers are never sent to AI providers.
• Providers: Anthropic (Claude) as primary; Google (Gemini) as fallback. See our subprocessor list.
• Provider data retention: We use Anthropic's paid commercial API, where input data is not used for model training by default. Anthropic may retain API inputs for up to 30 days for safety and abuse monitoring purposes.
• No general-purpose training: We do not provide your data to any AI provider for the purpose of training general-purpose models.

5. Data Retention

• Account data: Retained for the duration of your account. Anonymized on account deletion (billing records retained for 10 years per German tax law, § 147 AO).
• Game results: Retained for the duration of your account and as long as necessary to provide historical progress features. Deleted on account deletion.
• Conversation transcripts: Player text auto-purged after 90 days. AI dialogue and metadata retained for duration of account. All transcripts deleted on account deletion.
• Consent records: Retained for the duration of your account for compliance purposes.

6. Your Rights

Depending on your jurisdiction, you have the right to:

• Access your personal data
• Delete your account and associated data (Profile settings or contact us)
• Withdraw consent for conversation recording and analytics at any time (Profile settings)
• Data portability — download a copy of your data
• Correction — update inaccurate information
• Object to processing based on legitimate interest (EU)
• Restriction of processing in certain circumstances (EU)
• Lodge a complaint with a supervisory authority in your country of residence or in Germany (the competent authority is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg)

To exercise these rights, contact [email protected]. We will verify your identity (typically by confirming the email address associated with your account) and respond within one month. We may extend this period by up to two further months for complex or numerous requests and will inform you of any such extension — with reasons — within the first month.

Appeals. If we deny your request, you may appeal by emailing [email protected] with "Appeal" in the subject line. We will respond within 60 days.

7. Automated Decision-Making

The Service uses automated systems to generate feedback, performance scores, technique classifications, and coaching suggestions based on your gameplay. These automated processes are part of the core Service and do not produce legal or similarly significant effects on you. You may contact us if you have questions about how automated scores are determined.

8. Third-Party Services

We use third-party services to operate the Service. Our complete subprocessor list, which forms part of this policy, details each provider, the data they process, and their location. The same page lists the companies that act as independent controllers: Creem for web and Android payments, Google when you sign in with Google, and Apple when you sign in with Apple or buy through the App Store. Each processes that data under its own privacy notice and the law; we share with them only what the service you choose requires. Our subprocessors are bound by contract to protect your data at least as well as this policy requires. Our web app’s sign-in screen loads Google’s and Apple’s sign-in buttons from their servers, which shares your IP address and browser details with them when the screen opens.

Key points:

• AI providers receive your messages during gameplay (see Section 4). They do not receive your identity.
• App Store purchases on iPhone and iPad are processed and charged by Apple through the App Store, under Apple’s own terms and privacy policy. Apple handles your payment card and other payment details and does not share them with us. To link a purchase to your NegotiateIt account, our app gives Apple a random account reference (not your name or email). Apple then sends us a signed record of the purchase, which we check with Apple’s servers. From it we keep the transaction identifier, the product, the price and currency, and the renewal and expiry status. We use this to give you Pro access and keep it for our tax and accounting records (see Section 1). Legal basis: GDPR Art. 6(1)(b) (performance of contract) and, for record retention, Art. 6(1)(c) (legal obligation).
• Payment processing is handled by Creem (operated by Armitage Labs OÜ in Estonia), our merchant of record. Creem invoices you, processes payment, calculates and remits applicable taxes (VAT under EU OSS, US state sales tax), and processes refunds. To open the checkout we give Creem your email address and an internal account reference that lets us match your payment to your account. You enter your name, billing address, country and payment details directly on Creem’s hosted checkout; they never reach our servers. Creem tells us whether your subscription is active, its billing period, the amount and tax charged, and any refund or chargeback. Legal basis: GDPR Art. 6(1)(b) (performance of our contract with you). Creem is established in the EU (Estonia), so the details we pass to Creem stay in the EU. Creem is responsible for any transfers to its own providers outside the EU, which it describes at creem.io/privacy.
• In-app analytics are only active if you explicitly opt in via the consent prompt. This includes usage events — which scenarios you start and finish, screens you visit within a session, and which opponent card or pricing button you click. These events are linked to your account via a pseudonymous user ID (so we can measure your progress and return visits) and are hosted in the EU; they never include your typed messages, and you can withdraw consent at any time in Profile settings. Separately from those opt-in events, we record two timestamps on your own account record — when you first created a practice session and when you first attempted a turn. These stay on our own servers, are never sent to an analytics provider, and contain no content from your conversations. We rely on our legitimate interest (Art. 6(1)(f) GDPR) in knowing where new users get stuck, because the opt-in events above cannot answer that: the people who leave soonest are the least likely to have opted in. Our landing page uses privacy-friendly, cookieless analytics: we store no cookies and no client-side identifier. To estimate visitor counts, our server derives a temporary, daily-rotating pseudonymous identifier from your IP address and browser type; your raw IP address is never stored and never sent to our analytics processor (PostHog). We rely on our legitimate interest (Art. 6(1)(f) GDPR) in understanding aggregate website usage. Because nothing is stored on or read from your device, no cookie consent is required (§25 TDDDG).
• Marketing attribution uses server-side conversion measurement APIs (Meta Conversions API, AppLovin S2S, Reddit Conversions API, Google Ads offline conversion import) to attribute paid acquisition campaigns. We transmit hashed identifiers (such as a one-way hash of your email) or the ad-click identifier the advertising platform appended to the link you clicked (Reddit rdt_cid, Google gclid), plus the conversion event type and timestamp — never browsing behavior or any personal information beyond what is necessary to attribute a signup or purchase. No advertising script, tag, or cookie is placed on our pages for this; the click identifier arrives as a URL parameter and is processed server-side. We do not store or transmit the Google ad-click identifier for signups from the EEA, UK, or Switzerland. Stored click identifiers are deleted at the latest 35 days after signup. Legal basis: our legitimate interest in measuring the advertising we pay for (GDPR Art. 6(1)(f)).
• Error monitoring may include device information and anonymized error context, but never message content or personal data.
• Bot-protection challenge on our cancellation and withdrawal forms (/cancel and /withdraw) is provided by Cloudflare Turnstile. Turnstile may set a short-lived cookie or read minimal device signals strictly to distinguish humans from automated abuse. We rely on this as strictly necessary to provide the service you requested (§25(2) Nr. 2 TDDDG) and on our legitimate interest in preventing fraudulent cancellations (GDPR Art. 6(1)(f)).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

9. Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS/HTTPS)
• Password hashing with Argon2id (industry-standard memory-hard algorithm)
• Access controls and authentication on API endpoints
• Rate limiting and abuse prevention measures
• PII redaction policies for application logs and error reports
• Regular backups with documented restore procedures

No system is perfectly secure. We continually work to improve our security posture and will notify affected users and relevant authorities in the event of a data breach, in accordance with GDPR Articles 33 and 34.

10. International Data Transfers

We are based in Germany (EU). Your data may be transferred to and processed in the United States when we use third-party services (Anthropic, Google, Resend, Sentry, Cloudflare, PostHog). Where such transfers occur, we rely on:

• The EU-U.S. Data Privacy Framework (for certified providers), and/or
• Standard Contractual Clauses (SCCs) as appropriate

in compliance with GDPR Chapter V.

PostHog, Inc. is established in the United States. We use PostHog for both in-app product analytics and cookieless landing-page analytics; transfers to PostHog are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Fly.io hosts our application and database in its EU region. Creem, our merchant of record, is established in the EU (Estonia), so the details we pass to Creem do not leave the EU. Creem uses some service providers outside the EU; as an independent controller it is responsible for those transfers and describes its safeguards in its own privacy notice. To confirm an App Store purchase, our servers query Apple’s App Store Server API, operated by Apple Inc. in the United States; the request contains the transaction identifier, and the purchase record it returns includes the account reference described in Section 8. We check Google and Apple sign-in tokens on our own servers and do not send your data to Google or Apple to do so. Typography is served from our own infrastructure, so no font request transmits your IP to Google.

11. Age Requirement

NegotiateIt is intended for users aged 18 and older. You must confirm that you are at least 18 years old when creating an account. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will terminate their account and delete their data promptly.

12. US State Privacy Rights

If you are a resident of a US state with a comprehensive privacy law — currently including California, Virginia, Colorado, Connecticut, Texas, Florida, Oregon, Montana, Utah, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Maryland, Minnesota, Nebraska, Indiana, Kentucky, and Rhode Island — you have the rights described below. We honor these rights regardless of whether we technically meet the thresholds of your state's law.

12.1 Your rights

• Access: request the categories and specific pieces of personal information we have collected about you.
• Delete: request deletion, subject to legal exceptions (tax recordkeeping, ongoing service provision).
• Correct: request correction of inaccurate information.
• Portability: receive a copy of your personal information in a portable format.
• Opt out of sale: we do not sell your personal information.
• Opt out of sharing for cross-context behavioral advertising: we do not engage in this practice.
• Opt out of profiling that produces legal or similarly significant effects: we do not perform profiling of this kind.
• Non-discrimination: we will not discriminate against you for exercising your privacy rights.

12.2 Sources of personal information

We collect personal information directly from you (when you register and use the Service), from your interactions with the Service (game results, usage activity, conversation transcripts if you have opted in to recording), from the sign-in services you choose to use (Google, Apple), and from our payment partners (Creem for web and Android purchases, Apple for App Store purchases), which tell us your subscription status.

12.3 How to exercise your rights

Email [email protected]. Include "Privacy Request" in the subject line and describe what you are asking for.

12.4 Verification

We will verify your identity before processing requests, typically by confirming the email address associated with your account. For sensitive requests we may ask additional verification questions.

12.5 Authorized agents

You may designate an authorized agent to make requests on your behalf. We require a signed written authorization (or a notarized power of attorney) plus verification of your own identity. We will deny agent requests that lack adequate authorization or verification.

12.6 Response time and appeals

We will confirm receipt of your request and respond within 45 days. We may extend this period by an additional 45 days for complex or numerous requests, with notice to you within the initial 45-day window.

If we deny your request, you may appeal by emailing [email protected] with "Appeal" in the subject line. We will respond to appeals within 60 days. If you remain unsatisfied, you may contact your state attorney general.

12.7 California-specific (CCPA/CPRA)

Categories of personal information collected: identifiers (email, display name, account identifiers from Google or Apple, payment-provider customer or transaction IDs), commercial information (plan, subscription status and purchase records), internet activity (game results, usage data), inferences (negotiation scores, technique proficiency), and — where you have opted in to recording — the contents of communications (your typed negotiation messages).

Sensitive personal information. Where you have opted in to recording, your conversation transcripts may qualify as "contents of communications" under CPRA § 1798.140(ae). We process these only to provide and improve the Service; we do not infer characteristics about you for any purpose beyond gameplay feedback. You may revoke recording consent at any time in your Profile or request deletion of any stored transcripts via the contact above. Under California law you also have the right to limit our use of sensitive personal information; we already limit ours to the purposes just described.

Purpose of collection: providing the Service, improving system performance, communicating about your account.

Disclosures for a business purpose: in the past 12 months we disclosed identifiers and commercial information to payment providers (Creem, Apple) to complete purchases you requested, and the categories listed above to the service providers on our subprocessor page. Disclosures you direct, such as starting a Creem checkout or signing in with Google or Apple, are not a sale or sharing of personal information.

Retention: see Section 5.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the app or by email at least 30 days before they take effect. The version number and date at the top indicate the most recent revision.

14. Contact

For privacy-related questions, data requests, or concerns:

Email: [email protected]

Postal: BD Nova UG (haftungsbeschränkt), Straße der Jugend 18, 14974 Ludwigsfelde, Germany