Privacy Policy for Nikiwa

Effective from [Datum]

Key points at a glance

• We do not sell or rent out personal data.
• Without an account, your collection stays on your device.
• Depending on the country, the minimum age for your own account is between 13 and 16. Younger users who are at least 13 need their parents’ consent.
• For card recognition, the camera image is processed on your device. An image reaches us only if you so choose.
• Usage analytics, ad measurement and marketing emails happen only with your consent.
• You can delete your account in the app at any time and download your data.

1. Who is responsible

The controller responsible for processing your personal data is E2 Technologies GmbH, Bahnhofstrasse 10, 6340 Baar, Switzerland, represented by its managing director, Afrora Hoti-Rexhepi (“we”).

For privacy questions, you can reach us at privacy@nikiwa.app.

Our representative in the European Union under Art. 27 GDPR is [EU-Vertreter, Anschrift, E-Mail]. You can also contact our representative with any privacy concern.

For users in Québec, our managing director is in charge of the protection of personal data and can be reached at the same address.

2. What this policy covers

This policy applies to the Nikiwa app on iPhone and Android and to the website nikiwa.app, with or without an account. For certain countries, the notes in Section 13 also apply. Our terms of use govern how you may use the app.

3. What data we process and why

Which data is collected depends on what you do in the app. You will find the legal bases in Section 4 and the retention periods in Section 8.

3.1 Without an account

Without an account, your collection, your wishlists and your photos stay on your device. We do not receive them. If you delete the app or lose your device, this data is lost, because we have no backup of it.

So that we can show you the catalog, images and prices, our servers receive technical information such as IP address, time, device type, operating system and app version (Section 3.10).

3.2 Your account

For an account, we process:

• your email address and your password. We never store the password in plain text, only as a so-called hash, from which it cannot be reconstructed;
• if you sign in with Apple or Google, the identifier that Apple or Google sends us, and your email address. With Apple, you can choose a hidden forwarding address;
• your display name [and your profile picture];
• your month and year of birth from the age check, your country and, where Apple or Google provides it, your age range (Section 5). We do not ask for your day of birth;
• your settings, for example whether your profile is public and which notifications you want to receive;
• the devices you are signed in on, with model, operating system and app version;
• if you need your parents’ consent for an account: the parent’s email address and when they gave consent (Section 5).

3.3 Your collection

With an account, we store your collection on our servers and sync it across your devices: which cards and products you own, in which language, variant and quantity, in what condition and whether they have been graded by a grading company, plus notes, binders, wishlists and showcases. From this, we calculate, for example, the estimated value of your collection.

We store photos of your copies privately. Only you can see them.

From age 16, you can prepare copies for sale or trade before buying and trading launch in your country. We store prepared offers privately with your collection; no one else can see them. We work out matching trade partners internally and show them only once trading launches in your country. We look at how many offers are prepared in a region only in aggregate, to decide where buying and trading launch first. An offer becomes public only when you publish it yourself. If you remove a copy from your collection, we delete its offer too.

3.4 Public profile and showcase

Your profile is private by default. If you make it public, others can see your display name and the showcases you design. A public profile has a fixed web address, and anyone can see it without signing in. Once you are of age where you live (18 in most countries), search engines such as Google can find it too; until then we block it from search engines. Your quantities, wishlists, the photos of your copies, your location, your purchase prices and values are never public. You can set your profile back to private at any time.

3.5 Your Lounge

In the Lounge, you show your collection in a room, with your avatar and your shelves. Others can visit your Lounge only if your profile is public. Then anyone with the link can view it, even without an account. They then see the same things as in your showcases, plus your avatar and your room, but never quantities, values, wishlists or photos of your copies. Visitors cannot change anything. Your Lounge shows visitors day or night, depending on the time where you are. For this, we use your device’s time zone, so visitors can roughly tell which time zone you live in. We count how often your Lounge was visited and by how many people. Each account counts at most once a day, and only signed-in accounts count. For this, we store which accounts visited a Lounge on which day. Others see the number of visits only if you turn this on; only you see how many different people visited. We show no one who the visitors were.

You can block and report other users. When you file a report, we store the reason, the details you give us and the content concerned.

3.6 Scanning with the camera

To recognize cards, the app processes the camera image on your device. The image is not sent to us for this. After a scan, you decide:

• Keep photo: The photo is saved with your copy, privately, as described in Section 3.3.
• Help improve recognition: Only if you expressly consent does the app send us the cropped section showing the card and technical measurements from the capture. We use them to improve recognition, including to train AI models. We store only the card, without its surroundings, location or time, for no more than 24 months. If you withdraw your consent, we delete the images.

3.7 Reports, corrections and support

You can report missing cards or products, correct errors in the catalog and report problems with the app, even without an account. For this, we process your text and, if you attach one, a photo. We attach device data such as model and app version only with your consent. Without an account, we link a report to a random device identifier, not to you personally.

If we add a correction or a photo to the catalog, this contribution stays there without your name, even if you later delete your account.

If you write to our support team, we process your message and your contact details to reply to you. For this, we use Google Workspace. You can always ask to communicate with a human.

3.8 Notifications and emails

We send you in-app notifications and emails about your account and your reports. You receive push notifications only if you allow them on your device; for this, we store a device identifier for push notifications. You choose in the settings which notifications you receive by email or push.

We send marketing emails, for example about new features or offers, only with your consent. You can unsubscribe with one click in any email.

If you tap “Notify me”, for example on the notice that buying or trading is coming soon, we save this request with the date, separately for each feature. As soon as the feature launches in your country, we send you a single message, as an in-app notification or by email. After that, we delete the request. You can cancel it in the settings at any time before then. We show the button to users aged 16 and over.

3.9 Usage analytics and crash reports

Only with your consent do we record how the app is used, for example which screens you open, and when it crashes. For this, we use a random identifier, not your name or email address, and no advertising identifier. We do not track you across other apps or websites. Provider: [Analyse-Anbieter, Sitz]. There is no usage analytics for users under 16.

3.10 Operations and security

Every request to our servers generates technical data: IP address, time, requested content and error messages. We use it to run the service, to protect against misuse and attacks and to fix errors.

3.11 Website

On our website, we use cookies and similar technologies. We set technically necessary cookies, for example for security and for your cookie settings, without consent. We set all others only if you agree in the cookie banner: statistics cookies, to understand how the website is used ([Statistik-Werkzeug]), and marketing cookies, to measure and manage our advertising (Section 3.13).

You can change your choice at any time via “Cookie settings” at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal. The list in the cookie settings shows which cookies are stored and for how long.

3.12 Anonymous statistics

From the data of all users, we create aggregated, anonymous statistics, for example on prices, demand, card popularity and regional differences. Every figure is based on at least 20 users, so no one can be singled out. We publish such statistics and may also provide them to third parties, including for a fee. We never try to identify individuals from them, and we contractually prohibit recipients from doing so.

3.13 Advertising and measurement

We advertise Nikiwa on other platforms and want to know which ads work. For this, we measure on two levels:

• Without personal data: We receive aggregated figures from Apple, Google and the advertising platforms showing how many downloads a campaign brings. This does not require consent, and we learn nothing about you as a person.
• With your consent: In the app, a measurement service ([Messdienst]) records which ad brought you to us and whether you then take certain steps, such as opening an account or scanning your first card. For this, it uses a device identifier; on iPhone, this is the advertising ID, if you allow tracking when Apple asks. On the website, the advertising platforms set marketing cookies if you agree in the cookie banner. The data goes to the platforms so that they can measure our advertising, deliver it better, reach you again later or find people with similar interests.

Our advertising platforms are [Werbeplattformen]. We and the respective platform are joint controllers for collecting and transmitting the data on our website. The platform alone is responsible for what it does with the data afterward; its own privacy policy describes this.

There is no ad measurement for users under 16. You can withdraw your consent at any time: in the app under [Settings > Privacy], on the website via “Cookie settings” and, on iPhone, also in Settings under “Tracking”. We do not show personalized ads in the app itself.

3.14 Business partners, creators and artists

If we work with you as a creator, artist, service provider or other business partner, we process your contact, contract and payment data to perform the contract. We keep invoices and accounting records for ten years because the law requires it.

4. Legal bases

In Switzerland, we process personal data in accordance with the Swiss Federal Act on Data Protection (FADP): transparently, proportionately and only for the purposes stated here. Where consent is required, we obtain it.

For users in the EU and the EEA, we rely on these legal bases under the GDPR:

Our legitimate interest is a secure, reliable and economically viable service. You can object at any time to processing based on it (Section 9).

5. Children and teenagers

You can open your own account from the age at which you may decide about your own data in your country. Depending on the country, this is between 13 and 16; the table below lists the limits. If you are younger but at least 13, you need a parent’s consent for an account. If you are under 13, you use the app without an account, and your collection stays on your device.

To obtain consent, we send a parent an email with a confirmation link. We store the email address and when consent was given. Parents can withdraw their consent at any time and have the account deleted.

Before we collect any data, we ask for your month and year of birth the first time you open the app. Where Apple or Google reports an age range to us, for example in certain US states, that age range takes precedence. We use this information only to apply the age rules.

For users under 16, there is neither usage analytics nor ad measurement, and we do not request any consents.

We do not collect personal data from children under 13, except the technical data needed to operate the app (Section 3.10). If we learn that we have received such data anyway, we delete it. Parents can reach us about this at privacy@nikiwa.app.

6. Who receives your data

We share personal data only if it is necessary for the service, if the law requires it or if you want us to:

• Service providers, who work on our behalf and are contractually bound by our instructions:
  • Cloudflare, Inc. (USA): servers, storage of images and photos
  • [Neon] (USA): database, stored in [Region]
  • Postmark, AC PM LLC (USA): sending emails
  • Google (Ireland and USA): mailboxes for support and privacy requests (Google Workspace)
  • Apple and Google: sign-in with Apple or Google, push notifications
  • [Analyse-Anbieter]: usage analytics and crash reports, only with consent
  • People who develop and operate the app on our behalf, partly from changing countries outside Switzerland and the EU, currently Indonesia: development, maintenance and security
• Other users: what you show in your public profile, your showcases and your Lounge (Sections 3.4 and 3.5).
• Our representatives in the EU, to the extent they receive requests on our behalf: under the GDPR the representative named in Section 1, under the Digital Services Act (DSA) Prighter DSA GmbH in Vienna.
• Authorities and courts, if we are legally required to do so or if it is necessary to protect rights.
• Advertising platforms, only with your consent: [Werbeplattformen] and our measurement service [Messdienst], for ad measurement (Section 3.13).
• An acquirer, if the company is sold (Section 11).

We do not sell personal data and do not pass it on to data brokers. Data goes to advertising platforms only with your consent, so that we can measure and manage our own advertising. We do not show personalized ads in the app.

7. Transfers abroad

We are based in Switzerland. Our service providers also process data in the EU and in the United States; the database and private photos are stored in [Region]. Switzerland and the EU recognize each other as having adequate data protection.

We transfer data to the United States to recipients certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework, or on the basis of the standard contractual clauses of the European Commission, which the Federal Data Protection and Information Commissioner (FDPIC) also recognizes. You can get a copy of the clauses on request.

The advertising platforms process data in the United States and in other countries, some of which lack adequate data protection; at TikTok, for example, employees in China can access data. In those cases, the basis is standard contractual clauses or certification under the Data Privacy Framework.

People who develop and operate the app for us access data, in part from changing countries outside Switzerland and the EU, currently Indonesia, for example for maintenance and troubleshooting. For countries that Switzerland and the EU do not recognize as having adequate data protection, including Indonesia, the standard contractual clauses of the European Commission apply, with the adaptations for Switzerland.

For users in Japan and Québec, the notes in Section 13 also apply.

8. How long we keep data

This is subject to statutory retention obligations.

9. Your rights

You have the right to:

• know what data we process about you and receive a copy;
• have incorrect data corrected;
• have your data deleted;
• receive your data in a commonly used format or have it transferred;
• object to processing based on our legitimate interest;
• have processing restricted;
• withdraw consent at any time, with effect for the future.

You can do much of this directly in the app: under [Settings > Account], you can delete your account and download your data; under [Settings > Privacy], you can withdraw consents. You can also delete your account without the app at [Web-Link]. It is deleted 7 days after your request; until then, it is hidden from others, and you can undo the deletion.

For everything else, write to us at privacy@nikiwa.app. We respond free of charge and usually within 30 days. To make sure no one else receives your data, we first check that the request comes from you.

You can also file a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the authority in your country of residence.

10. Security

We protect your data with technical and organizational measures: connections are encrypted, and so is stored data. We store passwords only as a hash, and only people who need access for their work have it. If a data breach occurs nonetheless, we inform the authorities and, where necessary, you, as the law requires.

11. Sale of the company

If our company is sold in whole or in part or merged with another company, or if the business is transferred, your data may pass to the acquirer. The acquirer remains bound by this privacy policy. We will inform you in advance, and you can delete your account at any time. Prospective buyers receive no personal data before a contract is concluded, only aggregated figures.

12. Automated decisions

The app recognizes cards and estimates prices automatically. These are not decisions about you as a person. We always have a human make decisions that affect you legally, such as suspending your account.

13. Notes for specific countries

13.1 European Union and EEA

We have no establishment in the EU. Section 1 names our representative. You can file a complaint with the data protection authority in your country.

13.2 Switzerland

The competent authority is the Federal Data Protection and Information Commissioner (FDPIC) in Bern.

13.3 United States

We do not sell personal data. With your consent, we pass identifiers and events on to advertising platforms (Section 3.13). Under the laws of some states, this counts as “sharing” for advertising across apps and websites. You can stop this at any time: in the app under [Settings > Privacy] and on the website via “Cookie settings”. We treat a Global Privacy Control signal from your browser as an opt-out. We do not share any data of teenagers under 16.

Regardless of whether your state’s law already applies to us, you can exercise the rights in Section 9. We will not discriminate against you for doing so. If we decline a request, you can appeal within 45 days; we respond within 60 days.

We do not collect personal data from children under 13 (Section 5).

13.4 Canada and Québec

Section 1 names the person in charge for Québec. Your settings are set to the highest level of protection by default. Before we have personal data from Québec processed outside Québec, we assess whether it will be adequately protected there. When we anonymize data from Québec, we comply with the 2024 regulation.

You can ask us to give you your data in a commonly used format, and you can file a complaint with the Commission d’accès à l’information du Québec or the Privacy Commissioner of Canada.

13.5 Japan

We use your data only for the purposes described in Section 3. Your data is stored and processed in Switzerland, in EU countries and in the United States. The EU has a data protection system that Japan recognizes as equivalent. Switzerland has a comprehensive data protection law similar to the GDPR. In the United States, there is no general federal data protection law, only laws for specific sectors and individual states; our recipients there have contractually committed to safeguards. Before you open an account in Japan, we ask for your consent to this transfer.

You can ask us to disclose your data to you, correct it, stop using it or delete it. To do so, write to us at privacy@nikiwa.app; we respond without delay. You can also send complaints to Japan’s data protection authority, the Personal Information Protection Commission. On request, we will inform you about our security measures.

14. Changes to this policy

We update this policy when the app or the law changes. The current version is available in the app and at nikiwa.app. We will inform you of material changes in advance, in the app or by email. For new purposes that require consent, we will ask you first. We record which version you accepted, along with the date.

15. Languages

This policy is available in German, English, French and Japanese.