Privacy policy

Last updated: 16 Oct 2026

This privacy policy applies to the website nixtier.ai-design-thinking.de and the children’s app NixTier for Android (the version from our website). It describes which personal data we process, for what purpose and on what legal basis (Art. 13 GDPR). The German version is authoritative.

In short

• The app collects no data about your child. Pet, name, care, steps and settings stay on the device.
• No account, no advertising, no analytics, no trackers, no cookies.
• If you buy extras, we need your e-mail address – only for the code and the receipt.

1. Controller

Victor von Rautenberg
Pfarrer-Theile-Str. 97
13591 Berlin
Germany

E-mail: admin@ai-design-thinking.de

We have not appointed a data protection officer; there is no obligation to do so.

2. Hosting

The website and the app server run on a server at Hostinger (data centre in Germany). The contractual partner is Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaka, Cyprus. Hostinger processes the data exclusively on our behalf (processing on behalf of the controller under Art. 28 GDPR).

3. Visiting the website

Each time a page is accessed, the server processes technically necessary data:

• IP address
• date and time
• requested address (URL) and status code
• browser identifier (user agent)

This data is kept in an access log, which is deleted after 48 hours; address parameters such as codes and order numbers are not stored in it. The purpose is secure and stable operation, in particular the defence against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is precisely this secure operation.

To protect against misuse, an IP address is temporarily blocked in the event of an unusually high number of requests or repeated failed attempts, for no more than 2 hours.

The website sets no cookies and stores nothing in your browser (not even Local Storage). There are no analytics or statistics services, no advertising, no social media plug-ins and no third-party content; fonts, images and scripts come from our own server.

The “unlock code” page (/code) reads the code in the browser only, from the part of the address after “#”. This part is never transmitted to our server.

4. The NixTier app

NixTier is our children’s app for Android. The app collects no data about your child: pet, name, care, steps and settings stay on the device and are not backed up to the cloud. There is no account, no advertising, no analytics and no trackers.

Steps are counted by the device’s step sensor, only while the app is open. No location is used. The camera is used only in the parent area to scan the QR code from the purchase e-mail; the images are analysed in memory only, not stored and not sent.

The app uses the internet only to look for updates (version file; the new app file only after you confirm in the parent area), to check an unlock code when it is redeemed, and to load the list of cancelled codes (at most once a day). Only the code is sent – no device ID, no cookies, no data about your child. Our server technically sees the IP address; it is in the access log and is deleted after 48 hours (section 3). For each code we count only how often it was redeemed and the day it was last redeemed – without IP address and without device. The legal basis is Art. 6(1)(f) GDPR (secure operation, protection against misuse of codes).

5. Buying extras (by parents only)

On our purchase page you enter your e-mail address. We use it only to send you the unlock code and the receipt, and pass it to Stripe together with product, price and order number. We also store the times of your confirmations (terms, being of age, consent to immediate performance and acknowledgement of losing the right of withdrawal). The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for proof of the confirmations.

Payment takes place on Stripe’s payment page. Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, processes your payment data (e.g. card or PayPal data) as an independent controller. Information on this: https://stripe.com/de/privacy – From Stripe we receive the payment status, amount and identifiers of the transaction. We do not receive card data.

As soon as the e-mail with the code has been sent, we delete the address in plain text. We keep only an encrypted check value (HMAC with a secret server key), which lets us match “Resend code” and a withdrawal to your order, and a short form such as “e…@example.org”. For unpaid orders we delete the address after 24 hours and the order after 30 days. We do not store the unlock code itself; we can regenerate it from the order data.

The order data of paid purchases (product, price, times, order number, Stripe identifiers, check value of the address) are accounting records and are kept for 10 years (§ 147 AO, § 257 HGB; Art. 6(1)(c) GDPR).

6. Resend code

You enter the address used for the purchase; we compare only the check value and send the codes exclusively to that address. We do not disclose whether there are purchases for an address. We do not store the address entered permanently; to limit repeated requests only its check value is kept in memory for up to 24 hours. The legal basis is Art. 6(1)(b) GDPR.

7. Withdrawal

If you use the withdrawal function (“Withdraw from contract” button), we process your name, your e-mail address, where applicable the order number and your note, and the time, in order to handle and document the withdrawal. You receive an acknowledgement of receipt by e-mail; the operator receives an internal notification. The legal basis is Art. 6(1)(c) GDPR; we retain this information for 10 years (§ 147 AO, § 257 HGB).

8. Sending e-mails

E-mails (unlock code and receipt, resent codes, acknowledgement of a withdrawal) are sent via the mail server of Hostinger (smtp.hostinger.com), likewise on our behalf under Art. 28 GDPR. The e-mails contain no tracking pixels; the logo and the QR code are embedded or come from this server.

9. Storage periods

10. Disclosure, third countries, profiling

We do not share your data with third parties, except with Hostinger as a processor and with Stripe for purchases. We ourselves do not transfer any data to countries outside the EU. Stripe may also transfer data to the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework. There is no automated decision-making and no profiling (Art. 22 GDPR).

11. Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

You delete the data in the app yourself by uninstalling NixTier or choosing “Reset pet” in the parent area. For everything else, an e-mail to admin@ai-design-thinking.de is sufficient.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, https://www.datenschutz-berlin.de