Privacy Policy
This policy explains what data we collect, how we use it, who we share it with, and what rights you have. Applicable to users who have reached the digital consent threshold in their country.
This policy applies to users who have reached the digital consent threshold in their country. If you are a minor, please see our Privacy Policy for Minors.
1. Data controller
NutQuest is the controller of your personal data. For any privacy-related queries, please contact us at legal@nutquest.app.
2. What data do we collect?
2.1. Data you provide directly to us
- Registration: email address, alias (username), date of birth and password (stored as an encrypted hash). If you sign up with Google or Apple, we receive your unique identifier, email address and associated name; never your password.
- Preferences: selected language and chosen personality for the character Ratatoskr.
- User Content: free text, PDFs and images you contribute to create Worlds. This material is used exclusively during generation and is permanently and irrecoverably deleted once complete. NutQuest does not retain the original material.
- Tutor Interactions: conversations with Ratatoskr are stored while your account is active to maintain your history and improve your experience.
- Moderation data: if you report a World or receive a warning, incident identifiers are recorded (never the content in plaintext).
2.2. Data generated by your use of the Service
- Progression and metrics: correct answers, mistakes, response times, completed levels, streaks, league positions and game statistics.
- In-game economy: virtual currency balance, item inventory, transaction history and Premium Plan purchases.
- Social data: friends list, invitations, league and multiplayer participation. Only your alias, avatar and basic statistics are visible to other users; never your email address or date of birth.
2.3. Technical data collected automatically
- Device: platform (iOS/Android/Web), device language and push notification tokens (Firebase Cloud Messaging).
- Session: date and time of last access, date of last energy regeneration.
- Payment: if you purchase the Premium Plan via the web, Stripe processes the payment; NutQuest stores only the Stripe customer and subscription identifier, never your card details. In-app purchases through stores (App Store / Google Play) are managed directly by those stores.
2.4. Data we do NOT collect
NutQuest does not collect your real name (unless you choose it as your alias), postal address, phone number, biometric data, precise geolocation or photographs of yourself. Images uploaded to create Worlds are passed through filters that automatically reject faces and identifiable images.
3. How do we use your data and what is the legal basis?
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account, authenticating you and managing your profile | Email, alias, date of birth, password/OAuth, preferences | Performance of a contract (Art. 6.1.b GDPR) |
| Generating Worlds using AI | User Content (ephemeral), Tutor queries | Performance of a contract (Art. 6.1.b GDPR) |
| Maintaining conversational Tutor history | Conversations with Ratatoskr | Performance of a contract (Art. 6.1.b GDPR) |
| Managing progression, leagues, multiplayer and the in-game economy | Metrics, statistics, economic data, social data | Performance of a contract (Art. 6.1.b GDPR) |
| Processing Premium Plan payments and Virtual Currency | Stripe identifiers, subscription data | Performance of a contract (Art. 6.1.b GDPR) |
| Sending push notifications | FCM tokens, platform | Performance of a contract (Art. 6.1.b GDPR) |
| Operational email communications (verification, moderation) | Performance of a contract (Art. 6.1.b GDPR) | |
| Moderating content and ensuring platform security | Incident identifiers, hashes | Legitimate interest (Art. 6.1.f GDPR): platform security |
| Non-personalised contextual advertising (free plan) | Screen context (no profile) | Legitimate interest (Art. 6.1.f GDPR) |
| Personalised advertising (adults only, with consent) | Usage data managed by AdMob | Consent (Art. 6.1.a GDPR), managed by CMP/UMP |
| Retaining anonymised Freemium user metrics for Service improvement | Generated content and metrics, irreversibly anonymised | Anonymised data is not personal data (Recital 26 GDPR) |
| Complying with legal obligations | Transaction data, moderation records | Legal obligation (Art. 6.1.c GDPR) |
4. Transformative processing: what we do with your material
NutQuest radically transforms the material you contribute into educational content of a completely different nature: exercises, study cards, mini-games, podcasts and summaries. The Service does not copy, reproduce or store your original material. The source is permanently deleted after the World has been generated. Only the transformed content (owned by NutQuest) and a dense summary for the Tutor are retained.
To carry out this transformation, your material is transmitted to AI Providers during the generation process. NutQuest has signed a Data Processing Agreement (DPA) with each provider prohibiting them from using your data for their own purposes or for training their models.
5. Who do we share your data with?
| Recipient | Data | Purpose | Safeguards |
|---|---|---|---|
| Google (Gemini / Vertex AI) | User Content (ephemeral), Tutor queries | World generation and Tutor responses | EU/US — DPA + SCCs / EU-US DPF. No training. |
| Mistral | User Content (ephemeral), queries | Content generation and processing | France (EU) — DPA. No international transfer. |
| Groq | User Content (ephemeral), queries | Generation and processing | US — DPA + SCCs / DPF. No training. |
| Fireworks | User Content (ephemeral), queries | Generation and processing | US — DPA + SCCs / DPF. No training. |
| Tavily | AI-generated search queries | “Expand content” feature | DPA signed. No access to direct personal data. |
| Google AdMob | Device advertising identifiers (adults with consent; contextual for minors) | Advertising on the free plan | Google Ads policies. Consent managed by UMP. |
| Firebase (Google) | FCM tokens, platform | Push notifications | Google infrastructure. No content data. |
| Stripe | Payment data (processed by Stripe; NutQuest stores only identifiers) | Web Premium Plan and Virtual Currency payments | PCI DSS certified. NutQuest never sees or stores card data. |
| Apple App Store / Google Play | In-app payment data (managed entirely by the Stores) | In-app purchases | Each Store’s policies. |
| Cloudflare | Web traffic data (CDN, DNS, DDoS protection) | Network infrastructure and security | Cloudflare DPA. Transit data. |
| Google Cloud Platform | All Service data | Backend hosting | europe-southwest1 region (Madrid, EU). Google Cloud DPA. |
NutQuest does not sell personal data to third parties nor share it for advertising purposes beyond the Ad Network (and only with your consent for personalised advertising, if you are an adult).
6. International data transfers
Your data is hosted on Google Cloud servers in the europe-southwest1 region (Madrid, European Union). When transmitted to providers located outside the EEA (Groq, Fireworks in the US), NutQuest applies the safeguards of Article 46 GDPR: Standard Contractual Clauses (SCCs) and, where applicable, EU-US Data Privacy Framework certification. Mistral, located in France, requires no international transfer.
7. How long do we retain your data?
| Category | Retention period |
|---|---|
| Account data (email, alias, preferences) | For as long as your account is active. Deleted when the account is closed. |
| Source material you contribute (text, PDF, images) | Ephemeral: permanently deleted after World generation. |
| Generated Content and dense World summary | For as long as the World exists. Deleting the World deletes its content and embeddings. |
| Conversational Tutor history | For as long as your account is active. You may request deletion at any time. |
| Learning metrics and progression | For as long as your account is active. |
| Economic data (transactions, subscriptions) | For as long as your account is active and for the legally required period for tax obligations after closure. |
| Moderation records | Identifiers and metadata (no plaintext content) retained for traceability. Worlds under review purged after 90 days if unresolved. |
| FCM tokens | While active; revoked on sign-out or account closure. |
| Inactive accounts | NutQuest may delete accounts with no access for 24 consecutive months, following prior email notification. |
| Anonymised Generated Content and metrics (Freemium) | Retained indefinitely as non-personal data (irreversible anonymisation). Premium and Enterprise users excluded. |
When you close your account, all your personal data is deleted. Public Worlds are retained in anonymised form in accordance with the Terms of Use. Economic transactions are retained for the legally required tax period.
8. Your rights
Under the GDPR, you have the right to:
- Access: obtain a copy of the personal data we process about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of your data. You can close your account at any time from within the app, which triggers actual deletion of your data.
- Restriction: request that we restrict the use of your data in certain circumstances.
- Portability: receive your data in a structured, commonly used format.
- Objection: object to processing based on legitimate interest.
- Withdrawal of consent: where processing is based on your consent (e.g. personalised advertising), you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.
To exercise these rights, contact legal@nutquest.app. We will respond within one month, extendable to two months in cases of complexity.
If you believe the processing of your data is not compliant, you may lodge a complaint with the Spanish Data Protection Authority (AEPD) or with the supervisory authority in your country of residence.
9. Advertising and cookies
The free tier is financed by advertising served by the Ad Network (Google AdMob). For adult users in the European Union, your consent is requested before serving personalised advertising through the Consent Management Platform (CMP/UMP) integrated in the app. You can change your preferences at any time from within the settings.
Essential cookies and equivalent technologies necessary for the operation of the web Service (authentication, session) do not require consent. Non-essential cookies are only activated with your prior consent. See our Cookie Policy for more detail.
10. Security
NutQuest applies technical and organisational measures to protect your data: password encryption (bcrypt), storage on Google Cloud infrastructure with security certifications, encrypted communications (HTTPS/TLS), token-based authentication with expiry, role-based access control and automated content monitoring.
11. Additional guarantee for Premium and Enterprise users
Premium Plan and Enterprise users have an additional contractual guarantee: neither their Generated Content nor their usage metrics are used for model improvement or for training proprietary or third-party artificial intelligence systems.
12. Changes to this policy
NutQuest may update this Privacy Policy. Material changes will be communicated through the app’s news system and, where appropriate, by email. The current version will always be available at nutquest.app/en/legal/privacy/.