NewsNossaNewsNossa — Privacy Policy
Version: 1.0 — 2026-04-22 Controller: SchoolNossa OÜ ("NewsNossa", "we", "us", "our"), Tornimäe tn 5, 10145 Tallinn, Estonia (registry code 17422998). Contact / data protection: privacy@heimnossa.com Audience: Users in the European Union and the United Kingdom.
⚠️ Draft document. This text is a starting point intended for qualified legal review before publication. It is not legal advice. The rights of EU and UK data subjects are mandatory and override anything here that conflicts with them.
Updated 2026-10-31 for SchoolNossa OÜ, an Estonian company: record retention and the lead supervisory authority now follow Estonian law. Have a lawyer confirm the text before publication.
This Privacy Policy explains what personal data we collect, why, and what rights you have. It applies to your use of the NewsNossa application ("Service"). It is provided alongside our Terms of Service.
1. Who is the controller?
SchoolNossa OÜ, with registered seat at Tornimäe tn 5, 10145 Tallinn, Estonia, is the controller of the personal data we process about you. You can contact us at privacy@heimnossa.com for any privacy question, to exercise your rights, or to lodge a complaint internally before contacting your supervisory authority.
2. What data we collect, and why
| Category | Examples | Lawful basis | Retention |
|---|---|---|---|
| Account data | Email, display name, profile photo URL, authentication-provider ID (Apple/Google) | Performance of contract (Article 6(1)(b) GDPR) | Until you delete your account, then 30 days |
| Configuration content | Briefing titles, descriptions, topics, industries, regions, monitored entities, schedule | Performance of contract | Until you delete the briefing, then 30 days |
| Generated content | Audio briefings, transcripts, chapter metadata, source links, generated images | Performance of contract | Up to 12 months unless you keep accessing the briefing |
| Playback data | Playback position, completion state, default speed, speed per episode | Performance of contract; legitimate interest in product analytics (Article 6(1)(f) GDPR) | Until you delete your account, then 30 days |
| Wallet data | Credit balance, lifetime earned, lifetime spent, transaction history | Performance of contract; legal obligation for accounting (Article 6(1)(c) GDPR) | 7 years (Estonian Accounting Act) for transactional records |
| Push tokens | Firebase Cloud Messaging tokens for the devices you install on | Consent (Article 6(1)(a) GDPR) | Until you sign out or revoke notifications |
| Diagnostic data | Crash traces, performance metrics, error reports — only when you opted in via Settings → Privacy | Consent (Article 6(1)(a) GDPR) | 90 days |
| Product analytics | Anonymous event metrics — only when you opted in via Settings → Privacy | Consent | 14 months |
| Acceptance audit | The version of the Terms of Service and this Privacy Policy you accepted, with timestamp and platform | Performance of contract; legal obligation to demonstrate consent | 5 years after account closure |
We do not collect or process special categories of data (Article 9 GDPR) for any product feature. Avoid entering such data into briefing configurations.
3. How we collect data
- Directly from you — when you sign up, configure a briefing, generate audio, purchase credits, or change Settings.
- Automatically — playback events, the OS-level locale, the app version, your device platform.
- From service providers — Apple, Google, and RevenueCat report purchase confirmations, subscription status, and authentication results.
We do not buy personal data from data brokers and we do not enrich your profile from external sources.
4. Where data is stored, and processors we use
We rely on the following processors. They act on our instructions under written data-processing agreements compliant with Article 28 GDPR:
| Processor | Purpose | Region |
|---|---|---|
| Google Firebase | Authentication, Firestore database, file storage, Cloud Messaging, and opt-in Analytics and Crashlytics diagnostics | EU (europe-west* regions where supported) |
| Google Cloud / Vertex AI | Article retrieval, summarisation, text-to-speech | EU multi-region with sub-processor flow under EU SCCs |
| RevenueCat | Purchase mediation, subscription state | United States — EU SCCs in place |
| Apple App Store / Google Play | Purchase processing, store-side billing | Apple/Google's published regions |
Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where available, supplementary measures (encryption in transit, at rest, and at the application layer).
5. Generated content and AI processing
When a briefing is generated, your Configuration Content is sent to our generation pipeline. Public news articles are retrieved, classified, de-duplicated, and summarised using large language models. The resulting script is converted to audio. Chapter images are generated by a text-to-image model.
We do not use your Configuration Content, your audio listening history, or any other personal data to train, fine-tune, or evaluate any artificial-intelligence model.
Briefings are produced by automated systems and may contain errors. See the Terms of Service for the operational consequences of that.
6. Sharing of data with other users
If you publish a briefing under shared briefings:
- Other users can see the briefing's title, description, owner display name, frequency, and aggregate subscriber count;
- Subscribers can listen to the briefing's audio and read the chapter metadata and source links;
- Subscribers cannot see the underlying topic / industry / region / entity Configuration Content;
- Your other personal data (email, photo, settings, listening history) is not shared.
You can unpublish a shared briefing at any time. Unpublishing stops new subscriptions; existing subscribers' billing is closed at the end of the current cycle.
7. Notifications
If you opt into notifications, we send push messages through Firebase Cloud Messaging when a briefing run is ready, when a subscribed shared briefing has new audio, and (where Settings allow) when a download is complete. You can revoke this consent at any time in your operating- system settings or in Settings → Notifications.
8. Cookies and similar technologies
The mobile app uses on-device storage (Shared Preferences and Firestore client cache) to keep you signed in and to cache your data for offline use. There are no advertising cookies, no advertising SDKs, and no cross-site trackers. The web build of the app, where available, uses strictly-necessary first-party cookies for authentication only.
9. Your rights as a data subject
Where the GDPR or UK GDPR applies, you have the right to:
- Access the personal data we hold about you (Article 15);
- Rectify inaccurate data (Article 16);
- Erase your data — the "right to be forgotten" (Article 17);
- Restrict processing (Article 18);
- Portability — receive your data in a structured, machine-readable format (Article 20);
- Object to processing based on legitimate interests (Article 21);
- Withdraw consent for any processing based on consent, at any time, without affecting the lawfulness of prior processing (Article 7(3));
- Lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). You can also complain to the authority where you live or work — for example the data-protection authority of your federal state in Germany, or the Information Commissioner's Office (ICO) in the UK.
To exercise any of these rights, contact us at privacy@heimnossa.com. We respond within one calendar month of receipt; we may extend by two further months for complex requests and will tell you if so.
You can delete your account directly from the app. Account deletion triggers erasure of personal data within 30 days, except where we are required to retain specific records (for example transactional records under the Estonian Accounting Act, Raamatupidamise seadus).
10. Automated decision-making
We do not subject you to decisions producing legal or similarly significant effects that are based solely on automated processing, within the meaning of Article 22 GDPR.
11. Security
We implement technical and organisational measures including:
- TLS encryption for data in transit;
- encryption at rest at the storage layer (Google Firebase / Cloud Storage defaults);
- Firestore Security Rules restricting reads and writes to authenticated owners or subscribers;
- restricted access for our personnel on a need-to-know basis;
- review of access logs, and incident-response procedures.
We will notify the supervisory authority within 72 hours of becoming aware of a personal-data breach where the breach is likely to result in a risk to your rights and freedoms (Article 33 GDPR), and we will notify you directly where the risk is high (Article 34).
12. Children
The Service is not directed at children under 16, and we do not knowingly process personal data of children under 16. If you believe a child has registered, contact us so we can delete the account and the related data.
13. Changes to this Policy
We may update this Privacy Policy. The current version is always shown in the app. Where a change materially expands the data we collect or the purposes for which we use it, we will request your renewed consent or notify you in advance.
Effective version: 1.0 — 2026-04-22.