Privacy Policy
Last updated: October 2026
This policy explains which personal data NoelleHUB processes when you visit noellehub.org and when you use your account, why we do it, and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
Niklas Noetzel, NoelleHUB
c/o IP-Management #3628, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany
Email: info@noellehub.org
We are not required to appoint a data protection officer. For all privacy questions, write to info@noellehub.org.
2. Visiting the website
When you open a page, your browser sends technical data to our hosting provider: IP address, date and time, page requested, referrer, browser and operating system. This is needed to deliver the website and to keep it secure (Art. 6(1)(f) GDPR – legitimate interest in a stable and secure website). Server logs are deleted automatically after a short time (at most 30 days).
We do not use analytics, advertising or tracking tools, and we do not create user profiles for marketing. Fonts are served from our own server.
3. Your account
To create an account we collect:
- email address and password (the password is stored only as a secure hash),
- first and last name,
- billing address (street, postal code, city, country) – for invoices,
- optionally, a profile picture that you upload under “Account” (see section 5),
- the time at which you accepted this privacy policy and, when you start a membership or free trial, the time of your consent to immediate access and your acknowledgement that the right of withdrawal expires (also stored with the subscription at Stripe).
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for invoice data, our legal obligation to keep accounting records (Art. 6(1)(c) GDPR).
We send emails that are required for your account and membership (confirming your email address, resetting your password, the confirmation of your membership, the confirmation of a cancellation and important information about your membership). We do not send newsletters without your separate consent.
4. Payment and membership
Payments are processed by Stripe. When you start a membership, you enter your payment details directly at Stripe; we never see or store your full card or bank details. We receive from Stripe: customer ID, membership status, start and end dates, invoices and the last four digits of the payment method.
Legal basis: Art. 6(1)(b) GDPR; retention of invoices and accounting records as required by tax law (Art. 6(1)(c) GDPR, § 147 AO).
If you cancel via “Cancel membership”, we process your name, email address, the type of cancellation and, if given, your reason, to carry out the cancellation and confirm it to you (Art. 6(1)(b) and (c) GDPR).
Stripe also processes data under its own responsibility, for example for fraud prevention and to meet legal requirements: stripe.com/privacy.
5. Study features
When you use the learning features, we store the following, linked to your account:
- personal notes you write under questions,
- questions you add to Active Recall, their review schedule, and your review history and progress statistics,
- comments and replies you post in discussions.
Notes, review data and statistics are visible only to you. Comments are visible to all members together with your first name and the initial of your last name (e.g. “Peter G.”), a contribution badge and your profile picture, if you uploaded one. You can delete your own comments at any time.
Comments from the previous version of NoelleHUB (2020–2026) were carried over into the discussions, shown with the first name and the initial of the last name as they appeared there (Art. 6(1)(f) GDPR – keeping the discussions complete for all members). If you wrote one of these comments and want it removed or anonymised, write to info@noellehub.org and we will do so promptly.
Uploading a profile picture is voluntary. It is reduced to a small square image, stored with Supabase (see section 10) and shown next to your comments to other members and next to your messages in the chat. You can change or remove it at any time under “Account”; the old picture is deleted. Legal basis: Art. 6(1)(a) GDPR (your choice to upload it).
Legal basis: Art. 6(1)(b) GDPR – these features are part of the membership.
6. One device at a time
A membership may be used on one device at a time. For this, your browser stores a random device identifier (in local storage), and we store which device is currently active and when it was last seen. We do not collect hardware information or fingerprints.
Legal basis: Art. 6(1)(b) GDPR (the membership is personal and for use on one device at a time) and Art. 6(1)(f) GDPR (protection against account sharing). Storing the identifier in your browser is strictly necessary for this service you requested (§ 25(2) no. 2 TDDDG).
7. Cookies and local storage
We only use technically necessary storage:
| Name / type | Purpose | Duration |
|---|---|---|
| Login cookies (sb-…) | keep you logged in | until logout or expiry of the session |
| NH_DEVICE (local storage) | one device at a time (section 6) | until you clear your browser data |
| nh-whats-new-seen (local storage) | remember that you closed the “What’s new” message | until you clear your browser data |
| nh-last-subject-… (local storage) | show the subject you opened last (“Continue where you left off”) | until you clear your browser data |
| nh_chat (cookie) | keep your chat if you are not logged in | 6 months |
| nh-chat-started (local storage) | show new replies in the chat button | until you clear your browser data |
No consent is required for these (§ 25(2) no. 2 TDDDG). We do not use marketing or analytics cookies.
8. Embedded videos and external links
Some pages contain YouTube videos. They are only loaded after you click on them; before that, no connection to YouTube is made. When you click, your browser connects to YouTube (Google Ireland Ltd.), which receives your IP address (Art. 6(1)(a) GDPR, § 25(1) TDDDG – your click). Links to other websites open in a separate window; their privacy policies apply there.
9. Contact by email and live chat
If you write to us, we process your message and email address to answer you (Art. 6(1)(b) or (f) GDPR) and delete the correspondence when it is no longer needed, unless retention periods apply.
The chat on our website is our own service (no external chat provider). When you send a chat message, we store your name, email address, your messages and the page you wrote from, and forward each message to our mailbox (Zoho, see section 10). When we answer, you see the answer in the chat and receive an email notification. Legal basis: Art. 6(1)(b) GDPR (questions about a contract or membership) and Art. 6(1)(f) GDPR (answering your enquiry). Chats are deleted when they are no longer needed, at the latest 2 years after the last message.
10. Service providers
We use the following processors under data processing agreements (Art. 28 GDPR):
| Provider | Purpose | Location of data | Safeguard for transfers outside the EU |
|---|---|---|---|
| Vercel Inc., USA | website hosting, server logs | worldwide edge network | EU–US Data Privacy Framework, Standard Contractual Clauses |
| Supabase Inc., USA | database, login, file storage | EU (Stockholm, Sweden) | Standard Contractual Clauses for access from outside the EU |
| Stripe Payments Europe Ltd., Ireland | payment processing | EU; also USA | EU–US Data Privacy Framework, Standard Contractual Clauses |
| Zoho Corporation B.V., Netherlands | sending and receiving email | EU data centre | – |
11. How long we keep data
- Account, profile and study data: until you delete your account.
- Comments: until you delete them or your account; replies by others in the same thread remain.
- Invoices and accounting records: as required by tax law (currently 8 years, § 147 AO).
- Server logs: at most 30 days.
- Suspended review cards are deleted automatically after 30 days without changes.
After you delete your account, data is removed within 30 days; backups are overwritten in the regular cycle.
12. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Write to info@noellehub.org.
You also have the right to lodge a complaint with a supervisory authority, for example the authority where you live or the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
13. Minimum age
NoelleHUB is intended for university students and is not directed at children.
14. Changes
We update this policy when our services or the law change. The current version is always available on this page.