Privacy Policy

This Privacy Policy explains how personal data is processed when you use the reichesdeutsch.de website, the app.reichesdeutsch.de web app, the “Reiches Deutsch” mobile apps, or related contact, contract, and payment functions.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Elisabeth Reichert
sole proprietor under German law (Einzelunternehmerin), trading as “Reiches Deutsch”
Kulenkampffallee 198
28213 Bremen
Germany
Email: kontakt@reichesdeutsch.de

2. Hosting, delivery, and server logs

The marketing website is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. When the website is accessed, server logs may process in particular the IP address, date and time, requested page or file, referrer, browser, operating system, amount of data transferred, and access status.

This processing is necessary to deliver the online service safely and reliably. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure, stable, and abuse-resistant operation of the service. Where a hosting company processes data on our behalf, this is based on an agreement under Article 28 GDPR.

The app and its application interface use a self-operated Supabase software stack at app.reichesdeutsch.de. Supabase is used as software; this alone does not transfer app data to Supabase, Inc. The production app-server infrastructure is also hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The specific deletion periods for its technical logs are still being reconciled with the production configuration.

3. Contact, forms, and abuse prevention

When you contact us by email or form, we process the data you provide. This may include your name, email address, optional telephone number or Telegram identifier, message, and technical transmission details. The contact form uses our own backend, Nodemailer, a simple CAPTCHA, and technical rate limits to protect against automated abuse. The IP address may be processed briefly to identify repeated requests.

The legal basis is Article 6(1)(b) GDPR where the request concerns a contract or pre-contractual steps. Otherwise, processing is based on Article 6(1)(f) GDPR; our legitimate interest is reliably answering requests and protecting the forms.

Messages are delivered to the business mailbox through email and SMTP infrastructure provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The technical retention periods are still being reconciled with the production configuration.

4. User account and authentication

When you register and use an account, we process in particular:

• email address and first name;
• internal user, profile, person, and role identifiers;
• authentication data, while the password is not stored in plain text;
• confirmation, login, recovery, and session information; and
• timestamps and technical metadata for security-relevant events.

The data is needed to create the account, enable login, verify authorisation, and protect the account. The legal basis is Article 6(1)(b) GDPR. Security-related logging may additionally be based on Article 6(1)(f) GDPR; the legitimate interest is protecting accounts and systems.

5. Onboarding and personalisation

To create a learning plan, we process the selected German level (A1 to B2), learning goal, desired daily learning time, current onboarding step, and onboarding completion time. This information is used to adapt content and the learning route to your selected goals.

The legal basis is Article 6(1)(b) GDPR. Personalisation does not result in a solely automated decision that produces legal effects concerning you or similarly significantly affects you.

6. Courses, learning progress, and app activity

To provide the learning services, we process in particular course enrolments, access rights, assigned subscriptions, completed lessons, the course progress calculated from them, and completion times. Quiz questions and answers are processed to run the quiz. Under the current technical implementation, personal quiz answers or individual quiz results are not permanently stored as a user-linked record.

For the seven-day activity display, the app records for each active calendar day the user identifier, local activity date, first and last observation time in UTC, and the device’s UTC offset. On a new activity observation, records older than the seven-day window are technically pruned. An additional maximum deletion period for cases where there is no later app activity is currently being defined for production.

The legal basis is Article 6(1)(b) GDPR, because the data is needed for course access, learning progress, and the requested activity functions.

7. Subscriptions and payments through Stripe

We use Stripe for monthly and annual app subscriptions. For customers in the European Economic Area, Stripe Payments Europe, Limited, Ireland, is responsible. Stripe processes payment, contact, transaction, device, and fraud-prevention data under its own responsibility and, where agreed, on our behalf. Complete card or bank-account details are not stored on our systems.

Our systems process in particular the Stripe customer identifier, subscription and price identifiers, selected plan, status, trial, billing, and cancellation dates, payment or invoice references, and webhook events needed for synchronisation. Processing supports contract formation, payment, activation, subscription management, and fraud prevention. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(c) GDPR for statutory accounting and evidence obligations. Security and fraud-prevention measures may be based on Article 6(1)(f) GDPR.

For more information, see Stripe’s Privacy Policy.

8. Personal teaching and learning support

When personal online teaching or learning support is requested or provided, we process contact details, learning goal, language level, scheduling, booked units, communications, submitted exercises, and feedback to the extent needed to offer and deliver the service. The legal basis is Article 6(1)(b) GDPR.

If an external video-conferencing, scheduling, or communication service is used, it will be identified before use. The service actually used in production and its privacy terms must be added to this Policy before the corresponding services begin.

9. App stores

When the mobile app is downloaded, Apple or Google, as operator of the relevant app store, may process data under its own responsibility, such as the store account, device identifier, IP address, download data, and diagnostic data. We have only limited influence over this processing. Under the current product model, paid Reiches Deutsch subscriptions are concluded through web checkout, not as in-app purchases.

More information:

• Apple Privacy
• Google Privacy Policy

10. Local storage, cookies, and similar technologies

The website currently uses no marketing or analytics cookies. The selection made in the cookie notice is stored in the browser under reiches_deutsch_cookie_consent_v1. Fonts are delivered locally.

The web and mobile apps store technically necessary information on the device, in particular the active authentication session, last-used email address, language setting, and display preferences. This supports login, security, and the app functions explicitly requested. The legal basis for access to technically necessary terminal-equipment information is Section 25(2) TDDDG; subsequent processing is based on Article 6(1)(b) or (f) GDPR.

Removing the app or deleting local browser data removes local data, but does not automatically cancel a subscription or delete server-side account data.

11. No external web analytics

We currently use no external analytics, advertising, or crash-tracking services such as Google Analytics, Meta Pixel, Plausible, Matomo, or Firebase Analytics on either the marketing website or the app. Technically necessary server logs, the functional seven-day activity display, and development logs are not advertising audience analytics.

12. External links and social media

The website contains ordinary links to external services, in particular Instagram, Telegram, Stripe, Apple, Google, and the web app. The relevant provider processes data under its own responsibility only when you follow such a link. As long as no external content is embedded, merely displaying our page does not establish a connection to these providers.

13. Termination, withdrawal, and other legal declarations

When you submit a termination, withdrawal, account-deletion request, or another legal declaration, we process the identification and contact details you provide, contract designation, content of the declaration, receipt date and time, requested termination date, and confirmation evidence. This supports processing and proving the declaration. The legal bases are Article 6(1)(b) and (c) GDPR, and Article 6(1)(f) GDPR for the establishment, exercise, or defence of legal claims.

An account-deletion request is initially recorded and reviewed. Statutory retention duties and data needed to administer an ongoing contract may prevent immediate complete deletion.

14. Recipients, processors, and third-country transfers

Access is limited to people who need it for operation, support, teaching, customer service, accounting, or legal duties. Depending on your use, data may also be disclosed to hosting and email providers, Stripe, and external platforms you choose. Authorities, courts, tax advisers, or legal advisers receive data only where legally required or necessary to enforce rights.

Where providers process data on our behalf, we enter into agreements under Article 28 GDPR where required. Stripe, Telegram, Apple, and Google may be independent controllers for their own processing and may process data in countries outside the European Economic Area. Where we are responsible for a third-country transfer, it is based on an adequacy decision, appropriate safeguards such as EU Standard Contractual Clauses, or a statutory derogation.

netcup GmbH provides the production infrastructure used for the marketing website, app server, email, and SMTP. Any communications provider used for personal teaching will be added before the corresponding services begin.

15. Retention

We retain data only for as long as needed for the relevant purpose. In principle:

• account data, learning progress, and rights are retained for the duration of the account or contract and then deleted or anonymised unless statutory duties prevent this;
• activity records are restricted to a seven-day window on the next activity request; an additional maximum period where no later use occurs is still being defined technically;
• contact and support messages are deleted after handling unless needed for a contract or legal evidence; the regular mailbox deletion period is still being set;
• contract, payment, invoice, and legally relevant communication records are retained in accordance with commercial and tax-law duties; and
• server and security logs are deleted when their security purpose ends; the specific periods for the production infrastructure are still being documented.

16. Your rights

Subject to the GDPR, you have in particular the right to:

• access under Article 15 GDPR;
• rectification under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR;
• object under Article 21 GDPR to processing based on Article 6(1)(e) or (f) GDPR; and
• withdraw consent with future effect under Article 7(3) GDPR.

To exercise your rights, contact kontakt@reichesdeutsch.de.

17. Right to lodge a complaint

You may lodge a complaint with a data-protection supervisory authority. The authority with particular responsibility for the Controller is:

The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen
datenschutz.bremen.de

18. Updates

We update this Privacy Policy when functions, providers, or legal requirements change. The current version is available on this website.