Privacy Policy

1. Privacy at a glance

This overview explains in simple terms what happens to your personal data when you visit or use DeutschWeg. Personal data is any data that can identify you. Details follow in the sections below.

Who is responsible? The website operator. Contact details are in section 3 under "Responsible party".

How do we collect your data? Partly you give it to us, for example when you register, write an exam answer or send us a message. Other data, mainly technical data such as your browser and the time of access, is collected automatically when you visit the website.

What do we use it for? To provide the website without errors, run your account, save your learning progress, give you feedback on your German and process purchases. We do not sell your data, show advertising or use tracking for advertising.

What rights do you have? You can at any time ask what data we hold about you, where it comes from, who receives it and why, and ask us to correct or delete it. You can withdraw consent at any time and complain to a supervisory authority. Details are in section 3.

2. Hosting

Website delivery. Our website is hosted by Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes your IP address, browser type, the requested page and the time of access in order to deliver the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, reliable website).

Application server. The server that runs our AI, grading and payment features is hosted by Render (Render Services, Inc., USA) in its Frankfurt, Germany region. Legal basis: Art. 6(1)(b) GDPR.

Database and login. Account and learning data is stored with Supabase (Supabase, Inc., USA) on servers in the European Union (Ireland). Legal basis: Art. 6(1)(b) GDPR.

These providers process data on our behalf as processors (Art. 28 GDPR) and only for the purposes described here.

3. General information and mandatory information

Data protection. We treat your personal data confidentially and in accordance with the data protection laws and this policy. Data sent over the internet can have security gaps; complete protection against access by third parties is not possible.

Responsible party (controller).
Angela Kimani
Schaumbergring 12
66538 Neunkirchen, Germany
Phone: +49 176 43767068
Email: hello@deutschweg.de

Storage duration. Unless a more specific period is stated below, we keep your data until its purpose ends: account and learning data until you delete your account or ask us to. If you request deletion or withdraw consent, we delete your data unless the law requires us to keep it (for example tax and accounting records for purchases, generally 6 to 10 years).

Legal bases. We process data on the basis of your consent (Art. 6(1)(a) GDPR), to perform our contract with you (Art. 6(1)(b) GDPR), to meet legal obligations (Art. 6(1)(c) GDPR) or for our legitimate interests (Art. 6(1)(f) GDPR). Storing information on your device is governed by § 25 TDDDG. The specific basis is named in each section.

Recipients. We share data only with the service providers named in this policy, and only as far as needed for the purpose described.

Transfers to the USA. Several providers named here are US companies, so data may be transferred to the USA. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the EU Commission's adequacy decision; otherwise it is based on the EU Standard Contractual Clauses.

Withdrawing consent. You can withdraw any consent you have given at any time. Processing up to the withdrawal remains lawful.

RIGHT TO OBJECT (ART. 21 GDPR). WHERE WE PROCESS YOUR DATA ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. WE WILL THEN NO LONGER PROCESS YOUR DATA UNLESS WE CAN SHOW COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.

Right to complain. You can complain to a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland.

Data portability. You can ask us to give you, or another controller, the data we process on the basis of your consent or our contract in a common, machine-readable format.

Access, correction and deletion. You have the right to free information about your stored data, its origin, recipients and purpose, and the right to have it corrected or deleted. Contact us at hello@deutschweg.de. We aim to respond within 30 days.

Restriction of processing. You can ask us to restrict processing, for example while we check whether your data is accurate or while an objection you raised is being reviewed.

Encryption. This website uses TLS encryption. You can recognise an encrypted connection by "https://" and the lock symbol in your browser.

4. Data collection on this website

Cookies and storage on your device. We do not use advertising or tracking cookies. We store only what is strictly necessary on your device (browser storage): your login session, your learning progress, exam answers you are working on, settings you choose (such as level or language) and whether you have seen a notice. Legal basis: § 25(2) No. 2 TDDDG (strictly necessary, no consent required) and Art. 6(1)(b) GDPR.

Server log files. Our hosting providers automatically record information your browser sends: browser type and version, operating system, referring page, IP address and time of the request. This data is not combined with other data. Legal basis: Art. 6(1)(f) GDPR.

Registration. To use the learning features you create an account with your name, email address, country and password (stored only as a secure hash). While you learn we store your progress, scores, exam answers including texts you write, transcripts of speaking practice and the feedback you receive, your learning goal, exam date and learning streak. Legal basis: Art. 6(1)(b) GDPR. We keep this data until you delete your account.

Where you came from. If you register after following a link in one of our articles or exercises, we store with your account which article you came from and which exercise you wanted to open (for example "blog-ausbildung" and "/sprechen"). We use this only to see which content helps learners get started. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving our content). You can object at any time (see section 3).

Visit statistics. We use Cloudflare Web Analytics (Cloudflare, Inc., USA) to count page visits. It sets no cookies and stores nothing on your device. Cloudflare processes your IP address briefly to produce aggregated statistics (page, referring website, country, browser, device type) and does not use it to identify you. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the website). You can object at any time (see section 3).

Password reset email. If you request a new password, our database provider Supabase sends you an email with a reset link. We send no other emails and no newsletters.

Enquiries via chat or email. If you send us a message through the chat on our homepage, we store your email address, your message and your browser type in order to reply. If you email us, we process your email address and message. Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete enquiries 12 months after the conversation ends.

5. Fonts and software libraries

We serve our fonts and the software libraries the website needs from our own domain. Your browser does not connect to Google Fonts or other third-party servers to load them.

6. AI-based learning features

Several features use AI providers. Our server sends them only what the feature needs. Under the providers' terms for business API use, data sent through their APIs is not used to train their models by default.

• Anthropic (Claude), USA: grading of writing tasks and exam answers, the AI Pal and AI Tutor, the dictionary and feedback on speaking practice. We send the text you enter, your level and the conversation. For the AI Pal we also send your first name, your learning streak, words you have learned and, if you choose to answer it, how you are feeling today.
• OpenAI, USA: the live speaking simulation. Your voice is streamed to OpenAI in real time to run the conversation and create a transcript. We store the transcript and feedback, not the audio.
• ElevenLabs, USA: creates the German audio for listening exercises from exercise text. No personal data is sent.

Legal basis: Art. 6(1)(b) GDPR. AI feedback and scores are practice aids. They have no legal effect and are not automated decisions within the meaning of Art. 22 GDPR.

7. Payments

Purchases are handled by Lemon Squeezy (Lemon Squeezy, LLC, USA), which acts as the seller (merchant of record) and is itself responsible for the payment data it collects: name, email, billing address and payment details. Its own privacy policy applies. We pass Lemon Squeezy only your DeutschWeg user ID and the product you choose, and receive an order number so we can unlock your level. Legal basis: Art. 6(1)(b) GDPR.

8. Children

DeutschWeg is not intended for children under 16. We do not knowingly collect their data.

9. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version.