Privacy Policy

1. Controller and contact

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Dennis Herbrik
Weilimdorfer Straße 103
70469 Stuttgart
Germany

Email: dennisherbrik1988@gmail.com

2. Website access and server logs

When the website or its API is accessed, technically necessary request data may be processed, including the IP address, date and time, requested address, referrer, browser, operating system and response status. This is necessary to deliver the service, maintain stability and security, and detect misuse.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interests are the secure and reliable operation of UpLearn. Log data is retained only for as long as required for operation, security investigation or legal obligations; the specific period may depend on the hosting provider.

3. User accounts and Firebase Authentication

UpLearn uses Firebase Authentication, a service provided by Google, for registration, login and account management. Depending on the selected login method, the following data may be processed:

• Email address, display name and user ID
• Authentication credentials and security information
• Data provided through Google Sign-In, if you choose that option
• IP address, user agent and technical security data

Passwords are handled by Firebase Authentication and are not stored in the UpLearn application database. UpLearn stores the email address and display name needed to associate courses, learning progress and credits with an account. Authentication is necessary to provide the requested account functions; the legal basis is Art. 6(1)(b) GDPR. Security-related processing is also based on Art. 6(1)(f) GDPR.

For email-and-password accounts, Firebase sends email-verification and password-reset messages at the user's request. The links contain temporary action codes handled by Firebase. Access to authenticated UpLearn functions is permitted only after the email address has been verified.

Google may process authentication data outside the European Economic Area, including in the United States. Further information is available in Firebase's privacy and security information.

4. Learning content and AI-assisted generation and evaluation

To create learning material, you may provide learning goals, preferences, website addresses and PDF files. The backend extracts and combines relevant content and sends prompts containing this material to Azure OpenAI, a Microsoft Azure service. Generated flashcards, reading material, quizzes and other results are returned to UpLearn and may be saved as part of your learning course.

If you request an AI evaluation during Augmented Reading, the questions, your submitted answers and the reading content shown up to the current section are also sent to Azure OpenAI. The resulting assessment, score, feedback and suggested answer are stored with your learning run so that they can be displayed again later.

Only upload or submit material that you are permitted to process. Avoid including special categories of personal data or confidential information unless this is strictly necessary and you have a lawful basis to do so.

This processing is performed at your request to provide the learning-content generation service and is based on Art. 6(1)(b) GDPR. Security and abuse prevention may additionally be based on Art. 6(1)(f) GDPR.

Details about the provider's processing are available in Microsoft's Azure AI data privacy documentation.

5. Courses, uploads and learning progress

The following account-related content may be stored in the UpLearn backend:

• Course and module titles, descriptions, tags, goals and source references
• Extracted source content and generated learning material
• Uploaded course and flashcard images
• Game state, answers, AI evaluations, scores, completion status and learning progress
• Published-course, purchase, interest and credit information

Processing is necessary to save, display and synchronize the functions you request and is based on Art. 6(1)(b) GDPR. If you explicitly publish a course, its selected content and metadata may become visible to other users in the Store until you unpublish or delete it.

UpLearn does not use learning results to make decisions that produce legal or similarly significant effects within the meaning of Art. 22 GDPR.

6. Credits and payments with Stripe

Credit purchases are currently not available to the general public. Payment testing is restricted to the operator account and uses Stripe's test environment, which does not process real payments. If public live payments are introduced, this policy and the purchase information will be updated before that functionality is made available.

During an operator-initiated sandbox test, UpLearn and Stripe may process the test session or transaction identifier, test credit amount, status and association with the operator account. UpLearn does not receive or store complete card details.

For more information, see the Stripe Privacy Center.

7. Browser storage and essential technologies

UpLearn uses browser storage such as local storage and storage used by Firebase Authentication. This may contain an authentication session, user ID, email address, display name and local game settings or progress. These technologies are required to keep you signed in and provide the requested application state. The legal basis is Art. 6(1)(b) GDPR and, for secure operation, Art. 6(1)(f) GDPR.

The current frontend does not initialize optional analytics or advertising tracking. You can remove local data through the application's logout or account-deletion functions and through your browser settings. Removing it may sign you out or reset local progress.

8. Recipients and international transfers

Personal data is disclosed only where necessary to operate UpLearn or comply with law. Recipients may include:

• Hosting and infrastructure providers
• Google/Firebase for authentication
• Microsoft Azure and Azure OpenAI for AI-assisted learning-content generation
• Stripe and participating payment providers for payment processing
• Authorities or professional advisers where legally required

Some providers may process data outside the European Economic Area. Where required, transfers are based on an adequacy decision, the EU Standard Contractual Clauses or another safeguard permitted by Chapter V GDPR. The provider information linked above contains further details.

9. Storage and deletion

Personal data is retained only for as long as needed for the respective purpose:

• Account and learning data is generally stored while your account exists or until you delete the relevant course.
• Local browser data remains until logout, account deletion, application cleanup or manual browser deletion.
• Payment records may be retained for statutory accounting, tax and evidence periods.
• Security logs may be retained for a limited period or longer where an incident must be investigated.

The account settings provide a permanent deletion function for the account and associated UpLearn learning data. Data subject to mandatory statutory retention is restricted and deleted after the applicable period expires. Provider backup systems may require an additional technical deletion period.

10. Your rights

Subject to the legal requirements, you have the following rights:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with future effect where processing is based on consent (Art. 7(3) GDPR)

To exercise a right, contact the controller using the details above. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible at the controller's place of establishment is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

If you object under Art. 21 GDPR, please describe the processing concerned and the reasons arising from your particular situation.