1. Data Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):
Academee E-Learning
Represented by: Tom Schmitt
Sternenburgstraße 78, 53115 Bonn, Germany
Email: support@tryacademee.com
Data Protection Contact: datenschutz@tryacademee.com

2. Legal Bases for Processing

We process personal data strictly in accordance with the provisions of the GDPR:

• Performance of a Contract (Art. 6 (1) (b) GDPR): Account provision, conducting study sessions, generating learning worlds, calculating the FSRS spaced repetition schedule, and managing subscriptions.
• Consent (Art. 6 (1) (a) GDPR): Voluntary information in user profile (avatar, study program, target grades).
• Legal Obligation (Art. 6 (1) (c) GDPR): Statutory retention obligations for accounting and payment records under the German Commercial Code (HGB) and Fiscal Code (AO).
• Legitimate Interests (Art. 6 (1) (f) GDPR): Protection against brute-force attacks (rate limiting), platform security, and error monitoring.

3. Data Collection on This Website

Server Log Files: When accessing our website, the web server automatically records technical connection data (IP address, date and timestamp of the request, browser type, requested URL). This data is processed exclusively to guarantee trouble-free server operation and is deleted after 7 days.

Cookies & Local Storage (LocalStorage): We exclusively employ strictly necessary technical session cookies (session_token with HttpOnly and SameSite=Lax) to authenticate logged-in users. In your browser's LocalStorage, we store user-selected UI preferences (accent color, dark/light theme, language setting), which are never transferred to third parties.

4. Registration & User Account

During registration, we collect your email address and name. Passwords are never stored in plain text, but are hashed using the state-of-the-art, cryptographically secure Scrypt algorithm with an individual salt.

5. AI Learning World Generation (Google Gemini API)

When you upload lecture slides, PDF documents, or study notes, the text content extracted from these files is transmitted to the Google Cloud API via encrypted TLS connections. Passwords, payment information, or account master data are never shared with the AI.

Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Parent company: Google LLC, USA). Data transfers to the USA are safeguarded through Standard Contractual Clauses (SCC) approved by the EU Commission and certification under the EU-U.S. Data Privacy Framework.

6. Payment Processing (Stripe Payments & Stripe Tax)

For paid subscriptions (Student / Pro) and credit top-ups, we utilize the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

Payment details such as credit card credentials or SEPA banking data are entered directly into encrypted Stripe Checkout elements. We never store complete credit card information on our servers. To produce your invoice, your billing address is communicated to Stripe. As a small business under Section 19 UStG we charge no VAT and state none; the One-Stop-Shop (OSS) procedure is not used. Invoice receipts are retained for 10 years in compliance with Section 147 of the German Fiscal Code (AO).

7. Transactional Emails (Resend / SMTP)

For security-relevant system emails (Double-Opt-In verification, password resets, payment confirmations), we utilize transactional email delivery services. All transmissions are encrypted. Your email address is never used for unsolicited advertising without your explicit prior consent.

8. Your Rights as a Data Subject

Under the GDPR, you are entitled to comprehensive rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation and information regarding your personal data processed by us.
• Right to Rectification (Art. 16 GDPR): You can correct inaccurate personal data at any time directly within your account settings.
• Right to Erasure / To Be Forgotten (Art. 17 GDPR): You can permanently delete your account and all associated study data at any time via Settings > Danger Zone: Delete Account.
• Right to Data Portability (Art. 20 GDPR): Using the "Export My Data" button in your privacy settings, you can download all your account information as a structured ZIP archive.
• Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR): Competent supervisory authority: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).