Privacy Policy

The controller within the meaning of the DSGVO (GDPR) is:

RH Group GmbH
Südliche Münchner Str. 60c
82031 Grünwald
Germany
Email: info@preparaio.com
Phone: +49 89 74044725

We process personal data only to the extent necessary to provide a functional website and our learning content, or where permitted by law. When you visit the website, our hosting service automatically records access data (IP address, date, user agent) in server logs to maintain operations and defend against attacks (Art. 6 Abs. 1 lit. f DSGVO). Logs are deleted after a maximum of 30 days.

When you register, we process your email address, display name and authentication metadata for the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). Data is stored until you delete your account, but for no longer than 3 years after your last activity.

We process answers, progress, skill profiles and practice exam results to provide the contractual service (Art. 6 Abs. 1 lit. b DSGVO) and to improve the learning content (Art. 6 Abs. 1 lit. f DSGVO, interest in quality assurance of the exercises). Data is stored until account deletion; anonymised aggregate statistics (with no link to individuals) are retained beyond that point.

Payments are processed by Stripe Payments Europe, Limited (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) as a data processor. Name, email address, payment details and IP address are transmitted. Legal basis is Art. 6 (1) (b) GDPR (contract performance). See Stripe's privacy policy at stripe.com/privacy for details.

Text AI (writing): Free-text answers in writing exercises are transmitted via the Lovable AI Gateway to AI model providers (Google Ireland Ltd. for Gemini models and OpenAI Ireland Ltd. / OpenAI, L.L.C. for GPT models) for assessment. Legal basis: Art. 6 Abs. 1 lit. b DSGVO (performance of the contract). The answer itself, the exercise instructions and a pseudonymous learner identifier are transmitted — no real names, email addresses or payment data. According to the agreements with the providers, the inputs are not used to train the models.

Speech transcription (speaking): Audio recordings from speaking exercises are transmitted to ElevenLabs, Inc. (169 Madison Ave, New York, NY 10016, USA) for automatic transcription. Only the audio file together with a pseudonymous learner identifier is transmitted. Legal basis: Art. 6 Abs. 1 lit. b DSGVO.

Text-to-speech (listening): To generate the listening audio, we transmit exercise texts (no personal data) to ElevenLabs, Inc. and, as a fallback, to OpenAI (text-to-speech). The generated audio files are then cached in our EU database.

No model training: Under the data processing agreements concluded with the providers, neither inputs nor outputs are used to train the AI models.

• Hosting, database, authentication, file storage, authentication emails: Supabase (via Lovable Cloud), EU region.
• Payment processing: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (with onward transfer to Stripe Inc., USA).
• AI text assessment (via Lovable AI Gateway): Google Ireland Ltd. (Gemini) and OpenAI Ireland Ltd. / OpenAI, L.L.C. (GPT).
• Speech transcription and text-to-speech: ElevenLabs, Inc., USA; OpenAI (only as a fallback for text-to-speech).
• Email delivery (transactional and learning reminders): Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as an email delivery service provider, technically integrated via the Lovable Connector Gateway. The recipient's email address, subject line, email content and technical delivery headers (including the unsubscribe link) are transmitted.
• Audience measurement (only with consent): Google Ireland Ltd. for Google Analytics 4 and Microsoft Ireland Operations Ltd. for Microsoft Clarity.
• Marketing audience measurement (only with consent): Google Ireland Ltd. / Google LLC for Google Ads Conversion Tracking and TikTok Technology Ltd. (Ireland) / TikTok Pte. Ltd. for the TikTok Pixel and the server-side TikTok Events API.

We do not sell data and disclose personal data exclusively to the service providers listed above as part of providing our services. Where these service providers process personal data on our behalf, processing is governed by the provider's applicable data processing terms. According to Resend's published Data Processing Addendum (DPA), its DPA forms part of the customer contract and becomes binding when that contract is concluded.

Some of the service providers used (in particular ElevenLabs, OpenAI's parent company, Google LLC, Microsoft Corporation, TikTok Pte. Ltd., Stripe Inc., Resend) are based in the USA or forward some data to group companies located there. Depending on the provider, such transfers are safeguarded through the EU Standard Contractual Clauses (Art. 46 Abs. 2 lit. c DSGVO) and/or — where the respective provider is certified under it — through the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023). According to the provider's currently published information (DPA and GDPR information page), Resend stores data in the USA, and transfers from the EEA are safeguarded through the EU Standard Contractual Clauses incorporated into the DPA and participation in the EU-U.S. Data Privacy Framework. Despite these safeguards, access by US authorities under US law cannot be completely ruled out.

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 DSGVO). To exercise these rights, contact info@preparaio.com; no particular form is required.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach

Technically necessary (without consent, § 25 Abs. 2 Nr. 2 TDDDG): Login session (Supabase auth token), language and theme selection, consent storage, Stripe shopping cart and checkout cookies during the payment process.

Statistics – only with consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG):

• Google Analytics 4 (Google Ireland Ltd.) for pseudonymous audience measurement. IP anonymisation is active; retention period: 14 months.
• Microsoft Clarity (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to analyse how our pages are used – both public pages and the logged-in learning area. Clarity records clicks, scrolling, mouse movements and page views and uses these to create heatmaps and session recordings. Text entries and page content are masked, meaning they are not transmitted in plain text. Device and browser information, a truncated IP address, approximate location and timestamps are also processed. Cookies or identifiers include: _clck, _clsk, CLID, MUID; retention period according to Microsoft: up to 1 year. The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG). Transfer to Microsoft Corporation in the USA is possible (see Section 8). Further information: Microsoft Privacy Statement. You can withdraw your consent at any time via the cookie settings in the footer.

Marketing – only with consent:

• Google Ads Conversion Tracking (Google Ireland Ltd. / Google LLC) to measure advertising success.
• TikTok Pixel (TikTok Technology Ltd., Ireland) to measure campaign reach on TikTok.
• TikTok Events API (server-side conversion measurement): When you register or take out a subscription, we also transmit the relevant event (registration or purchase) directly from our server to TikTok so that the success of advertising campaigns can still be measured when the pixel is blocked. The following are transmitted: a cryptographically hashed (SHA-256) email address and user identifier, and, for purchases, the purchase value, currency and exam code, together with a timestamp for each event and an event ID to prevent double counting. No plain-text data and no payment data. The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO); this transfer does not take place without marketing consent. You can withdraw your consent at any time via the cookie settings in the footer – the transfer will then stop for all future events.

We use Google Consent Mode v2 with the default setting “denied”. Without consent, neither analytics nor marketing scripts (including Microsoft Clarity) are loaded, and no corresponding cookies are set. Ad personalisation remains permanently disabled.

Current status: No selection made yet. You can change or withdraw your selection at any time:

Purpose: If you explicitly enable this, we send you personalised learning reminders by email — for example, notifications about reviews that are due, longer breaks from learning, your learning streak, outstanding tasks or the exam countdown. For this purpose, we analyse your learning and progress data (including your last activity, reviews that are due, streak status, exam date, target exam and language setting).

Legal basis: exclusively your consent (Art. 6 Abs. 1 lit. a DSGVO). Without this consent, we neither analyse data for reminder purposes nor send reminders. The toggle is off by default; a general email setting from the past does not count as consent for this purpose.

Voluntary nature: Consent is voluntary and is not a condition for using Preparaio or entering into a contract. Not giving consent does not put you at any disadvantage in accessing learning content.

Withdrawal: You can withdraw your consent at any time — in your account settings under “Notifications” or via the unsubscribe link in every reminder email (without logging in, including through your email application's one-click unsubscribe feature). Withdrawal takes effect for the future: the lawfulness of processing that has already taken place remains unaffected. Withdrawal applies exclusively to learning reminders. You will continue to receive necessary account, contract and payment emails (e.g. registration and login emails, purchase confirmations, invoice notifications, invitations from your language school, security-related notices), as these are not based on this consent.

Frequency: Sending is limited by configurable system-side caps — both per day and over a rolling window of 7 days. Within a sending run, the rules engine prioritises the appropriate reminder for each learner so that reminders are not stacked within the same sending run. We deliberately do not specify fixed numbers here, as these caps may be adjusted for operational reasons.

Proof of consent: To fulfil our obligation to provide proof (Art. 7 Abs. 1 DSGVO), we log when you gave or withdrew consent, keeping the data to a minimum: time, event (given/withdrawn), source (settings or unsubscribe link), the version of the consent text and the language. We store no IP address, no user agent and no copy of the email. These records are automatically deleted after 3 years.

Unsubscribe links: The unsubscribe link contains a random token with no embedded information — neither your email address nor your name or user identifier can be derived from it. On the server side, we store only a cryptographic hash (SHA-256) of the token. Tokens are valid for 90 days, can be revoked at any time and are deleted 30 days after expiry or revocation.

No tracking measurement: Reminder emails contain no tracking pixels and no personal tracking parameters in their links. For the technical sending process, we use the email delivery service provider named in Section 7.

Retention period for delivery logs: For each reminder email, we store a technical delivery log (purpose, status, recipient address, time) to prevent duplicates, comply with the caps and provide support. These logs are automatically deleted 180 days after sending. Logs for mandatory emails (account, purchase, invitation) are not affected by this.

We update this statement whenever the legal situation or our processing activities change. Last updated: 2026-06-14.