Privacy policy

Last updated: [TODO: date]

1. Controller

The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) is:
[TODO: company name], [TODO: address], Austria
Email: [TODO: privacy@…]

Data protection officer: [TODO: name and contact, if appointed; otherwise delete this sentence]

2. Overview

We only process personal data as far as needed to run this website and the Noventa learning program, based on the GDPR and the Austrian Data Protection Act (DSG). We do not sell data, do no advertising tracking and use no analytics cookies. [TODO: confirm; if an analytics tool is used, describe it here]

3. Hosting

The website and app are hosted by [TODO: hosting provider, company name, address]. Server location: [TODO: country, ideally EU]. We have a data processing agreement with the provider pursuant to Art. 28 GDPR. [TODO: sign DPA and confirm]

4. Server log files

When you visit the website, our server automatically processes technical data: IP address, date and time, requested page, referrer, browser and operating system. This serves the secure and stable operation of the service (Art. 6(1)(f) GDPR; legitimate interest: IT security and troubleshooting). Log files are deleted after [TODO: e.g. 14] days.

5. Cookies

We only use strictly necessary cookies: a session cookie (login, chosen language) and a security cookie protecting against cross-site request forgery. They are strictly necessary for the service you request (§ 165(3) Austrian Telecommunications Act 2021; Art. 6(1)(b) and (f) GDPR) and do not require consent. They are deleted at the end of the session or after [TODO: lifetime, e.g. 2 hours].

6. Account and learning program

To provide Noventa we process: name, email address, password (stored only as a hash) or passkey data, chosen language, chosen course, learning progress (completed days, card reviews, quiz results) and the texts you write in your journal. The legal basis is the performance of our contract (Art. 6(1)(b) GDPR). The data is stored as long as your account exists and removed within [TODO: e.g. 30] days after you delete your account, unless statutory retention obligations apply.

7. Sign in with Google

You can optionally sign in with your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). After your confirmation, Google transmits your name, email address, profile picture and a Google user ID to us. The legal basis is Art. 6(1)(b) GDPR (carrying out the sign-in you chose). Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). Google's privacy policy: policies.google.com/privacy.

8. Payments with Stripe

We process payments via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). Stripe processes your name, email address, payment details (e.g. card data), billing address, IP address and transaction data. We do not store full card details ourselves, only a customer ID, subscription status and invoice history. The legal bases are Art. 6(1)(b) GDPR (performance of contract) and (c) (legal obligations, e.g. accounting). For certain processing (e.g. fraud prevention, financial regulation) Stripe acts as an independent controller. Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework and additionally uses Standard Contractual Clauses. Stripe's privacy policy: stripe.com/privacy.

We keep invoice and accounting records for seven years as required by § 132 Austrian Federal Fiscal Code (BAO).

9. Fonts (Bunny Fonts)

We use the fonts "Inter Tight" and "Instrument Serif" from the Bunny Fonts directory (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia). The font files are downloaded when the website is built and served from our own server, so visiting the website does not connect you to Bunny Fonts. [TODO: confirm technically; if fonts are loaded directly from fonts.bunny.net, add the transfer of the IP address to BunnyWay, legal basis Art. 6(1)(f) GDPR]

10. Emails

We only send emails needed for the service (e.g. email verification, password reset, payment receipts). Email service provider: [TODO: provider, location, DPA]. Legal basis: Art. 6(1)(b) GDPR. We only send newsletters with your explicit consent (Art. 6(1)(a) GDPR). [TODO: delete if there is no newsletter]

11. Audio and speech output

[TODO: describe how audio / text-to-speech works (e.g. browser speech synthesis, nothing sent to us; or an external TTS service with provider, location, DPA). If microphone recordings are processed: purpose, storage location, retention period.]

12. Recipients and transfers to third countries

Your data is only shared with the processors and service providers named above. Transfers to third countries only take place as described above and on the basis of an adequacy decision or appropriate safeguards (Art. 44 et seq. GDPR).

13. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future. Just write to [TODO: privacy@…].

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

14. Automated decisions

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Scheduling your reviews (spaced repetition) is a learning feature without legal effect.