Privacy Policy
Last updated: June 2026
1. Data Controller
Abdullah Tayyab
c/o Rafiq
Dunckerstraße 20
10437 Berlin
Germany
Email: a.tayyab15218@gmail.com
2. Data We Collect
When you create an account and use the platform, we collect:
- Email address and display name (for account creation and communication)
- Federal state selection (to serve state-specific exam questions)
- Learning progress: questions answered, session results, and mock exam scores
- Payment data (processed exclusively by Stripe — not stored on our servers)
Legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interests in operating the platform). Data is deleted within 30 days of an account deletion request.
3. Third-Party Processors
Supabase (Database & Authentication)
Supabase Inc., 970 Toa Payoh North, Singapore — EU database server in Frankfurt, Germany. Data processing agreement in place per Art. 28 GDPR. supabase.com/privacy
Vercel Inc. (Hosting)
340 Pine Street, Suite 900, San Francisco, CA 94104, USA. Processes technical metadata (IP addresses, access logs) to deliver the service. vercel.com/legal/privacy-policy
Stripe Inc. (Payment Processing)
510 Townsend Street, San Francisco, CA 94103, USA. All payment data is processed by Stripe under their GDPR-compliant infrastructure. We do not store full card details. stripe.com/privacy
Shopify Inc. (Customer Management & Email)
151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada. Your email address and name are synced to Shopify after registration for customer management and transactional emails. shopify.com/legal/privacy
4. Cookies
We use only technically necessary cookies (Supabase authentication session token). No tracking or analytics cookies are used. No consent banner is required under Art. 6(1)(f) GDPR for strictly necessary cookies.
5. Your Rights
Under GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). Contact us at a.tayyab15218@gmail.com to exercise these rights.
You also have the right to lodge a complaint with your local data protection authority (Art. 77 GDPR).