Privacy policy (Datenschutzerklärung)

We take your privacy seriously. This policy explains what personal data Bleiben processes, why, for how long, and what rights you have under the General Data Protection Regulation (GDPR).

In short: we only process what we need to run Bleiben. There are no analytics, no advertising and no tracking cookies, and we don't sell your data.

1. Who is responsible

[to be completed: operator.addressBlock]

Email: [to be completed: operator.email]

2. Visiting the website

When you open a page, our hosting provider's servers process technical data: your IP address, the date and time, the page you asked for, and your browser and operating system. This is needed to deliver the website and to keep it secure (for example against attacks). Legal basis: our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). These server logs are kept only as long as needed for security and are then deleted.

3. Cookies and storage in your browser

We only use what is strictly necessary for the website to work, so we don't ask for consent (§ 25 (2) no. 2 TDDDG):

Our fonts are hosted by us; your browser doesn't contact other servers for them.

4. Date calculator and exam finder

Your answers in the calculator (permit type, dates, pension months, German level, study in Germany) are processed to work out your likely route and date. They appear in the page address so you can bookmark the result. They are not stored unless you are logged in and choose "Save to my plan". The postcode you enter in the exam finder is only used for that search and is not stored. Legal basis: Art. 6 (1) (b) GDPR.

5. Your account and login

To create an account we need your email address. You log in with a link we send by email, or with Google if you choose that. With Google, Google sends us your email address and your Google account's name and profile picture; we only use the email address. We store your email address, when you logged in, and your settings (Bundesland, city, a booked exam date, whether you want reminders). Legal basis: performance of our contract with you (Art. 6 (1) (b) GDPR).

If you ask us to email you when the paid plans open, we note when you asked and send you one email when they do. You can undo this on the pricing page.

6. Your learning progress

When you practise while logged in, we store your answers and results: Leben in Deutschland practice and mock tests, the A1 lessons and checks, your word reviews, and how many free questions or checks you have used. This is needed to show your progress and to apply the plan limits. Legal basis: Art. 6 (1) (b) GDPR.

7. AI feedback on your German

When you ask for feedback on your writing or speaking practice, we send the text you wrote and the task to our AI service provider (OpenRouter), which passes it to a language model. We only allow model providers that don't store your text or use it for training. Please don't write personal details (such as your address or ID numbers) in practice texts.

We store your text and the feedback in your account so you can read them again, and so we can check feedback that you report as wrong. For each request we also log the model, the number of tokens, the cost and the duration, without your text, to keep our costs under control.

The scores are practice estimates to help you learn. They are not decisions with legal or similar effects on you (Art. 22 GDPR). Legal basis: Art. 6 (1) (b) GDPR; for reviewing reported feedback also our legitimate interest in good feedback (Art. 6 (1) (f) GDPR).

8. Planner, checklist and document vault

If you save your calculator result, we store your answers and the resulting date to build your plan, which steps you have marked as done, and which checklist items you have ticked. If reminders are on, we send you emails before your next steps; you can switch them off in the planner at any time.

Uploading documents to the vault is optional. Files are encrypted on our server before they are stored (AES-256-GCM), only you can download them, and you can delete them at any time. They are deleted automatically 12 months after upload. Documents such as payslips or residence permits contain sensitive information; only upload what you want to keep here.

Legal basis: Art. 6 (1) (b) GDPR.

9. Payments

Payments are handled by Stripe. Stripe processes your payment details (for example your card) and billing address; we never see your full card details. We receive and store which product you bought, the amount and the VAT, the payment and subscription status, your Stripe customer number, and the time you agreed that your access starts immediately. Stripe also processes data to prevent fraud, partly as a separate controller.

Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and our legal obligations to keep business and tax records (Art. 6 (1) (c) GDPR with § 147 AO and § 14b UStG, up to 10 years).

10. Cancellations

If you use our cancel page, we store what you enter (name, email address, contract, type of cancellation, reason and requested end date) and when we received it, so we can prove the cancellation and confirm it to you. We keep this for 3 years and then delete it automatically. Legal basis: Art. 6 (1) (c) and (f) GDPR.

10a. Feedback

If you send us feedback, we store your message, the kind of feedback, the page you came from and, if you're logged in, your account (or, if you give it, your email address so we can reply). We use it to improve Bleiben and delete it after 12 months. Legal basis: our legitimate interest in improving the service (Art. 6 (1) (f) GDPR).

To prevent abuse of our public forms, we count requests per visitor for a short time, using a one-way hash of the IP address that changes daily. The counters are deleted after two days.

11. Emails

We send you login links, order and cancellation confirmations, and, if you have the planner and reminders on, planner reminders. We use an email service provider for this.

12. Service providers

These providers process data on our behalf, under data processing agreements (Art. 28 GDPR):

Some of these companies are based in the USA, or may access data from there. Transfers are based on the EU–US Data Privacy Framework where the company is certified, and otherwise on the EU standard contractual clauses (Art. 45 and 46 GDPR).

13. How long we keep your data

We keep your account data until you delete your account. Then we delete it, with these exceptions:

• Payment and tax records: as long as the law requires (up to 10 years).
• Cancellation requests: 3 years.
• Feedback you sent us: 12 months (kept without a link to you).
• The AI cost log (model, tokens, cost): kept without any link to you.
• Stripe webhook records (technical ids only): 90 days.

14. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive it in a common format (Art. 20), and to object to processing based on our legitimate interests (Art. 21). To use these rights, email us at [to be completed: operator.email].

You can delete your account yourself on your account page. This deletes your profile, progress, AI feedback, plan and vault files.

You also have the right to complain to a data protection authority (Art. 77 GDPR), for example where you live, or the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

15. Do you have to give us your data?

You can use the calculator, the exam finder and the free practice without an account. An account needs an email address; without it we can't save your progress or sell you a plan.

16. Changes

We update this policy when Bleiben changes. The date below shows the latest version.