Privacy policy

1. Controller

Controller within the meaning of the GDPR:
Plakos GmbH, Willy-Brandt-Allee 31, 23554 Lübeck, Germany
Email: support@plakos.de

2. Which data we process

Account data: first name, last name, email address, password (hashed).
Learning data: course progress, quiz answers, learning time, XP, streaks, certificates.
AI inputs: if you use the AI learning assistant, your inputs are sent to our AI service provider in order to answer them (see section 5).

3. Legal bases for processing

Performance of a contract (Art. 6(1)(b) GDPR) for your account and access to learning; legitimate interests (Art. 6(1)(f) GDPR) for operational security and the prevention of misuse; consent (Art. 6(1)(a) GDPR) for optional push notifications.

4. Storage period and deletion

Account data is stored until the account is deleted. Compliance certificates are archived in accordance with statutory retention obligations. When an account is deleted, personal data is deleted or anonymised; evidence of certificates is kept in pseudonymised form for audit purposes.

Log data (log files): we process system-generated log data containing personal data such as IP addresses or access times to maintain IT security, to fix errors and to prevent misuse (Art. 6(1)(f) GDPR). It is stored for a maximum of 90 days and then automatically deleted or anonymised. Data of external test participants (applicant tests) is automatically deleted 6 months after submission or after the invitation expires.

Source documents for AI course creation: documents, web pages and texts that authors upload to create courses with AI are stored for the duration of the course creation and automatically deleted 14 days after it is completed, at the latest after 30 days. The uploaded original file is removed as soon as it has been read in.

5. Processors

• Hetzner Online GmbH — Hosting, database (PostgreSQL) and email server (self-hosted mailcow) (Germany (EU))
• OpenAI (openai.com) — AI features (learning assistant, oral exam, read-aloud, course creation) — inputs are only processed when you actively use the AI features (USA (standard contractual clauses))
• Apple APNs / Google FCM — Push notifications — only with your explicit consent (USA (standard contractual clauses))

We have data processing agreements pursuant to Art. 28 GDPR with all processors. Business customers conclude a data processing agreement (AVV, in German) with us.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection and data portability. Please send requests to support@plakos.de. You also have the right to lodge a complaint with the competent supervisory authority.

If you are in the United Kingdom, the UK GDPR gives you these same rights.

7. Cookies & local storage

Technically necessary: local storage (localStorage) for signing in, your language setting and your cookie decision — no consent is required for this (§ 25 (2) TDDDG, German Telecommunications and Telemedia Data Protection Act). Push notification tokens are only processed with your explicit consent.

Statistics and marketing (only with consent): on our public pages we use the Google tag (gtag.js) of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) — split into two purposes that you can allow separately in the cookie banner (Art. 6(1)(a) GDPR, § 25 (1) TDDDG). No Google script is loaded before you decide.

• Statistics — Google Analytics 4: we see which pages are used and how (page views, completed self-checks, enquiries sent). Google Analytics 4 does not store IP addresses. Cookies _ga/_ga_*, stored for up to 2 years.
• Marketing — Google Ads conversion measurement: we learn whether an enquiry came from one of our Google ads. Personalised advertising and remarketing stay disabled (Consent Mode: ad_personalization denied). Cookie _gcl_au, stored for up to 90 days.

Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. There is no web analytics in the signed-in area or in the applicant test area.

You can change or withdraw your consent for each purpose at any time with effect for the future — via the “Cookie settings” link in the footer of every page.