Privacy policy
Last updated: 30 October 2026
1. Controller
Arsenii Borodin, Freundgasse 4-6/14, 1040 Vienna, Austria
E-mail: aborodin3866@gmail.com
An e-mail to this address is enough for any data protection request.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account: e-mail address, display name, password (stored only as a BCrypt hash), plan, whether the e-mail address is confirmed | Providing the account, sign-in, confirming the e-mail address | Art. 6(1)(b) (contract) | until the account is deleted |
| Uploaded presentations (PDF) and file name | Display, explanation, sharing by link, classes | Art. 6(1)(b) | until you delete the presentation or your account |
| Content for the AI: text and image of the current slide, your questions, highlighted passages, learning progress | Generating explanations, answers, quizzes and study guides | Art. 6(1)(b) | with us: progress until the account is deleted; at the AI provider see section 3 |
| Learning progress, study sessions, class memberships | Saving progress and continuing across devices | Art. 6(1)(b) | until the account is deleted or you leave the class |
| Usage events for a presentation (e.g. slide viewed, question asked – with the first 200 characters of the question), with your account ID or a random browser ID | Statistics for the person who shared the presentation (counts only, no question texts); improving the platform | Art. 6(1)(f) (legitimate interest in running and improving the service) | until the account or the presentation is deleted |
| AI usage: time, feature, model, token count, cost (without an account: with no identifier at all) | Cost control and usage limit (AI budget) | Art. 6(1)(b) and (f) | until the account is deleted |
| Payment data (via Stripe), subscription status | Handling the Pro subscription | Art. 6(1)(b) and (c) (retention duties) | status until the account is deleted; accounting records 7 years (§ 132 BAO) |
| Withdrawal notices (name, e-mail, contract, time) | Proof and processing of the withdrawal | Art. 6(1)(c) | 7 years |
| Server logs (IP address, time, requested address) | Security, abuse prevention, debugging | Art. 6(1)(f) | 14 days |
| IP address of visitors without an account or with an unconfirmed e-mail address | Daily limit on free AI use, abuse prevention | Art. 6(1)(f) | only in the server's memory, until the end of the day |
You can also open presentations and ask questions without an account; free AI use is then limited to a few slides a day. Content for the AI is processed the same way, but your progress stays in your browser only. If you share a presentation by link, the PDF is stored on our server and can be opened by anyone who has the link.
In a class, the teacher who created it sees the members' names and learning progress.
3. Recipients and processors
- Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Servers in the EU.
- AI providers: depending on the selected provider, Anthropic (Claude) or OpenAI (GPT). They receive the data listed under “Content for the AI”, but not your e-mail address or name. Under their API terms they do not use this data to train their models and keep it only for a limited time. Processing also takes place in the USA, based on the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, the European Commission's Standard Contractual Clauses (Art. 46 GDPR). A data processing agreement is in place with both providers.
- Payments: Stripe Payments Europe, Ltd., Dublin, Ireland. You enter card details directly with Stripe; we never receive them. Stripe is itself the controller for payment processing (Stripe privacy policy).
- E-mail delivery: Google Ireland Limited (Gmail), Gordon House, Barrow Street, Dublin 4, Ireland. Used only to send confirmations: the link to confirm your e-mail address at sign-up and the confirmation of a withdrawal. Google receives your e-mail address and the text of these e-mails; processing may also take place in the USA, based on the EU-US Data Privacy Framework (Art. 45 GDPR).
Fonts, the PDF viewer and formula rendering are loaded from our own server – no data is sent to Google or CDNs. We do not use any third-party advertising or tracking services.
4. Browser storage (§ 165 TKG 2021)
We do not set cookies. In your browser's local storage (localStorage) we keep: your sign-in token, settings (language, model, level, theme), local copies of your study sessions, a random browser ID for usage events and a security pass, valid for 12 hours, for free AI use without a confirmed account. These entries are technically necessary for the features you use. You can delete them in your browser at any time.
5. Minimum age
You can create your own account from the age of 14 (§ 4(4) Austrian Data Protection Act). If a school uses the class feature with younger pupils, the school is responsible for their data and we process it on the school's behalf.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Directly in your account (Account → “Your data”) you can download all stored data and delete your account together with its data. Otherwise an e-mail is enough; we reply within one month.
You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
7. Artificial intelligence
Explanations, answers, quiz questions and study guides are generated automatically by an AI model and may be wrong. There is no automated decision with legal effect within the meaning of Art. 22 GDPR.
8. Security
The connection is encrypted throughout (HTTPS). Passwords are stored only as BCrypt hashes.
9. Language
This policy is also available in German.