Privacy Policy

If, in the course of our processing, we disclose data to other persons and companies (processors), transfer it to them, or otherwise grant them access to the data, this is done only on the basis of legal permission.

Hosting: This website is hosted by tec-promotion GmbH, Benno-Strauß-Straße 7, 90763 Fürth, Germany. Servers are located in Germany. A data processing agreement (DPA) in accordance with Art. 28 GDPR is in place with the hoster. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the reliable presentation of our website).

Content Delivery Network (CDN): We use the service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA as a Content Delivery Network. Cloudflare temporarily processes user IP addresses. The use is based on our legitimate interests in a secure and efficient provision of our online offering in accordance with Art. 6 para. 1 lit. f GDPR. Data transfer to the USA is based on the EU-US Data Privacy Framework. More information: https://www.cloudflare.com/privacypolicy/

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 lit. f GDPR (Art. 21 GDPR).

To exercise your right to object, you can contact us by email at a@rafaelalex.de.

This website uses only technically necessary cookies. In accordance with § 25 para. 2 TDDDG, no consent is required for these cookies.

Session cookies: Automatically deleted after the end of your visit.

No tracking cookies: We do not use cookies for marketing or tracking purposes. Rybbit Analytics is fully cookieless.

We use the appointment booking service Cal.com, Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Legal basis: Art. 6 para. 1 lit. b GDPR. Privacy policy: https://cal.com/privacy

For project inquiries I provide an online questionnaire, accessible via an individual, non-public access link. The data processed includes the answers given in the questionnaire (e.g. name, email address, details about the project) as well as voluntarily uploaded files. Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual measures).

The current progress is stored server-side under a random identifier so the questionnaire can be resumed later or the link shared within a team. Anyone with the link can view and change the answers; the link should therefore not be passed on to third parties. Drafts are deleted automatically after 7 days without access.

On submission, the answers are processed on my self-hosted automation platform (n8n) and delivered by email to me and to the email address provided. To summarize and structure the answers I use the AI service Claude by Anthropic PBC, 500 Howard St, San Francisco, CA 94105, USA; for this purpose the answers (excluding uploaded files) are transmitted to Anthropic. Privacy policy: https://www.anthropic.com/privacy

The provider automatically collects and stores information in server log files:

• •Browser type and browser version
• •Operating system used
• •Referrer URL
• •Host name of the accessing computer
• •Time of the server request
• •IP address

Legal basis: Art. 6 para. 1 lit. f GDPR.

The iOS app Sprachverliebt shows one rare German word per day. The app requires no registration and no account; no names or email addresses are collected. There is no tracking, no analytics, and no advertising in the app, and it collects no advertising identifiers.

Device key (App Attest): To secure the interface, the app generates an anonymous device key using Apple's App Attest procedure. The server stores only the public key together with a random identifier; this does not allow any conclusion about the person or device. Legal basis: legitimate interest in preventing abuse (Art. 6 para. 1 lit. f GDPR).

Sample assignment: Devices without a Plus purchase are assigned a fixed selection of ten catalog entries once, at random. Only the assignment of the anonymous device identifier to these entries is stored, no further personal data. Legal basis: performance of a contract (Art. 6 para. 1 lit. b GDPR).

Daily content: The app loads the daily word content from its own backend (sprachverliebt.rafaelalex.de). Only the anonymous device identifier is transmitted for this purpose.

Text-to-speech: For pronunciation, the word text (no personal or device data) is transmitted to OpenAI (USA) for speech synthesis. The transfer to the USA is based on standard contractual clauses.

iCloud synchronization: Saved words and reading progress are stored on the device and, if iCloud is active, in the user's private iCloud database under their own Apple account. The operator has no access to this data; Apple is responsible for this processing.

Purchases (Sprachverliebt Plus): Purchases are handled entirely by Apple (App Store / StoreKit); Apple processes the payment data. The server only stores the unlock status of a purchase-bound device identifier, no names or payment data. Legal basis: performance of a contract (Art. 6 para. 1 lit. b GDPR).

Error tracking: Server-side errors are optionally recorded via Sentry, provided a DSN is configured; without configuration, the integration is fully inactive. Only technical error data (stack traces, request metadata) is recorded, no word content and no user accounts. Legal basis: legitimate interest in stability and error resolution (Art. 6 para. 1 lit. f GDPR).