1. Controller
The controller is Alexander Diener, Rohweg 56, 37671 Höxter, Germany. Send privacy requests to alexander.diener@kursavo.de.
2. Visiting the website
To establish a connection, the IP address, date and time, requested address, transferred data volume, and browser and device information are processed technically. This supports secure, stable delivery and abuse prevention. The legal basis is Article 6(1)(f) GDPR. We currently use no separate advertising or audience analytics.
3. Early-access application
When you apply, we store your name, contact, project type and size, current platform, plan interest, stated needs, language and submission time. Processing is needed to reply and prepare a possible contract under Article 6(1)(b) GDPR; voluntary additional details rely on Article 6(1)(a) GDPR. Data is deleted once the request is finally closed unless statutory retention duties require longer storage.
4. Sign-in and account
Passwordless sign-in processes the email address, interface language, hashed one-time token, a hashed IP address for abuse limits, request time and session data. The link lasts 15 minutes; the session lasts up to 30 days or until logout. The browser receives only the technically necessary protected kursavo_session cookie. Legal bases are Article 6(1)(b) and (f) GDPR.
5. Schools, courses and learning
Depending on use, we store profile and role data, school membership, invitations, school and course content, files, access rights, learning progress, assignment responses, attachments, feedback and notifications. This is required to provide the platform under Article 6(1)(b) GDPR.
Where a school decides the purposes and means of processing student data, the school is the controller and Kursavo processes the data on its behalf. The school must provide its own privacy information and have a lawful basis for data it uploads.
6. Transactional email
For sign-in links and invitations, the recipient address, message metadata and message content are sent to Resend (Plus Five Five, Inc., USA). Resend provides a data processing agreement, EU Standard Contractual Clauses and EU–US Data Privacy Framework certification. Legal bases are Article 6(1)(b) and (f) GDPR.
7. Hosting and recipients
The website and workspace data are hosted on European infrastructure from Hetzner Online GmbH. Hetzner processes technical data as an infrastructure processor. Other recipients receive data only where a legal basis, binding obligation or expressly requested function requires it.
8. Retention and security
We retain data only as long as its purpose, an active account or school, legal claims or mandatory retention periods require. Data is then deleted or anonymised. Measures include access separation, hashing of one-time links and sessions, encrypted transport and backups. Absolute security of internet transmission cannot be guaranteed.
9. Your rights
- access and a copy under Article 15 GDPR;
- rectification under Article 16 GDPR;
- erasure or restriction under Articles 17 and 18 GDPR;
- data portability under Article 20 GDPR;
- objection to processing based on legitimate interests under Article 21 GDPR;
- withdrawal of consent for the future;
- a complaint to a competent data protection authority.
10. Changes
We update this policy when features, providers or legal requirements change. The current version is always available on this page.