Privacy Policy

The controller for your data is [LEGAL ENTITY NAME], [POSTAL ADDRESS]. You can reach us at hello@simplegermanlearn.com.

• Your email address and the time you agreed to hear from us. We use it to send you a confirmation email, tell you when the course launches, and share the early-member offer and free resources. Legal basis: your consent (Art. 6(1)(a) GDPR). You confirm your address by clicking the link in our confirmation email.
• Where you came from. If you arrive through a tagged link (for example from our Instagram or YouTube), we record the tags in the link (such as the campaign name), the website you came from (only its address, without any search terms or parameters) and the page you landed on. We use this to understand which channels help learners find us. Legal basis: our legitimate interest in improving our outreach (Art. 6(1)(f) GDPR).
• Optional details about you and your learning. After you confirm your email we may ask a few optional questions: your first name, your current German level (language proficiency), why you are learning German (your learning goal, with a short note of your own if you choose “Other”) and what you find hardest. Answering is entirely up to you: you can leave any question blank or skip all of them, and confirming your email never depends on it. We use your answers to personalise your learning experience and shape the course, for product development, and to tailor the emails we send you. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Technical data and security. When you visit or sign up, our hosting and security providers process technical data such as your IP address and browser details to deliver the site and to tell real visitors from automated abuse (see Cloudflare below). Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
• Anonymous usage counts. We count a few steps of the signup journey (page viewed, form started, signup submitted, a signup error, email confirmed, the optional questions shown, skipped or saved) together with the campaign tags and a short technical code such as the type of error. These counts never include your email address, any account, visitor or device identifier, or your IP address, and they cannot be linked back to you. We do not count visitors whose browser sends a Do Not Track or Global Privacy Control signal. Legal basis: our legitimate interest in understanding and improving the signup (Art. 6(1)(f) GDPR).

Joining the waitlist needs only your email address. Your first name is optional, and we do not ask for payment details or any sensitive information.

We do not sell your data. We use the following service providers to run the site, and they process data only on our behalf:

• Cloudflare: hosting, content delivery, the Turnstile check that protects our signup form from bots (it may process your IP address and browser signals), and Cloudflare Web Analytics for cookie-free page-view and speed statistics.
• Supabase: the database that stores your waitlist entry (hosted in [SUPABASE REGION]).
• Resend: sends our confirmation and update emails, so it processes your email address.
• Google (Gemini API): powers the optional AI practice features. Only the practice text involved (such as the topic or the exercise sentence) is sent, never your email address. Please do not type personal information into practice exercises.
• Content delivery of icons (Font Awesome via cdnjs, run by Cloudflare): your browser loads icon files from this service, which therefore sees your IP address.

Links to Instagram, Facebook and YouTube take you to those services, whose own privacy policies then apply.

Some of these providers are based in, or may process data in, countries outside the EU/EEA (for example the USA). Where that happens we rely on an adequacy decision or on standard contractual clauses approved by the European Commission. [CONFIRM TRANSFER MECHANISMS FOR EACH PROVIDER]

We do not use advertising or tracking cookies and we do not use third-party analytics trackers. We store two small things in your browser: your light/dark theme choice, and, for the length of your visit only, the campaign tags described above so they can be attached if you sign up. When you click the link in our confirmation email we also set one short-lived, essential cookie (valid for 24 hours) that lets the optional questions after confirming be saved to your entry without a login; it holds only an internal identifier and a signature, not your email address, and it is not used for tracking. Cloudflare Turnstile may use limited browser storage to do its security check. To understand how the site is used we use Cloudflare Web Analytics, which is cookie-free, plus the anonymous usage counts described in section 2.

• Waitlist email and related data: until you unsubscribe or withdraw your consent. When you unsubscribe we delete your first name, questionnaire answers and campaign tags and keep only your email address, its status and the time you unsubscribed, so that we do not email you again. You can ask us to delete that record too (see section 7), but then we can no longer prove that you opted out.
• Signups that are never confirmed are deleted automatically after 30 days.
• Anonymous usage counts are deleted automatically after 13 months.
• Confirmation links expire after 24 hours, and we only keep a one-way scrambled (hashed) version of them.

Under data protection law you have the right to:

• ask for a copy of your data (access);
• have wrong data corrected;
• have your data deleted;
• restrict how we use it, or object to our legitimate-interest uses;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting what we did before; and
• complain to a data protection authority, for example the one where you live or work.

To use any of these, email hello@simplegermanlearn.com. We may need to check it's really you first.

You can stop hearing from us at any time by using the unsubscribe link in our emails, or by emailing hello@simplegermanlearn.com. Opening the link only shows a confirmation page; nothing changes until you press the button, so automatic link scanners cannot unsubscribe you by accident. Once you have unsubscribed we stop emailing you, remove your first name and the optional answers you gave us and cancel any unused confirmation links. If you sign up again later with the same address and confirm it, we treat that as a new sign-up.

Data is encrypted in transit, access to the database is restricted to our servers, and confirmation links can only be used once. No system is perfectly secure, but we take care to keep what we hold to a minimum.

The waitlist is intended for people aged 16 and over. If you are younger, please ask a parent or guardian to sign up for you. [CONFIRM AGE THRESHOLD]

If we change how we use your data, we will update this page and the date at the top, and we will tell you by email if the change is significant.