Zu deutscher Version

Privacy Policy

Last updated: July 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

The contracting party specified in the legal notice.

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functional website, our content, and services. The processing of personal data is generally carried out only with the consent of users or when processing is permitted by statutory regulations.

3. Collection and Storage of Personal Data, and Purpose of Use

a) When Visiting the Website

When accessing our website, information is automatically sent to our server by the browser on your device. This information is temporarily stored in a so-called log file. The following information is collected:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the retrieved file
  • Website from which access is made (referrer URL)
  • Browser used and, if applicable, the operating system of your computer and the name of your access provider

The aforementioned data is processed by us for the following purposes:

  • Ensuring smooth connection establishment to the website
  • Ensuring user-friendly use of our website
  • Evaluation of system security and stability
  • Other administrative purposes

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR.

b) When Using Our SaaS Service

When registering, using, and managing a customer account, as well as when using our service, we process the following categories of personal data:

  • Master data: Google account ID, email address, name, and profile image (if available); okti does not store your Google password
  • Account data: Subscription status, subscribed plans, payment status (via Lemon Squeezy)
  • Usage data: Created or uploaded learning materials (e.g., files, notes, flashcards, quiz questions, and podcasts), chat histories, text, image, and audio inputs, and content generated from them
  • System data: Usage statistics, learning and review history, interaction history, feedback on user responses, error data, token/cost values, and AI-assisted analyses
  • Preference and profile data: Language, design and notification settings, information on learning situation, university, learning style, preferred response length, and support needs
  • Communication data: Emails, support requests, internal messages

Purpose of processing:

  • Provision of the service and performance of contractual obligations
  • Storage and display of content created by the user
  • Analysis of usage to improve features and the learning experience
  • Personalization of learning content and AI responses
  • Management of subscriptions and access rights
  • Troubleshooting and abuse detection

Legal bases:

  • Art. 6 para. 1 lit. b GDPR – Performance of a contract (provision of the SaaS service)
  • Art. 6 para. 1 lit. f GDPR – Legitimate interest (optimization of the service, prevention of abuse)

4. Individual Processing Operations

4.1 Google OAuth (Login with Google Account)

We offer login via Google OAuth. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google provides us with the profile data required for authentication (Google account ID, email address, name, and profile image). We do not receive your Google password.

The legal basis is Art. 6 para. 1 lit. b GDPR, as authentication is required to set up and use the account you requested.

Further information:https://policies.google.com/privacy

4.2 Hosting with Hetzner

Our web application and our servers are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

In particular, account, contract, learning, content, communication, and log data are processed there. Hetzner processes personal data on our behalf in accordance with Art. 28 GDPR.

The legal bases are Art. 6 para. 1 lit. b GDPR for providing the service and Art. 6 para. 1 lit. f GDPR for secure and stable operation.

Further information:https://www.hetzner.com/de/legal/privacy-policy

4.3 Cloudflare (Content Delivery Network and Security)

We use Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) as a Content Delivery Network (CDN) and for security services.

Cloudflare processes IP addresses, HTTP headers, and other technical data to optimize website performance and protect against attacks.

The transfer to the USA is based on Art. 46 GDPR (standard contractual clauses).

The legal basis is our legitimate interest in the secure and efficient provision of our web application (Art. 6 para. 1 lit. f GDPR).

Further information:https://www.cloudflare.com/de-de/privacypolicy/

4.4 Cloudflare R2 (Object Storage)

We use Cloudflare R2 (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) as object storage for storing files and media content.

The R2 storage used by us is configured with European data jurisdiction. Nevertheless, Cloudflare may process technical metadata and access data under the agreed data protection safeguards where required for operation, security, or support.

Uploaded files, images, and other media content that users use in the application are processed.

The legal basis is the performance of a contract (Art. 6 para. 1 lit. b GDPR) for providing the storage functions of our service.

Further information:https://www.cloudflare.com/de-de/privacypolicy/

4.5 Payment Processing via Lemon Squeezy (Merchant of Record)

For the sale of our products, we use Lemon Squeezy (Lemon Squeezy LLC, USA) as Merchant of Record.

Lemon Squeezy handles the entire purchase and payment process. Personal data such as name, billing address, email address, and payment information are collected and processed directly by Lemon Squeezy.

The transfer to the USA is based on Art. 46 GDPR (standard contractual clauses).

The legal bases are Art. 6 para. 1 lit. b GDPR for entering into the contract and Art. 6 para. 1 lit. c GDPR for statutory billing and retention duties. In this respect, Lemon Squeezy processes payment data under its own data protection responsibility.

Further information:https://www.lemonsqueezy.com/privacy

4.6 TensorX.ai (Text-Based AI Features)

For text-based AI features, we use TensorX Ltd., Unit 25, Classon House, Dundrum Business Park, Dublin 14, Ireland, as a processor. This includes chat, feedback, answers, flashcards, quizzes, notes, suggestions, summaries, and structuring learning content.

Depending on the feature, your texts, chat messages, answers, selected content or content extracted from files, related conversation context, and technical instructions are transmitted to TensorX. TensorX processes the resulting outputs and technical usage metadata.

According to the provider, inference data is processed exclusively in the European Union; inputs and outputs are not stored persistently and are not used to train models.

The legal basis is Art. 6 para. 1 lit. b GDPR when you request the relevant AI feature. TensorX processes content on our behalf in accordance with Art. 28 GDPR.

Further information:https://tensorx.ai/privacy-policy/

4.7 Google Gemini API (Podcast Audio and Live Voice Interaction)

For generating podcast audio and live voice interaction within podcasts, we use Google's Gemini API. Depending on the applicable contractual terms, the contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or an affiliated Google entity.

Podcast scripts and the audio generated from them are processed, as are your spoken inputs transmitted in real time, the conversation context, and audio responses when using the live feature. For the live feature, your browser connects directly to the Gemini API using a short-lived access token.

Google may process inputs, outputs, and technical metadata to provide the service and, for a limited period, to detect abuse. Under the Gemini API terms, when paid services are used, inputs and outputs are not used to improve Google products. Processing exclusively in the EU is not guaranteed for this data flow.

The legal basis is Art. 6 para. 1 lit. b GDPR. Where data is transferred to third countries, the safeguards described in Section 11 apply.

Further information:https://ai.google.dev/gemini-api/terms

4.8 Cloudflare Markdown Conversion (Document Preparation)

Supported uploaded documents and images are sent to Cloudflare's Markdown Conversion API to convert them into machine-readable Markdown text. The file, its filename and file type, the generated text, and technical metadata are processed.

Conversion allows content to be displayed in okti and prepared for learning and AI features that you request. Cloudflare states that it does not use such customer content to train AI models or improve its own or third-party services unless explicit consent has been given.

The legal basis is Art. 6 para. 1 lit. b GDPR.

Further information:https://developers.cloudflare.com/workers-ai/platform/data-usage/

4.9 PostHog (Product Analysis, AI Analysis, Feedback Mechanisms)

We use PostHog for product-related analysis of the use of our web application as well as for analyzing the use of our AI functions. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We operate PostHog via the EU cloud provided by PostHog, so processing takes place exclusively on servers in the European Union.

For analyzing AI usage, we collect pseudonymized data via PostHog LLM Analytics (Large Language Model Analytics) to obtain an overview of individual user consumption and to track which type of AI generation (e.g., feedback generation, flashcard creation, quiz creation) was used for which purposes. This serves to improve our service, optimize AI functions, and monitor usage.

The following data types can be processed:

  • Page views, clicks, scroll behavior, navigation paths
  • Usage and event data (e.g., interactions with UI elements)
  • LLM Analytics: Pseudonymized data on AI usage (e.g., type of generation, number of requests, usage statistics, features used)
  • Anonymized session replay (e.g., cursor, click, and navigation flows; sensitive content is not recorded or is masked)
  • Technical information (browser type/version, operating system, device type)
  • Shortened or anonymized IP address for determining the approximate region

We operate PostHog with privacy-friendly default settings (including IP masking); cross-device recognition does not take place. The data is not merged with other personal data.

PostHog is also used for processing feedback forms. The feedback data you enter is collected together with technical information (session data, user behavior) to improve user experience and evaluate product feedback.

The legal basis is your consent according to Art. 6 para. 1 lit. a GDPR. You have the right to revoke your data protection consent at any time. The revocation of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

For objection and removal requests to PostHog, you can contact [email protected].

Further information about PostHog can be found athttps://posthog.com/faq and in PostHog's privacy policy:https://posthog.com/privacy

5. Cookies and Local Storage

For authentication and security, the web application uses technically necessary access and refresh cookies protected with the HttpOnly attribute. The access cookie normally remains valid for ten minutes and the refresh cookie for seven days. Other cookies or local storage entries retain functional and display options you select, such as language, theme, navigation, notification settings, or local chat approvals.

On the public website, we store your language selection and your decision regarding analytics in your browser. PostHog may only collect browser-side data there after you provide consent. You can withdraw consent by deleting the website data and making a new selection.

In the main web application, PostHog may set cookies or comparable identifiers for analytics and error diagnostics. Further details on scope and legal bases are provided in Section 4.9.

6. Sharing and External Content

If you make learning content available through a sharing feature, the people you select or who receive the sharing link can access the shared content and related information. You determine the recipients and any optional expiry period. Avoid personal data of third parties unless you have a lawful basis for sharing it.

When you initiate a YouTube import, our server retrieves the video URL you provide and available subtitles from YouTube.

When searching for universities, the web application transmits the search terms you enter (name and/or country) to the public university API operated by Hipo Labs (universities.hipolabs.com). A user ID or email address is not intentionally transmitted, but search terms may themselves contain personal information.

The legal basis for sharing and imports initiated by you is Art. 6 para. 1 lit. b GDPR. We rely on Art. 6 para. 1 lit. f GDPR for loading technically necessary libraries; our legitimate interest is the secure provision of interactive learning content.

7. Legal Bases for Processing

  • Art. 6 para. 1 lit. a GDPR – Consent
  • Art. 6 para. 1 lit. b GDPR – Performance of a contract
  • Art. 6 para. 1 lit. c GDPR – Legal obligation
  • Art. 6 para. 1 lit. f GDPR – Legitimate interest

8. Storage Duration and Deletion

We generally store account, profile, learning, content, and chat data for the lifetime of your user account or until you delete individual content. When the account is deleted, we delete or anonymize data associated with the account unless statutory retention duties, the establishment, exercise, or defense of legal claims, or other overriding reasons require continued storage.

Authentication data is deleted or replaced according to its validity period or upon logout or token rotation. Temporary processing copies and failed uploads are removed when their purpose no longer applies. Contractual, payment, and tax records are retained for the applicable statutory periods.

Log, security, analytics, and error data is deleted or anonymized when the analysis or security purpose no longer applies or according to the periods agreed with the relevant processor. TensorX states that it does not store AI inputs or outputs; other AI providers may retain content or metadata for the limited purposes described in Section 4.

9. Contact for Data Protection Inquiries

If you have questions about data protection, the processing of your personal data, or the assertion of your rights, you can contact us at any time:

Email: [email protected]

You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen; you may also contact the authority of your habitual residence.

10. Rights of the Data Subject

You have the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent given (Art. 7 para. 3 GDPR)

11. International Data Transfers

Cloudflare, Lemon Squeezy, and Google may process data in the United States or other countries outside the European Economic Area.

Depending on the provider and the specific data flow, we rely on an adequacy decision by the European Commission under Art. 45 GDPR, in particular the EU-US Data Privacy Framework, or on standard contractual clauses under Art. 46 para. 2 lit. c GDPR and, where necessary, supplementary safeguards. You can request copies of the relevant safeguards using the contact details above.

12. Data Security

When you visit and use the web application, we use the widely adopted TLS protocol (Transport Layer Security) as well as other technical and organizational security measures to protect your data against manipulation, loss, destruction, or unauthorized access.

13. Requirement to Provide Data and Automated Decisions

You must provide the account and authentication data marked as required if you wish to use a user account and its related features. A particular AI, import, storage, or payment feature cannot be provided without the content required for that feature. There is otherwise no statutory requirement to provide data.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI evaluations and learning recommendations are used solely to support learning.

14. Current Version and Amendment of This Privacy Policy

This privacy policy is currently valid and dated July 2026.

Due to the further development of our web application or due to changed legal requirements, an adjustment may be necessary.