Privacy Policy

Part 1: General information

1. Who is responsible for data processing?

The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other data protection provisions is:

Thorge Mrowinski
Project “Avorate AI”
Gerhart-Hauptmann-Ring 7j
21629 Neu Wulmstorf
Germany
Email: support@avorate.app

Avorate is currently in a closed, non-commercial test phase (private beta). Access is only possible via a personal invite code, and no paid services are offered. A business will be duly registered before the official public launch.

What this means for data protection: During this phase we are continuously building out the service and its safeguards. The processing described here reflects the actual state of implementation, and we update this policy whenever something changes. Before the public launch we will additionally carry out a formal data protection impact assessment under Art. 35 GDPR, in which the risks of the AI-assisted evaluation of voice recordings — in particular for users who are minors — are fully assessed and the necessary remedial measures are determined. We welcome comments and concerns at any time at support@avorate.app and will follow up on them.

This policy applies to the website www.avorate.app, to the web app at web.avorate.app, to the help and documentation site docs.avorate.app and to the mobile app “Avorate AI - Coach”.

2. Data protection officer

We have not appointed a data protection officer because there is no legal obligation to do so:

• Avorate is operated by a single individual. We do not, as a rule, permanently employ at least twenty people in the automated processing of personal data (Section 38(1) sentence 1 BDSG).
• Our core activity consists neither of regular and systematic monitoring of data subjects on a large scale nor of large-scale processing of special categories of personal data (Art. 37(1)(b) and (c) GDPR).
• Should that change — in particular with the public launch and growing user numbers — we will appoint a data protection officer and name them here.

For any data protection question and to exercise your rights, contact us at support@avorate.app.

3. Use by children and young people (Art. 8 GDPR)

Avorate is expressly aimed at pupils. A significant share of our users is therefore a minor. This creates specific obligations for us, which we disclose here:

• Age threshold for consent: Under Art. 8(1) GDPR, a child's consent to information society services is only valid from the age of 16. Germany has not made use of the opening clause to lower that threshold, so the limit of 16 applies. Where we process data on the basis of your consent (voice recordings, push notifications, error diagnostics), that consent must be given or authorised by the holder of parental responsibility for anyone under 16.
• Contractual side: Independently of this, the user agreement itself requires the consent of the legal guardians for minors with limited legal capacity (aged 7 to 17) under Sections 106 et seq. of the German Civil Code (BGB). Our terms of use set out the details.
• No age verification, deliberately: We do not collect a date of birth and do not verify age. An age check would require additional and particularly sensitive data about minors and would run counter to data minimisation. Instead we rely on the assurance given at registration and on the fact that access is only possible via a personally issued invite code.
• No advertising, no profiling: We do not use advertising, do not build interest or behavioural profiles and do not disclose data for advertising purposes. No processing takes place that aims at influencing children commercially.
• Parents' rights: Legal guardians may exercise the rights listed in section 5 on behalf of their child and can contact us at support@avorate.app. If we learn that an account was created without the required consent, we delete it without delay.

4. Our principles

• Data minimisation (Art. 5(1)(c) GDPR): We collect no postal address, no telephone number, no date of birth, no identity document data and no payment data.
• No tracking: Neither the website nor the app uses analytics, tracking or advertising services. No cross-device identifiers are created.
• No sale of data: We do not sell or rent personal data and do not pass it on to third parties for advertising purposes.
• No special categories: We do not ask for data within the meaning of Art. 9 GDPR. We process voice recordings solely to generate speaking feedback and expressly not for the purpose of uniquely identifying a person; they are therefore not biometric data within the meaning of Art. 9(1) GDPR. Even so, please do not record health, religious or comparably sensitive content in a practice session.

5. Your rights as a data subject

As a data subject you have the following rights vis-à-vis the controller at any time, free of charge, within the scope of the GDPR:

• Right of access (Art. 15 GDPR): You have the right to know whether and which personal data we process about you, for which purposes, to which recipients it is disclosed and how long it is stored.
• Right to rectification (Art. 16 GDPR): You may request the immediate correction of inaccurate personal data or the completion of personal data we hold about you. You can change your profile and school details yourself in the settings at any time.
• Right to erasure / right to be forgotten (Art. 17 GDPR): You may request the deletion of your personal data, provided no legal ground (e.g. statutory retention obligations) prevents this. You can trigger the deletion of your entire account yourself in the app (section 16 of Part 3).
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions you may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You have the right to receive data that we process automatically on the basis of your consent or for the performance of a contract, in a common, machine-readable format — for yourself or for transmission to a third party.
• Right to object (Art. 21 GDPR): Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent once given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to lodge a complaint (Art. 77 GDPR): Irrespective of the above, you have the right to lodge a complaint with a data protection supervisory authority — in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for our seat is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
(State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Website: lfd.niedersachsen.de

6. Recipients and processors at a glance

We use the following service providers. A data processing agreement pursuant to Art. 28 GDPR is in place with all of them. Where a transfer to a third country takes place, it is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified under it, by the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).

• Supabase Inc., USA — database, authentication, file storage and server-side functions. The infrastructure we rent is physically located in Frankfurt am Main (region eu-central-1).
• Cloudflare, Inc., USA — hosting and delivery of the website avorate.app and of the web app web.avorate.app.
• Google (Vertex AI / Google Cloud) — AI analysis and generation via the regional EU endpoint.
• Google Ireland Limited, Ireland — delivery of push notifications to iOS and Android devices (Firebase Cloud Messaging).
• Google Ireland Limited, Ireland — sign-in with a Google account (“Continue with Google”), if you choose that route.
• Cloudflare, Inc., USA — the Turnstile captcha protecting our sign-in and registration forms, and the forwarding of emails addressed to our addresses (Email Routing).
• Resend, USA — sending of transactional emails and receipt of incoming support emails; EU sending region (eu-west-1), sending domain mail.avorate.app.
• Pexels — a brand of Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin — stock photo search in the image dialog of the editor. When you open that dialog, the preview images are delivered to your device directly from the servers of the service (images.pexels.com). In doing so, the service necessarily receives, for technical reasons, your IP address and the details of your browser or app. For more information see Part 3, section 18.
• Functional Software, Inc. dba Sentry, USA — error diagnostics, exclusively in the mobile app and exclusively after your explicit consent; reports are routed via the service's EU region.
• The push service of your browser vendor — for web push, the technically necessary delivery to your browser.

Beyond this we only disclose personal data where we are legally obliged to do so or where you have expressly consented.

7. Retention periods at a glance

• Account, profile and content — for as long as your account exists; after a deletion request, final deletion after 30 days (section 16 of Part 3).
• Presentations, talks and practice sessions — until you delete the respective entry, at the latest until your account is deleted.
• Hashes of IP addresses (invite code pre-check) — deleted automatically after two hours.
• Attempt counters inside your account — deleted automatically after two days.
• Availability measurements of our systems — deleted automatically after 90 days; they contain no personal data.
• Log of administrative actions — deleted automatically after one year.
• Support messages — until your enquiry has been finally dealt with; afterwards we delete them unless a statutory retention obligation applies.

Part 2: Data processing on our website (avorate.app)

1. Provision of the website and server log files (hosting via Cloudflare)

Our website is hosted and delivered via the Cloudflare Workers platform of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). When you visit our website, Cloudflare automatically processes general information and technical data (browser type, operating system, referrer URL, hostname, IP address, date and time). This processing is technically essential to ensure stable, performant and secure delivery.

Cloudflare operates a worldwide network of locations and delivers the site from a location near you. For requests from the European Union this is generally within the EU. Processing outside the EU is not technically excluded; it is covered by the safeguards named below.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free and secure provision).
• Data processing agreement: We have concluded a data processing agreement (Data Processing Addendum) with Cloudflare.
• Third-country transfer: Processing takes place on the basis of the EU Standard Contractual Clauses.

2. No web analytics, no tracking, no external fonts

We do not use any web analytics, tracking or advertising services on avorate.app. No analytics or advertising cookies are set, no visitor profiles are created and no usage data is transmitted to third parties for analysis purposes. The typeface we use is bundled when the site is built and is not loaded from a Google server at runtime; visiting the site therefore creates no connection to Google.

• Language cookie: A technically necessary cookie is stored that remembers the language you selected and serves the correct language version.
• Appearance: Your choice between light and dark appearance is stored locally in your browser and is not transmitted to us.
• Legal basis: Section 25(2) no. 2 TDDDG for the storage on your terminal equipment (strictly necessary for the service you requested) and Art. 6(1)(f) GDPR for the subsequent processing. Beyond the server log files described in section 1, your visit is not evaluated.

3. Contacting us by email

If you write to one of the addresses given on the website, we process your sender address, the subject and the content of your message in order to deal with your enquiry. Details are set out in Part 3, section 13.

Part 3: Data processing in the app (Avorate AI - Coach, mobile and web)

1. Registration, authentication and user account (Supabase Auth)

A user account is required to use the app.

• Email registration: We process your email address and your password. The password is only ever stored as an irreversible hash; we never know it in clear text. In addition, the authentication system stores technical metadata such as the time of registration, the confirmation status of the email address and the time of the last sign-in.
• Third-party login (Google Sign-In): If you sign in with your Google account, Google provides us with the email address stored there, your name and a unique Google user ID. No password is set in that case.
• Processor and place of storage: For the user database and authentication we use Supabase Inc. (1111 Broadway, Suite 300, Oakland, CA 94607, USA). The infrastructure we rent is physically located on servers in Frankfurt am Main (Germany).
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

2. Profile details in the app

Your account includes a profile that tailors the AI output to your situation. All details are voluntary and can be changed or deleted at any time.

• Scope of processing: a display name, your year group, your school type and your federal state, plus application settings (selected coach voice, appearance, notification preferences, status of the onboarding flow).
• Purpose: adapting the language level, assessment standard and examples to your year group and school type. No assignment to a specific school takes place; we do not collect a school name.
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

3. Access via invite code (closed beta)

Avorate currently runs as a closed beta. A newly created account is initially not unlocked and is only activated by entering a valid, personal invite code.

• Scope of processing: We store with your account which invite code was redeemed and when, whether the account is unlocked, and whether it is designated for free full beta access. An invite code itself contains no personal data.
• Purpose: controlling access to the test phase, traceability of the unlock and limiting the repeated use of a code.
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement) and Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
• Storage period: The record exists for as long as your user account exists and is removed when it is deleted.

4. Bot and abuse protection (Cloudflare Turnstile)

Registration, login, password reset and the pre-check of an invite code are protected by the captcha service Turnstile provided by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). Without this protection, these forms would be open to automated mass registrations, the testing of stolen credentials and the guessing of invite codes.

• Scope of processing: Your IP address, technical characteristics of your browser or device (including user agent and language setting) and a single-use verification token are transmitted to Cloudflare. Turnstile is a privacy-friendly captcha: it sets no tracking cookie, creates no user profiles and does not evaluate your behaviour beyond the check itself.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against automated attacks and abusive registrations).
• Recipient and third-country transfer: Cloudflare, Inc., USA, on the basis of a data processing agreement; the transfer to the USA is safeguarded by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

5. Our own abuse protection for the invite code pre-check

The pre-check of an invite code happens before you have an account. It is therefore the only function that can be reached without signing in and has to be protected against the automated guessing of codes. To do so we limit the number of attempts per internet connection and hour.

• Scope of processing: All we store is a SHA-256 hash of your IP address computed with a secret additional value (a “pepper”), the time of the attempt and whether the attempt was successful. The IP address itself is never stored; without the secret additional value the hash cannot be traced back to an IP address.
• Purpose: solely limiting the number of attempts. The data is not combined with your user account and no profiling takes place.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against brute-force attacks).
• Storage period: The entries are deleted automatically after two hours.

After signing in we also limit the number of redemption attempts per account and hour. For this we store a counter against your user ID which is deleted automatically after two days (Art. 6(1)(f) GDPR).

6. Storage on your device

To keep the app usable, individual items are stored locally in your browser or on your device. This data does not leave your device unless it is transmitted to us anyway in order to provide the function.

• Sign-in session: a session token that keeps you signed in.
• Registration draft: the steps of the registration wizard you have already completed (invite code, year group, school type, federal state, email address) so that navigating away does not discard your input. Passwords are never stored.
• Cache: drafts of a presentation, a copy of your overview list and short-lived addresses for image files so the app does not have to reload everything on each visit. These entries are removed when you sign out.
• Settings: language, appearance and your decision about error diagnostics (section 14).
• Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the service you expressly requested) and Art. 6(1)(b) GDPR.

7. Presentations and talks you create

When you generate a presentation or a talk, we store the result in your account so that you can access, edit and export it later.

• Scope of processing: topic, subject, year group and the parameters you chose, the generated content (outline, slides, texts), the processing status, your change requests in the editing chat together with the changes made in response, and technical consumption figures for the AI calls.
• Files: uploaded images, AI-generated images and export files are held in a private storage area assigned exclusively to your account. It is not public; access is only possible via short-lived signed addresses.
• Legal basis: Art. 6(1)(b) GDPR.
• Storage period: until you delete the respective entry, at the latest until your account is deleted.

8. Practice sessions: voice recording, transcript and assessment

The core of the app is practising a talk. To do so you record your spoken talk via your device's microphone. Recording only ever starts on a deliberate action by you.

• Scope of processing: the audio recording itself, the verbatim transcript generated from it, the duration, an overall score, individual metrics (e.g. speaking pace, filler words, pauses), an indicative grade and concrete improvement tips, plus the topic, subject and year group of the exercise.
• Place of storage: The audio file is placed in the private storage area described in section 7 at Supabase in Frankfurt am Main; transcript and assessment are held in the associated database.
• Legal basis: Art. 6(1)(a) GDPR (consent, given by deliberately starting the recording and granting microphone access) and Art. 6(1)(b) GDPR for providing the assessment you requested. You can withdraw your consent at any time with effect for the future by making no further recordings; recordings already stored can be deleted by you.
• Please note: Do not record other people without their consent and do not speak particularly sensitive content into a recording.
• No voice recognition: We do not create a biometric profile from your voice and do not use it to recognise you. Every recording is evaluated on its own; no comparison with earlier recordings takes place at voice level. No processing of biometric data for the purpose of uniquely identifying you within the meaning of Art. 9 GDPR is therefore involved.
• You decide whether the recording is kept: In the settings you can specify that the audio file is deleted immediately after the assessment. If the option is switched off, the file is removed immediately and permanently once the assessment is complete; only the transcript and the assessment are retained. Independently of this, you can use the “Delete recordings” function at any time to remove all stored audio files of your account at once.
• Storage period: Audio recordings remain stored — unless you have switched off retention as described above — until you remove them via “Delete recordings”, at the latest until your account is deleted. Transcript and assessment continue to exist independently of this and are removed at the latest when your account is deleted; “Delete recordings” concerns the audio files only. We deliberately do not set an automatic period here, because your practice history and the comparison with the most recent exercise (“What has improved?”) are based on this data. You can delete any individual practice session yourself at any time — in the overview of your practice sessions. This removes the transcript and the assessment immediately; the associated audio file is permanently cleared from storage by a nightly clean-up run within 48 hours at the latest.

9. AI processing (Google Vertex AI)

For generating content and for automated feedback we use the AI platform Vertex AI by Google Cloud. The language model currently used is Gemini 3.1 Flash Lite; for generating slide images an image model (Imagen) in the europe-west4 region is additionally called.

• What is transmitted: your input (topic, subject, year group, specifications, change requests), images you upload and — when a practice session is evaluated — the audio recording itself. For this, the recording is loaded server-side from private storage and passed to the model within the same call. Your email address, your name and your account identifier are not transmitted.
• Strict use of the EU endpoint: The calls go exclusively to the regional endpoint within the European Union. Processing therefore takes place on servers within the EU.
• No model training: It is contractually agreed that the transmitted data is not used to train or improve AI models. It is deleted after the processing operation.
• No inference of emotions: The assessment of your exercise is limited to observable, measurable features of speaking — speaking pace, loudness over time, pauses, intelligibility, filler words, sentence structure and pronunciation. There is expressly no recognition or inference of emotions, moods or personality traits. We do not use an emotion recognition system within the meaning of Art. 3(39) of Regulation (EU) 2024/1689 (AI Act).
• Legal basis: Art. 6(1)(b) GDPR for the service you requested; for the transmission of the voice recording additionally Art. 6(1)(a) GDPR. A data processing agreement is in place with Google.

Transparency under the AI Act: Avorate is an AI system within the meaning of Regulation (EU) 2024/1689 (AI Act). We therefore expressly inform you that you are interacting with an AI system and that the texts, outlines, slides and images generated are artificially generated content (Art. 50(1) and (2) AI Act). We label generated content in the interface and are working on fully implementing the machine-readable marking of synthetic content in export files. If you publish generated content or use it at school, at university or at work, please observe the labelling and disclosure obligations that apply there.

Limits of the AI and no automated decision: The outputs are computer-generated suggestions based on statistical probabilities. They may be factually wrong, incomplete or inappropriate and do not replace an assessment by a teacher. There is no automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR): the score and indicative grade shown are practice feedback for you and are transmitted neither to your school nor to any third party.

10. Usage credits and speaking time

The extent of the AI-assisted features is governed by internal usage credits and a quota of analysable speaking time.

• Scope of processing: a ledger with the time, amount and reason of every credit or debit, and the remaining speaking time. Users with beta access receive a one-off 50 credits and two hours of speaking time free of charge.
• Purpose: correct allocation and accounting of the quotas and protection against abusive multiple use. No payment processing is associated with this (section 17).
• Legal basis: Art. 6(1)(b) GDPR.

11. Push notifications (Firebase Cloud Messaging & Web Push)

We offer optional push notifications to inform you about purely operational events — in particular that Avorate is available again after maintenance. No advertising messages are sent and no usage profiles are created.

• Mobile app (Firebase Cloud Messaging): For delivery on iOS and Android devices we use Firebase Cloud Messaging (FCM) by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Only a pseudonymous, device-related delivery token is processed and stored together with the platform information (iOS/Android) in our database in Frankfurt am Main. No names, email addresses, content or usage data are transmitted to Google.
• Web app (Web Push): In the browser we use the open Web Push standard with VAPID authentication via your browser vendor's push service. We store your browser's technical push address, the associated encryption keys and your browser identification; message contents are encrypted to your browser. No Firebase service is used on the web.
• Consent and withdrawal: Notifications are only activated after your explicit consent via the system permission dialog and can be disabled at any time in the system or browser settings. Upon sign-out or uninstallation the token becomes invalid and the associated record is removed.
• Legal basis: Art. 6(1)(a) GDPR (consent).

12. Sending of transactional emails (Resend)

For sending emails we use the delivery provider Resend (a provider based in the USA). Only transactional messages are sent — in particular the confirmation of your registration, the resetting of your password and our replies to support enquiries. We do not send advertising or newsletter emails.

• Scope of processing: your email address, the subject and content of the respective message and the technical delivery status (e.g. delivered, undeliverable). Mail is sent from our verified sending domain mail.avorate.app.
• Place of processing: Sending is configured for the EU region (eu-west-1).
• Legal basis: Art. 6(1)(b) GDPR for account and contract related messages and Art. 6(1)(f) GDPR for handling your support enquiries.
• Third-country transfer: safeguarded by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

13. Support enquiries

If you write to support@avorate.app, your message is taken into our support system so that we can process and answer it reliably.

• Scope of processing: sender address and name, subject, message text, processing status, internal handling notes and our replies. For account recovery requests we additionally process the details you provide in order to verify that you are entitled to the account. Where the address can be matched to an account, we record that match.
• Legal basis: Art. 6(1)(b) GDPR for contract-related matters, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and in protection against unauthorised account takeovers).
• Storage period: until your enquiry has been finally dealt with; afterwards we delete the records unless a statutory retention obligation applies.

14. Error diagnostics in the mobile app (Sentry)

To ensure stability we use, exclusively in the mobile app, the error diagnostics service Sentry by Functional Software Inc. dba Sentry (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). Reports are routed via the service's EU region. Sentry is not used in the web app or on the website.

• Scope of processing: in the event of an error, the error message, the technical call stack, app version, device type and operating system version, and technical intermediate steps preceding the error. The transmission of standard personal attributes is expressly switched off: IP addresses, request headers and cookies are not transmitted, nor is any content of your presentations or talks.
• Consent-based use: Error diagnostics is off by default and is only activated after your explicit consent during onboarding. You can withdraw it at any time in the settings; the client is then shut down and nothing further leaves your device.
• Legal basis: Art. 6(1)(a) GDPR (consent); third-country transfer safeguarded by the EU Standard Contractual Clauses.

15. Security and operational logs

• Availability monitoring: We check automatically and at regular intervals whether our services are reachable and store the time, response time and status code. These measurements contain no personal data and are deleted automatically after 90 days.
• Log of administrative actions: Administrative interventions in accounts (e.g. blocking, unblocking, deleting, editing a support case) are logged with the time, the acting person and the account concerned. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in traceability and abuse prevention); the entries are deleted automatically after one year.
• Server-side logs: Technical logs arise at our infrastructure providers which serve troubleshooting and the defence against attacks (Art. 6(1)(f) GDPR).

16. Deletion of your account

You can trigger the deletion of your account yourself in the app at any time. The process is deliberately two-stage so that an accidental deletion is not immediately irreversible.

• Grace period of 30 days: Your request marks the account for deletion. Within 30 days you can undo the deletion yourself.
• Final deletion: After the 30 days have elapsed, an automatic process running daily removes the account permanently. This irreversibly deletes every database record linked to the account — credentials, profile, presentations and talks you created, editing histories, practice sessions with transcripts and assessments, the credit ledger, the speaking time balance, push tokens and the redemption of the invite code.
• Files: Your files in the private storage area (voice recordings, uploaded and generated images, export files) are removed in the course of the account deletion. Should a file remain for technical reasons, we delete it without delay once you point it out.
• Exceptions: Independently of this, the log of administrative actions and support cases already closed remain for the periods stated above, insofar as they are necessary for traceability or statutory retention obligations apply.

17. Payments, subscriptions and in-app purchases (not currently in use)

Avorate is in a closed beta and is provided free of charge. No subscriptions, credit packages or in-app purchases are offered or concluded. No payment processing therefore takes place at present, and no payment data is collected or transmitted to any payment or billing provider.

• Prepared but disabled integrations: For a later paid version, the technical integration of the billing providers Stripe and RevenueCat exists in the source code. Neither is in operation, because the credentials required for them are not set; they receive and process no data.
• Before any activation: We will update this privacy policy accordingly beforehand and inform you about it. Paid services will only come about after your express and separate consent.

18. Image search via Pexels

In the image dialog of the editor you can search free stock photos of the Pexels service and add them to your presentation. The service is operated by Pexels, a brand of Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin.

• Search query: Your search term — with automatic illustration, the topic of your presentation — is transmitted by our server to the interface of the service. Your IP address is not passed on in the process, because the request originates from us and not from your device.
• Preview images: The result images, by contrast, are delivered to your device directly from the servers of the service (images.pexels.com). In doing so, the service necessarily receives, for technical reasons, your IP address, the time of retrieval and the identifier of your browser or app. We have no influence over this transmission; it is a precondition for the images being able to be displayed.
• Images you adopt: If you decide on an image, our server downloads it and places it in our own private file storage. From that point on, the image is delivered from our storage and no longer by the service.
• Legal basis: Art. 6(1)(b) GDPR — the image search is part of the feature you requested. You can avoid the transmission entirely by not opening the image dialog and instead uploading your own images or having images generated.
• Third-country reference: The controller is a company established in Germany. We cannot rule out a transfer by the provider itself to group companies outside the EU; the details are governed by its privacy policy.

19. Camera access for the self-preview

When practising a talk, you can switch on a self-preview in the mobile app so that you can see yourself while speaking. For this, the app requests access to your device's camera.

• No video is recorded. The camera image is displayed exclusively on your device. It is not stored, not transmitted to us and not passed to the AI. Only the audio recording is evaluated (section 8).
• Voluntary: You can refuse the permission or withdraw it at any time in your device's system settings. The practice feature remains fully usable without a camera.
• Legal basis: Art. 6(1)(a) GDPR (consent, given by granting the system permission).

If you wish to upload an image of your own or a document as the basis of a presentation, the app opens your device's file picker. We receive only the file you select. No access to your photo library is requested.

20. Changes to this privacy policy

We adapt this policy when the processing changes — for instance because a feature is added or a service provider changes. The version published on this page always applies. In the event of material changes we will additionally inform you in the app or by email.

This privacy policy was last updated in August 2026.