Privacy Policy

1. Who we are

Deutsch-Landia is operated by IACOB MIHAI-ALBERTO PFA (a Romanian-registered sole proprietorship; fiscal code (CUI) 54802933, Trade Register No. F2026028449007), registered office at B-dul 1 Decembrie 1918 nr. 1N, Sector 3, Bucharest, Romania. You can reach us on +40 765 759 979 or at privacy@deutsch-landia.com. We operate the educational platform available at deutsch-landia.ro and deutsch-landia.com and are the controller of personal data collected through these services. We take the privacy of our users, especially children, very seriously.

2. Data collected

We collect the following data:

• Registration data: email, first name, last name, age, role
• Progress data: completed lessons, solved exercises, XP score
• Technical security data: IP address, user-agent (browser + operating system), and the approximate country derived from the IP address. We use these for account security, fraud prevention and incident investigation (legal basis: our legitimate interest, GDPR Art. 6(1)(f)). We retain them for 24 months and they are viewable only by administrators in an internal panel whose access is itself logged. We do not use a third-party geolocation service — the country is read from a header provided by our network (Vercel), with no cookie and no script on your device, and we never determine a location more precise than the country.
• Payment data: processed exclusively by Stripe — we do not store card data
• Where your account came from (adults only, only with your consent): which campaign or link brought you here and what kind of site sent you — at most six short labels, never an identifier; section 10 says exactly what, when and for how long.

We do not store biometric data, GPS location, or social media data. One thing deserves its own paragraph, because it involves your microphone.

3. Children's protection (COPPA / GDPR Art. 8)

• Below the age of consent in your country (16 in Romania and Germany, 14 in Austria, 13 in the US and the UK), the account does NOT activate on its own. We ask for a parent's email address, create the account in a locked state, and unlock it only after the parent confirms from their own inbox. Until then nothing can be learned, played or purchased. We also check that the parent address is not the child's own.
• We do not display behavioural ads to children — zero advertising tracking on educational content.
• We do not record, for minors, which campaign or link brought them to us (section 10).
• We do not sell children's data and do not disclose it for commercial purposes. There is exactly one situation where somebody else sees anything about your child: when a school enrols them. The school then sees their learning progress (section 4 says exactly what), but not how long they spend online, the games they play on their own, or their friends.
• We do not build voiceprints and we never identify anyone by their voice. What happens to your microphone during pronunciation exercises is described in section 2.
• We never determine a location more precise than the country.
• Parents can request access, rectification or deletion of their child's data at any time at privacy@deutsch-landia.com — we respond within 30 days.

4. When your child’s account comes from a school

Some accounts are not created by the family but by a school we work with: a teacher or the office adds the pupils to a list, we create the accounts, and each child gets their own sign-in details. If you are a parent and this is the first you are hearing of such an account, this section is written for you.

Who decides what

• The school decides who is enrolled, in which class, and for how long. It is also responsible for your authorisation as a parent: it warrants it to us by contract and records, pupil by pupil, how it was obtained — a register we can ask to see at any time.
• We decide how the platform works: the lessons, the points, the leaderboards, the friends, and the subscription a family can buy separately, independently of the school.
• For anything concerning you or your child, you can write to us DIRECTLY. We will not send you back to the school.

What you can do

• You can ask for access to, correction of, or deletion of your child’s data — exactly like any other parent on the platform.
• You can stop the school’s access at any time. If the school gave us your email address, we have already sent you a message with a link that does precisely that, in one click, with no explanation owed to anyone. If nothing arrived, write to us and we will handle it.
• Stopping the school’s access does NOT delete your child’s account. Their progress, points and streak stay theirs — only the link to the school is cut.

What happens when the school’s contract ends

The account stays your child’s and returns to the free version. Nothing they learned is lost. The school sees nothing from that moment on, and if the family wants to carry on with everything that was included, they can take out a separate subscription.

5. How we use data, and on what basis

Every purpose has its own legal basis — we do not process anything "in general".

• Providing and personalising the educational service — performance of the contract (Art. 6(1)(b)); for minors' accounts, parental consent (Art. 8)
• Progress tracking and generating review recommendations — performance of the contract (Art. 6(1)(b))
• Communications related to account and subscription — performance of the contract (Art. 6(1)(b))
• Marketing communications (reminders, news) — your explicit consent (Art. 6(1)(a)), withdrawable with one click from any email
• Improving the platform through aggregate analysis — your consent to the "Marketing and measurement" cookie category (Art. 6(1)(a))
• Campaign measurement — where your account came from: your consent to the "Marketing and measurement" category (Art. 6(1)(a)), adults only; counting clicks on the /go short links: our legitimate interest in handling the request (Art. 6(1)(f)), the result not being personal data (section 10)
• Account security, fraud prevention and incident investigation — our legitimate interest (Art. 6(1)(f)), documented by a written balancing test
• Payments, invoicing and keeping accounting records — performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))

6. Who we share data with

We do not sell data and we give it to nobody for advertising. We pass on strictly what is necessary, to the providers that make the platform work. The list below is complete, not an example:

• Stripe — payment processing (Irish entity)
• Vercel — website hosting and delivery (US company, served from the European data centre)
• Railway — application server and database (US company, hosted in Amsterdam)
• Resend — sending account-related email (EU region)
• Sentry — error monitoring (EU region)
• PostHog — product analytics, ONLY with your consent (EU servers, Frankfurt)
• Cloudinary — hosting images and uploaded materials (Israel and US)
• Inngest — running scheduled jobs, for example the automatic clean-up of expired data (US)
• Cloudflare — DNS and network-level protection (global), plus storage of the database backups, encrypted before they leave us and kept in the EU
• Google — only if you use "Continue with Google" or the Google Classroom roster import (US)
• Daily.co — only if you join a video session with a teacher (US)
• Your school, if your account was created by a school — learning progress, in the categories listed in section 4

Transfers outside the European Economic Area

Some of the providers above process data outside the EEA, mainly in the United States. For those transfers we rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914). Israel, where Cloudinary has infrastructure, is covered by a European Commission adequacy decision. You can request a copy of the applicable safeguards by writing to privacy@deutsch-landia.com.

7. How long we keep data

These are the periods we actually enforce, not the ones that would look best:

• Your account and everything about learning (progress, test results, vocabulary, XP, streaks, badges) — for as long as the account exists. Delete it and they go with it.
• Encrypted backups of the whole database (kept in the EU, unreadable without a key only we hold) — hourly copies for 2 days, daily copies for 14 days, weekly copies for 12 weeks. A deleted account disappears from them as they expire, at most 12 weeks later; we use backups only to recover the platform from a disaster, never to restore a deleted account.
• Security audit log (IP address, user-agent) — 24 months, then deleted automatically by a job that runs daily.
• Country derived from your IP address — for the life of the account, because it is a fraud signal and supports age-of-consent verification; deleted with the account.
• Where your account came from (the campaign labels) — 180 days from the creation of the account, then deleted automatically; at once, if you withdraw consent for the "Marketing and measurement" category (the conditions are in section 10); with the account, if you delete it.
• Payment and subscription records — 7 years from the last payment, because Romanian tax law requires it.
• Proof of parental consent, after the account is deleted — 3 years from the deletion, then deleted automatically. We keep only: the status of the consent, its basis and method, the dates of the request, of the answer and of the consent, the version of the accepted text, the kind of erasure and a reference to the account (a cryptographic fingerprint, not its identifier); and, where a school confirmed the consent, which school, the procedure it declared and the version of its form — no IP address, and not the parent’s name or email. We keep it so that we can defend ourselves if anyone claims in court that a child’s data was processed without a parent’s consent. The general limitation period under the Romanian Civil Code is 3 years (art. 2517); the legal basis is GDPR Art. 17(3)(e).
• Paid bookings with marketplace teachers, and their payments — we keep them even after a teacher deletes their account, because the law requires us to keep accounting records and so that complaints can be answered. The teacher’s account is closed and their personal data (name, email, photo, profile) removed; what remains is the booking record (without contact details), the record of the teacher’s vetting (statuses, dates, references — no documents) and the identifier of their Stripe payout account, to reconcile payments.
• Safety reports (about inappropriate content or behaviour) — we keep them after the account that sent them is deleted, but without the link to that account: what was reported and how it was handled remains. The IP address it was sent from is removed too.
• Authentication session — 30 days.
• Unsubscribe list — 180 days; spam complaints are kept indefinitely, precisely so we never write to you again.
• Error reports and providers' technical logs — between 30 and 90 days, per each provider's policy.

8. Your rights (GDPR)

You have the right to:

• Access — receive a copy of your data
• Rectification — correct inaccurate data
• Erasure — "the right to be forgotten"
• Portability — export your data in a standard format
• Objection — to processing based on legitimate interest
• Restriction — ask us to pause processing temporarily (Art. 18)
• Withdrawal of consent — at any time, for marketing and for cookies (Art. 7(3)); withdrawing the "Marketing and measurement" category also deletes where your account came from (section 10); withdrawal does not affect what was lawfully processed beforehand

Automated decisions

We do not make solely automated decisions that produce legal effects or similarly significantly affect you (Art. 22). The algorithm that suggests what to review is a teaching aid; it decides nothing about your account, your payment or your access.

The fastest route: if you are signed in, you can download all of your data yourself, straight away, without waiting for anyone. For anything else — or if you would rather write to us — use: privacy@deutsch-landia.com

9. Cookies

We use four categories of cookies and similar technologies, aligned with the consent banner. (1) Necessary — httpOnly cookies for the authentication session, a technical cookie that only says a session exists (value “1”, no personal data), security, and the language preference; these are essential and cannot be disabled. This also covers error and security monitoring (Sentry), strictly necessary for platform stability — no cookies, no session recordings, and no data that identifies you (we strip it before sending), on a legitimate-interest basis. (2) Functional — stores your choices in the browser (light/dark theme, onboarding progress) for a personalised experience; it does not identify you across sites. (3) Analytics — site performance measurement, via Vercel Speed Insights; activated ONLY if you accept the “Analytics” category. (Sentry no longer measures performance: since 3 September 2026 we use only the error monitoring described under point 1.) (4) Marketing and measurement — aggregate behavioural analytics (PostHog, EU servers in Frankfurt) and where your account came from: the campaign labels from the link you clicked, kept in your browser tab (sessionStorage, key “dl_acq”) until you create your account or close the tab; they reach us, and stay for 180 days, only if you create an account as an adult (section 10); activated ONLY if you accept the “Marketing and measurement” category. We use no session recordings (Microsoft Clarity was removed on 6 September 2026). None of the technologies in the “Analytics” and “Marketing and measurement” categories run before your explicit acceptance. You can accept all, reject all, or choose per category, and consent can be withdrawn at any time from the section below.

10. How you found us (campaign measurement)

To learn which of our posts and links bring people who actually go on to learn, we do two small things, described here in full. Neither involves ads, tracking pixels or advertising platforms.

Where your account came from — adults only, only with your consent

• What we keep — at most six short labels: the source, medium, campaign and variant from the link you clicked (for example "tiktok", "social", "autumn-2026"), the kind of site you came from, from a fixed list (for example "instagram" or "google"; any other site is recorded only as "other"), and the first section of the page you landed on (for example "/grammar"). Never an identifier, an email address, your IP address, the site's address or the exact page; a label shaped like an identifier or a phone number is refused by the database itself.
• When — only if you accepted the "Marketing and measurement" category in the cookie banner AFTER this section was published, on 30 September 2026 (a choice made before then does not cover this purpose, which is why the banner is shown to you once more), and only if you declared, when creating your account, an age of at least 18. Until you create an account the labels sit in your browser tab (sessionStorage) and vanish when you close it; they are sent once, when the account is created (with "Continue with Google", when you state your age).
• Children and unknown age — we do not record where the account came from for minors, for accounts whose age we do not know, or for any account that goes through parental consent (section 3). If a child or a teenager creates the account, the labels are cleared from the browser without being sent.
• Legal basis — your consent (GDPR Art. 6(1)(a)), given through the "Marketing and measurement" category: it covers both keeping the labels in your browser (Romanian Law 506/2004 art. 4(5)) and keeping them on our side.
• How long — 180 days from the creation of the account, then deleted automatically. Deleted with the account too.
• Who receives it — nobody beyond our hosting and backup providers (section 6). It stays in our database, in the EU (Railway, Amsterdam), and only we see it, in the admin panel, as totals per source.
• Your rights — if you withdraw consent for the "Marketing and measurement" category (section 9) on a device where you are signed in, where your account came from is deleted at once, and if you have not created an account yet, the labels are cleared from your browser. From a device where you are not signed in we cannot tell which account is meant: sign in and withdraw it there, or write to privacy@deutsch-landia.com and we will delete it. The record appears in your data export (section 8). Withdrawal does not affect what was lawfully processed beforehand.

The /go/… short links

The links in our social-media profiles pass through a short address of ours (for example deutsch-landia.com/go/bio-ig) that sends you on to the site. For each such link we count how many times it was clicked on each day — and nothing else. We set no cookie and write neither the IP address, the browser nor the exact time anywhere: the result is one number per day per link, which is no longer personal data. So that the same click is not counted twice (a reload, a double tap) and to stop a flood of automated requests, we use for one minute, in the server's memory only, a fingerprint (hash) of the IP address and browser type, not the address itself; it is written nowhere, and the server drops it at the latest when it restarts. Handling your request, including that short-lived fingerprint, rests on our legitimate interest in keeping the site working and counting correctly (Art. 6(1)(f)), as on any other page. We do not ask for consent for this count: we store nothing on your device and read nothing from it beyond the request you made by clicking the link. Each short link belongs to a campaign or a placement (for example our Instagram profile), never to a person or to a message sent to someone.

The weekly report

Every Monday, the platform's administrators receive an internal email with the week's totals: how many new accounts, how many confirmed their email, took the placement test, started or finished a lesson, started a trial or paid, how many came back in their second week, from which sources and countries, and how many clicks the short links received. Numbers only — no names, no addresses, no identifiers; in a week with fewer than five sign-ups, the sources and countries stay out of the email (they remain only in the admin panel), so that a small number cannot point at a person. The totals are kept as statistics (no longer personal data) and are given to nobody.

11. Security

We use HTTPS/TLS 1.3, passwords stored only as a hash (Argon2id; older bcrypt hashes are upgraded to Argon2id at the next sign-in), httpOnly cookies, rate limiting, TOTP 2FA for administrative accounts, AES-256-GCM encryption for OAuth and TOTP secrets, Content-Security-Policy in enforce mode, and other standard measures. We maintain a written Information Security & Safety Program (ISSP) per COPPA § 312.8 and a Data Retention Policy, both available to supervisory authorities on request. In the event of a security breach with risk to your rights, we notify you within 72 hours (GDPR Art. 34).

12. Your rights as a California resident (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) + California Privacy Rights Act (CPRA):

• Right to know — what personal information we collect, sources, purposes, and categories of third parties we share with
• Right to delete — personal information (subject to legal exceptions — e.g., legal obligations, security)
• Right to correct — inaccurate information
• Right to opt-out — of sale or sharing of personal information
• Right to non-discrimination — for exercising your CCPA rights
• Right to data portability — receive your data in a structured, machine-readable format

To exercise these rights, email privacy@deutsch-landia.com with subject "CCPA Request". We will respond within 45 days (45-day extension permitted under CCPA § 1798.130(a)(2)).

Notice at Collection (CPRA): Categories of personal information we collect and their purposes are detailed in the "Data collected" section. Children's data (under 16) is classified as sensitive personal information under CPRA and is never sold or shared.

13. Data protection contact

For any question about your data, write to us at: privacy@deutsch-landia.com
We have not designated a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR; requests are handled directly by the controller. You can also file complaints with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing).