Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Alexander Aschauer
Zu den Gärten 4
52355 Düren, Germany
Email: hello@thegermangarden.com

2. Data we collect and why

Account data

When you create an account, we collect your email address and a hashed password. This data is required to provide you with access to your account and premium content. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

Payment data

When you subscribe, your payment is processed by Stripe, Inc. We do not store your credit card details. Stripe receives your name, email, and payment information directly. We store only your subscription status and renewal date. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). Stripe's privacy policy: stripe.com/privacy.

Session cookies

We use strictly necessary session cookies to keep you logged in. These cookies do not track you across other websites and are deleted when you log out or close your browser. No consent is required for strictly necessary cookies. The legal basis is our legitimate interest in providing a functional service (Art. 6(1)(f) GDPR).

Server logs

Our hosting provider (Vercel, Inc.) automatically collects standard server log data including IP address, browser type, and pages visited. This data is used for security and operational purposes and is deleted after a short retention period. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

3. Marketing emails and partner offers

Newsletter — new texts and learning tips

If you opt in during registration, we will send you emails about new German texts, learning tips, and updates from The German Garden. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by updating your preferences on your account page or by clicking the unsubscribe link in any email. Withdrawal does not affect the lawfulness of processing before withdrawal.

Partner offers

If you opt in during registration, we may send you occasional offers from partner German learning apps and websites operated by the same team. We do not share your email address with third parties for their own marketing purposes. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by updating your preferences on your account page or by clicking the unsubscribe link in any email.

Both marketing consents are optional and independent of each other. Declining or withdrawing consent has no effect on your account or access to content.

4. Data processors and third parties

We use the following service providers who process data on our behalf:

• Supabase (Supabase Inc., USA) — authentication and database hosting. Data is stored in EU-based AWS data centres. Privacy policy.
• Stripe (Stripe, Inc., USA) — payment processing. Privacy policy.
• Vercel (Vercel, Inc., USA) — website hosting. Privacy policy.

Where data is transferred to the USA, this is done on the basis of Standard Contractual Clauses (SCCs) as provided by the European Commission.

5. Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your account and personal data.
• Right to restriction — you can ask us to restrict processing of your data.
• Right to data portability — you can request your data in a machine-readable format.
• Right to object — you can object to processing based on legitimate interest.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.
• Right to lodge a complaint — you have the right to complain to a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

To exercise any of these rights, contact us at hello@thegermangarden.com. We will respond within 30 days.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account, your data is erased within 30 days. Subscription records may be retained for up to 10 years for tax and accounting purposes as required by German law. Marketing consent records are retained until you withdraw consent or delete your account.