Beducated privacy & data

1. Data Controller Beducated GmbH Leopoldstr. 31 80802 Munich, Germany

Account information : Email address, name, and password when you create an account

Payment information : Processed by our payment providers (see Section 5); we do not store credit card numbers

During onboarding, you may optionally provide information about your sexual interests, orientation, relationship status, age range, and gender identity.

Approximate location : Country-level, derived from your IP address for geo-targeting (e.g., language, consent requirements)

Device information : Browser type, operating system, screen resolution

Activity log (app only): We log content interactions (lessons completed, videos watched) and login events.

Communications : Messages you send to our support team

Contract performance (Art. 6(1)(b) GDPR): To provide our services, process payments, and manage your account

Legitimate interest (Art. 6(1)(f) GDPR): For website analytics, security, and fraud prevention

Consent (Art. 6(1)(a) GDPR): For marketing cookies (Meta Pixel, Google Ads) and newsletter subscriptions

It is used solely to personalize your content recommendations and is processed based on your explicit consent

Account data : Retained for the duration of your account, plus 30 days after deletion

Payment records : Retained for 10 years as required by German tax law

Analytics data : Aggregated and anonymized; raw data retained for up to 26 months

Server logs : Retained for up to 14 days

Support conversations : Retained for up to 3 years

Activity log : Retained for up to 12 months for service improvement and payment dispute evidence, then deleted.

Our application database is hosted on Neon (serverless PostgreSQL) in the EU (Frankfurt).

European hosting infrastructure (Hetzner, Germany) for our website

EU Standard Contractual Clauses (SCCs)

Adequacy decisions by the European Commission

The EU-US Data Privacy Framework, where applicable

To exercise these rights, contact us at legal@beducated.com .

Access your personal data (Art. 15 GDPR)

Rectify inaccurate data (Art. 16 GDPR)

Erase your data ("right to be forgotten") (Art. 17 GDPR)

Restrict processing (Art. 18 GDPR)

Data portability — receive your data in a portable format (Art. 20 GDPR)

Object to processing based on legitimate interest (Art. 21 GDPR)

Withdraw consent at any time without affecting prior processing (Art. 7(3) GDPR)

Right to delete your personal information

Right to opt-out of the sale of your personal information

Some of our advertising tools (Meta Pixel, Google Ads) may constitute "sharing" of personal information under CCPA.