Privacy Policy

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Clyde Gerard Calador
Benedixstraße 7
04157 Leipzig
Deutschland
Email: calacly@gmail.com

This policy covers the elomenta.com website (including the public lesson pages and the creator dashboard) and the elomenta mobile app. The app has not been released yet; the app sections describe processing from the moment you use it.

The website is hosted by Vercel Inc. (USA). When you open a page, Vercel processes technically necessary connection data (IP address, time, requested page, user agent) in server logs. The legal basis is our legitimate interest in serving the site securely and reliably (Art. 6(1)(f) GDPR); logs are deleted automatically after a short period. Server-side processing (for example rendering the public lesson pages) runs in Frankfurt, Germany; static content is delivered through Vercel’s global content delivery network. Vercel is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses from Vercel’s data processing agreement apply in addition.

The public pages of this website set no cookies and use no analytics, tracking or advertising services, so no consent banner is needed. The creator dashboard (after sign-in) uses only technically required login cookies (Supabase Auth) to keep your session — Art. 6(1)(b) GDPR and the strictly-necessary exemption of German law (§ 25(2) no. 2 TDDDG).

Public lesson pages (elomenta.com/l/…) display the creator’s chosen display name. This processing is based on our contract with the creator (Art. 6(1)(b) GDPR): lessons appear only after the creator has reviewed and published them.

Using the app requires an account. We process your email address, sign-in data (password stored only as a hash), profile details, lessons and learning state (such as exercise answers, review and progress data) to provide the service (Art. 6(1)(b) GDPR). This data is stored by our processor Supabase in the EU (AWS Frankfurt, eu-central-1) and kept until you delete your account. Your email address and password are contractually required to create an account — without them the app cannot be used; all other profile details are optional.

Exercise answers and input to speaking and roleplay activities are processed by AI services to generate practice content and individual feedback. Material provided by creators (scripts, transcripts, captions, notes) is likewise processed into draft lessons, which the creator reviews before publication. We use Anthropic and OpenAI (both USA) through their API services; the legal basis is performance of the contract (Art. 6(1)(b) GDPR), and transfers to the USA are safeguarded by EU Standard Contractual Clauses. Under these providers’ API terms, submitted content is not used to train their models.

Product analytics (PostHog, EU Cloud) happens only if you expressly consent at first launch — or later in the settings (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without consent the analytics SDK is not even initialised: no analytics identifiers are stored on your device and no events are sent. You can withdraw consent at any time in the settings; if this policy changes materially, the app asks again.

To keep the app stable we process crash and error reports with Sentry (Functional Software, Inc., USA). Reports are stripped of standard personal identifiers; the legal basis is our legitimate interest in a working app (Art. 6(1)(f) GDPR). You can object at any time in the settings (crash reports off). Transfers are safeguarded by EU Standard Contractual Clauses.

Purchases and subscriptions run through the Apple App Store; Apple acts as merchant and independent controller for payment processing (we never receive payment details such as card numbers). To manage subscription state (active, trial, expired), our processor RevenueCat (USA) processes a pseudonymous user identifier and purchase receipts; the legal basis is performance of the contract (Art. 6(1)(b) GDPR), safeguarded by EU Standard Contractual Clauses.

On first launch the app sends a one-time signal to our own backend containing only which release stage of the app, which platform and which app version started. All that is stored is a per-day counter — no identifier, no IP address, no precise timestamp; no record describes a person. This count tells us whether releases reach users (Art. 6(1)(f) GDPR) and runs independently of analytics consent — it is a separate purpose that does not require consent, because nothing is stored on or read from your device. “Stored” here refers to our application database. For technical reasons the receiving server sees your IP address during transport; it is processed in memory and discarded. Independently of that, the backend platform keeps short-lived technical function logs (time, IP address, invoked function), deleted automatically after a short period (section 15).

Creators use an account in the creator dashboard to upload material and to review and publish lessons (Art. 6(1)(b) GDPR). If a creator connects their YouTube account in the future, we access channel metadata and captions of their own videos through Google’s YouTube API Services, only with their authorisation and only to prepare draft lessons. Retrieved channel metadata and captions are stored as the source material of the respective lesson in our database (Supabase, EU region Frankfurt); they are deleted when the creator deletes the lesson or their account, or revokes the authorisation — lessons the creator has already reviewed and published remain as the creator’s own approved content. This data is shared onward only with the AI providers named in section 7, to the extent required to prepare the draft lesson — with no one else, and never for advertising. elomenta’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Authorisation can be revoked at any time at security.google.com; from revocation on we no longer access YouTube data. The YouTube Terms of Service and the Google Privacy Policy also apply to the YouTube API Services.

We use the following service providers (processing under Art. 28 GDPR unless marked as an independent controller):

• Vercel Inc. — website hosting (USA; server-side processing in Frankfurt, global CDN)
• Supabase — database, authentication, backend functions (EU — AWS Frankfurt, eu-central-1)
• Apple — app distribution and payment processing (independent controller) (App Store)
• RevenueCat, Inc. — subscription state (USA)
• PostHog — product analytics — only with consent (EU Cloud)
• Functional Software, Inc. (Sentry) — crash and error reports (USA)
• Anthropic / OpenAI — AI processing for lesson creation and practice feedback (USA)
• Google (YouTube API Services) — channel metadata and captions with creator authorisation (USA/global)

Where providers process data in the USA, transfers rest on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and — where the provider is certified, as Vercel is — on the EU-US Data Privacy Framework. Where an EU region is available we use it: Supabase (Frankfurt), PostHog (EU Cloud), server-side website processing (Frankfurt).

Account and learning data are kept for as long as your account exists; account deletion removes them (section 16). The same criterion applies to the subscription data at RevenueCat and the analytics events at PostHog: both are tied to the lifetime of your account — their deletion is triggered or instructed by account deletion, and at PostHog completes only days to weeks later (section 16). Sentry deletes crash reports automatically after at most 90 days. Per their own terms, the AI providers do not retain submitted input permanently — at most temporarily for abuse monitoring (typically up to 30 days). Server and function logs of our hosting and backend platforms (Vercel, Supabase) are deleted automatically — usually within a few days, after about a week at the latest. Data retrieved with YouTube authorisation is stored as described in section 12, for as long as the associated lesson exists. Statutory retention duties (for example under tax law) remain unaffected.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future. Contact us at the email address above — or use account deletion directly in the app, which implements your right to erasure.

Account deletion reaches our processors: it also deletes the associated RevenueCat customer and instructs PostHog to erase your person and events. Three things we state plainly: event erasure at PostHog is queued at deletion time but executed asynchronously by the provider over days to weeks. The erasure instruction to the analytics service is issued whether or not you ever consented to analytics — it carries only your account identifier and only acts to erase, so no profile created under a later-withdrawn consent is left behind. And: deleting your account does not cancel an active App Store subscription — Apple does not let us cancel it on your behalf. Cancel it in your Apple account (Settings → Apple ID → Subscriptions), or you will keep being charged for an app you can no longer reach.

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is Die Sächsische Datenschutz- und Transparenzbeauftragte; you may also contact any other supervisory authority.

We update this policy when processing changes (for example with the app’s release or new features). The version published here applies; for material changes affecting consent, the app asks again.