Privacy Policy

This policy explains which personal data Kollego processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). It covers this website and the Kollego app.

1. Controller

Kumar Vivek
Königsberger Straße 35
60487 Frankfurt am Main
Germany

Email: kumarvivek@tashiqa.com · Phone: +49 176 87414824

We are not required to appoint a data protection officer. For any privacy question, contact us at the email address above.

2. What we process and why

Visiting this website

When you open a page, our hosting provider processes technical data your browser sends (IP address, date and time, requested page, browser type) to deliver the page and keep it secure. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). These logs are kept only briefly by the host.

We measure page views with Vercel Web Analytics, which works without cookies and without identifying you: visitors are counted with a hash that changes every day and cannot be linked back to a person. Legal basis: legitimate interest in understanding which pages are useful (Art. 6(1)(f) GDPR).

Fonts are served from our own servers; no data is sent to Google or other font providers.

Your account

To create an account we need your name, email address and a password (stored only as a cryptographic hash by our authentication provider). We also store the date you accepted our Terms. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Learning data

To teach you and show your progress we store: the exams you prepare for (exam type, planned exam date, daily study goal, target score), your answers to practice questions, lesson progress, diagnostic and mock-exam results, calculated skill levels, daily study activity (minutes, items, streak), and your time zone so days and reminders follow your local time. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).

Your readiness estimate and study plan are calculated automatically from this data. They are practice guidance only and have no legal or similarly significant effect on you (Art. 22 GDPR does not apply).

Reminder emails

If you switch on daily reminders in Settings, we email you when you haven't practised yet that day. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Settings or with the unsubscribe link in every email.

Account emails

We send emails that are necessary for your account, such as password-reset links. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).

Purchases

Prep+ is sold by our reseller Paddle.com Market Limited (UK), which acts as Merchant of Record. Paddle processes your payment details, billing address and tax information as an independent controller under its own privacy policy. We never see your card details. From Paddle we receive and store the plan, term, amount, currency, a customer ID and a transaction ID so we can grant access and show your purchase history. Legal basis: performance of our contract (Art. 6(1)(b) GDPR). The Paddle checkout script is loaded only when you click a purchase button.

Security

To protect accounts against password guessing, we count sign-in, sign-up and password-reset attempts per email address and per IP address. We store only one-way hashes of these values, for at most 24 hours. Legal basis: legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

3. Cookies and local storage

We use one cookie, kollego_session, which keeps you signed in (valid for 30 days, or until you sign out). We also store a few preferences in your browser's local storage: your colour theme, whether the sidebar is collapsed, and your last detected time zone. All of these are strictly necessary for the service you asked for (§ 25(2) TDDDG), so we do not ask for consent. We use no advertising or tracking cookies.

4. Service providers

We use these processors, bound by data processing agreements (Art. 28 GDPR):

• Supabase Inc. (USA): database and authentication. Data is stored in the EU (Frankfurt, Germany).
• Vercel Inc. (USA): hosting of the website and app, server functions in Frankfurt (Germany), cookieless web analytics.
• Resend (Plus Five Five, Inc., USA): sending reminder emails.

Where data may be accessed from the USA, transfers are protected by the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 44 ff. GDPR). Paddle (see Purchases) is an independent controller, not our processor.

5. How long we keep data

• Account and learning data: until you delete your account.
• Sign-in sessions: 30 days, or until you sign out.
• Password-reset links: 1 hour. Rate-limit records: at most 24 hours.
• Purchase records: until you delete your account. Paddle keeps its own records as required by tax law.

Deleting your account (Settings → Privacy & data) immediately and permanently removes all of your data from our database.

6. Your rights

You have the right to:

• access your data and receive a copy (Art. 15, 20 GDPR): use "Download my data" in Settings;
• have incorrect data corrected (Art. 16): edit your name in Settings, or email us to change your email address;
• have your data deleted (Art. 17): use "Delete account" in Settings;
• restrict processing (Art. 18) and object to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting earlier processing (Art. 7(3));
• lodge a complaint with a supervisory authority (Art. 77), for example ours: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden, datenschutz.hessen.de.

7. Minimum age

Kollego is intended for university applicants. You must be at least 16 years old to create an account. We do not knowingly collect data from children under 16; if you believe a child has created an account, contact us and we will delete it.

8. Changes

We update this policy when our processing changes. The current version is always available on this page. See also our Terms and Imprint.