Privacy Policy

As of 31 October 2026 · applies to fluentandfearless.de and start.fluentandfearless.de

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. The short version

You can use this website and the free course without an account and without giving me any personal data. Your progress then stays in your browser.

If you want, you can create a free account in the course. Then your email address, your progress and what you type into the course are stored in your account, so you can continue on any device. You can delete your account at any time, with one click.

I only send you news about new courses if you tick a box saying so. There is no tracking and there are no ads. Data is only processed where described below.

3. Hosting

Both websites are hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA, as my processor. When you visit a page, Netlify's servers automatically process technical access data such as your IP address, the time of the request and your browser type. This is necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR, legitimate interest).

This data may be processed in the USA. Netlify participates in the EU-U.S. Data Privacy Framework, on the basis of which the European Commission has recognised an adequate level of data protection (Art. 45 GDPR). In addition, my data processing agreement with Netlify contains the European Commission's standard contractual clauses. More information: netlify.com/privacy

4. Your course progress

The free course saves which steps you have completed, the chapter you last opened, the language you read the course in, and what you type into the course (for example the language you are learning and your level) in your browser's local storage. Without an account, this data never leaves your device, and I cannot see it. It is stored because it is necessary for a function you actively use. If you clear the site data for start.fluentandfearless.de, your progress is reset.

If you are signed in, the same data is also stored in your account (section 5). Your browser then also keeps a sign-in token in local storage so you stay signed in. If you write to me through the contact form, the chapter you were last in is sent along with your message (section 10).

5. Your account (optional)

What I store. When you create an account, I store your email address and, as you use the course: the steps you have completed, the chapter you last opened, what you type into the course (such as the language you are learning, your own language, your level and your answers to the questions in the course), the language you read the course in, whether and when you asked for the Deutschberg Workbook, and when you created your account and last used it. For security, the sign-in service also records technical data such as the time of sign-in and your IP address.

Why. To provide the account you asked for: your progress on every device, and to see how far learners get in the course so I can improve it. Legal basis: Art. 6(1)(b) GDPR (you use the free course with an account).

Where. The account runs on Supabase (Supabase Pte. Ltd., Singapore) as my processor, on servers in Frankfurt, Germany. I have a data processing agreement with Supabase. Supabase may access data from outside the EU for support and maintenance; this is covered by the European Commission's standard contractual clauses.

How long. Until you delete your account. You can do that at any time in the course (“Delete account” at the end of chapter 3); your account data is then deleted immediately, including the proof of your consent (section 7) and your contact at Brevo. Accounts that have not been used for 24 months are deleted automatically. I will email you before that happens, so you can keep your account by signing in once.

Is it required? No. The whole course works without an account.

6. Signing in with Google (optional)

If you choose “Continue with Google”, you are taken to Google, and Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) learns that you are signing in to this course. Google then sends your name, your email address and the address of your profile picture. I use only your email address; the sign-in service stores the other details with your account record. Google's page names our sign-in service by its technical address, ending in supabase.co.

Google is responsible for what happens on its own pages. Data may also be processed by Google LLC in the USA, which participates in the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR, because you chose to sign in this way. If you don't want Google involved, use the email link instead. More information: policies.google.com/privacy

7. Emails

I send emails through Brevo (Brevo SAS, 9-17 rue Salneuve, 75017 Paris, France) as my processor, with a data processing agreement. Brevo processes your email address and the emails sent to you in the EU; where Brevo uses a subcontractor outside the EU, the transfer is covered by standard contractual clauses.

Sign-in links are emails you ask for. The link works once and expires after one hour. The workbook: if you ask for the Deutschberg Workbook, I store the date of your request and add your email address to the workbook list in Brevo, which sends it to you. Legal basis for both: Art. 6(1)(b) GDPR. Brevo keeps the sending logs for one month.

News about new courses — only if you tick “Yes, email me when there are new Fluent & Fearless courses like this one.” The box is never pre-ticked. I store that you agreed, when, and the exact wording you agreed to, as proof of your consent (Art. 7(1) GDPR). If you agreed, Brevo also stores the language you are learning, your own language and your level, so I can write to you only about courses that fit you. Legal basis: your consent, Art. 6(1)(a) GDPR and § 174 of the Austrian Telecommunications Act (TKG 2021).

You can withdraw your consent at any time, without giving a reason: with the unsubscribe link in every email, by unticking the box in your account, or by writing to me. Withdrawing does not affect emails sent before.

No tracking in emails. My emails do not record whether you open them. Links in the emails pass through Brevo, which counts clicks only in total, without linking them to you.

8. Videos (YouTube)

The course contains videos hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Until you click play, no connection to YouTube or Google is made — the preview image comes from this website.

Only when you click play is the video loaded from youtube-nocookie.com. From that moment, Google receives data such as your IP address and may process it in the USA. By clicking play, you consent to this (Art. 6(1)(a) GDPR). You can simply not play the video; the rest of the course works without it. More information: policies.google.com/privacy

9. Cookies

This website sets no cookies. YouTube may do so once you have started a video (section 8). Signing in uses local storage in your browser (section 4), not cookies; Google may set its own cookies on its sign-in page (section 6).

10. Contact by email and contact form

If you write to me, I process your email address and your message in order to answer you (Art. 6(1)(b) or (f) GDPR). My mailbox is hosted by Zoho Corporation B.V., Netherlands, as my processor, in data centres in the EU. I delete the correspondence when it is no longer needed, unless statutory retention periods apply.

The free course has a contact form. If you use it, your email address, your name (if you give it), your message and the chapter of the course you were last in are sent to Netlify (section 3). Netlify stores the message and forwards it to me by email. I use this information only to answer you; the chapter helps me understand your question. I delete the message at Netlify after I have answered you. The form also contains a hidden field that only automated spam programs fill in; Netlify discards such messages.

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on your consent, you can withdraw it at any time with effect for the future. If you have an account, you can delete it yourself at any time at the end of chapter 3 of the course. To exercise these rights, write to the email address above.

I do not use your data for automated decisions or profiling within the meaning of Art. 22 GDPR.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde: dsb.gv.at

12. Changes

I will update this policy when the website or the course changes. The current version is always available at fluentandfearless.de/privacy.