Privacy policy

1. Controller

The controller responsible for processing personal data on this website and in the SuperGrade app within the meaning of the General Data Protection Regulation (GDPR) is:

[Vor- und Nachname bzw. Firma des Betreibers] [Straße und Hausnummer] [PLZ und Ort] Deutschland Email: [E-Mail-Adresse, z. B. kontakt@supergrade.de]

You can also reach us at this email address with any questions about data protection and to exercise your rights.

2. Overview

SuperGrade is a study app for university students. We process personal data only as far as necessary to run the website, your user account, the services you book, billing and the security of the service. We do not use advertising or audience analytics services, we do not sell data, and we do not use your study content for advertising. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We use the service providers named below as processors (Art. 28 GDPR). They process data only on our instructions unless stated otherwise.

3. Visiting the website and hosting (Vercel)

The website and the app are run on Vercel Inc. (USA). With every request, Vercel processes the technically necessary connection data: IP address, date and time, requested address, referrer, browser type and operating system, and the response status code. This data is needed to deliver the pages and is kept briefly in server logs for troubleshooting and defending against attacks. It is not combined with other data.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable provision of the service. If you are logged in, the processing also serves the performance of the user agreement (Art. 6(1)(b) GDPR). For transfers to the USA, see section 13.

4. Cookies and storage on your device

We do not use analytics, marketing or third-party cookies. Only the following information is stored on your device:

• Supabase login cookies (name starts with "sb-"): keep you logged in and are deleted when you log out or when they expire.
• Language cookie "NEXT_LOCALE": remembers your chosen language for the browser session.
• Entries in your browser's local storage: your choice of light or dark theme, the selected list view, the selected study focus per class, and details of the running study session so that an interrupted session can be ended correctly. These entries remain until you delete them in your browser.

The legal basis for storing and reading this information is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because it is necessary to provide the service you use. We base the further processing on Art. 6(1)(b) GDPR (login, settings, study session) and Art. 6(1)(f) GDPR (error analysis).

5. Registration and user account (Supabase)

To use the app, you create an account. We process your email address, your password (stored only as a cryptographic hash), optionally a display name, and technical login information such as the time of registration and of your last login. To secure the login, our provider also logs the IP addresses of login events.

The database, login and file storage are provided by Supabase, Inc. (USA). The data is stored in a data centre in Frankfurt am Main, Germany (region eu-central-1). Access by Supabase from third countries, for example for maintenance and support, cannot be ruled out; the safeguards described in section 13 apply.

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). Email address and password are required; without them, no account can be created.

6. Account emails

We send account emails, for example to confirm your email address when you register, via [E-Mail-Versanddienstleister: Name und Sitzland]. Your email address, the content of the email and technical delivery data are processed. The legal basis is Art. 6(1)(b) GDPR. We do not send newsletters or advertising emails.

Also via [E-Mail-Versanddienstleister: Name und Sitzland], we send you a contract confirmation after a purchase and an acknowledgement of receipt after a cancellation via “Cancel contracts here” or a withdrawal via “Withdraw from contract”. For this we store your declaration with the time of its receipt and the details you enter: email address, for a withdrawal your name, the contract concerned, type and requested date of a cancellation and, where given, its reason. The legal basis is Art. 6(1)(c) GDPR in conjunction with §§ 312f, 312k and 356a BGB (German Civil Code).

7. Your study content and uploaded PDF files

When you use the app, we store the content you create and the data generated while you study:

• classes and exercises with your details (e.g. name, description, source, importance)
• uploaded PDF files (e.g. exercise sheets) and the exercises created from them
• your ratings during reviews, the resulting learning state and the review history
• study sessions with start, end and duration
• your subscription status: booked plan, end of the billing period, validity of a Semester Pass, and your customer and subscription IDs at Stripe

We use this data to provide the app, schedule reviews and show your progress. The legal basis is Art. 6(1)(b) GDPR. Please do not upload documents that needlessly contain personal data of third parties.

8. AI-powered features (Anthropic)

Some features use an AI language model (Claude) from Anthropic, PBC (USA). Data is transferred only when you trigger one of these features yourself:

• PDF import: we send the text extracted from your PDF file to Anthropic. If no usable text can be extracted, we send the first pages of the PDF file itself. The model identifies exercises and returns them in a structured form.
• Assign importance: we send the text you paste (e.g. notes on exam relevance) together with the names, labels and descriptions of the exercises in the class, so that the model can assign an importance to each exercise.

The legal basis is Art. 6(1)(b) GDPR, as the transfer is necessary for the feature you requested. Anthropic processes the data as a processor, states that it does not use data from its commercial API to train its models, and keeps inputs and outputs only for a limited time. We store the results in your account. For transfers to the USA, see section 13.

9. Payment processing (Stripe)

You pay for paid plans and the Semester Pass via Stripe. When you buy, you are redirected to a Stripe payment page. You enter payment details such as card numbers directly there; we do not receive them. We send Stripe your email address and an internal ID of your account and receive the payment and subscription status back. In the Stripe customer portal you manage your subscription, payment method and invoices.

The provider is Stripe Payments Europe, Limited (Ireland). Stripe processes some data as an independent controller, for example for fraud prevention and to meet legal obligations, and may transfer data to Stripe, Inc. (USA). The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (tax and commercial record-keeping obligations). More information: Stripe privacy policy.

10. Error monitoring (Sentry)

To detect and fix errors, we use Sentry, a service of Functional Software, Inc. (USA). When an error occurs, the browser or server sends an error report with the error message, the program trace (stack trace), the requested address, browser, operating system and time. If you are logged in, the report contains only your internal user ID, not your email address or name. For a share of page views we also measure loading times.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a stable and secure service. Sentry deletes the data when the retention period of our plan ends, at the latest after 90 days. For transfers to the USA, see section 13.

11. Abuse protection (Upstash)

To prevent abuse and overload, we limit how often certain actions can be carried out per account within a time window, for example PDF imports or checkouts. For this we store a counter for your internal user ID at Upstash, Inc. (USA). The counter is deleted automatically when the time window ends, at the latest after two hours. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the service and limiting costs.

12. Contact by email

If you email us, we process your details to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns your account or a contract, otherwise Art. 6(1)(f) GDPR. We delete the correspondence once it is no longer needed, unless statutory retention obligations apply.

13. Transfers to third countries

Vercel, Supabase, Anthropic, Sentry and Upstash are based in the USA; Stripe may transfer data to Stripe, Inc. in the USA. Where personal data is transferred to the USA, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of our contracts with the providers. The same applies to the email delivery provider if it is based outside the EU. You can request a copy of the safeguards from us.

14. Retention and deletion

We store your account data and study content for as long as your account exists. You can delete your account at any time in the settings. We then end a running subscription at Stripe, delete your uploaded PDF files and then delete your account with all classes, exercises, reviews and study sessions. Deletion takes effect immediately and cannot be undone.

Excepted is data we must keep for legal reasons: we and Stripe keep invoices and payment records for up to ten years under § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code); your customer record at Stripe remains for this purpose. Deleted data may remain in our database provider's backups until they are overwritten in the regular cycle. Server logs, error reports and abuse-protection counters are deleted within the periods stated above.

We keep cancellations and withdrawals as proof even after your account is deleted, until the limitation period for claims from the contract has expired, usually three years from the end of the year of receipt. The link to your account is removed when the account is deleted.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, contact [E-Mail-Adresse, z. B. kontakt@supergrade.de].

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is [Datenschutz-Aufsichtsbehörde des Bundeslands des Betreibers].

16. Changes

We update this privacy policy when our service or the law changes. The version published on this page applies.