Privacy Policy
Last updated: June 2026
Controller (Art. 4 No. 7 GDPR)
1. Overview
We take the protection of your personal data seriously and process it only in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). This policy explains what data we process when you use bildungly.de and the related AI-powered upskilling advisory service.
2. Data processed when visiting the website
When you access our site, your browser automatically transmits technical data that we store in server log files: IP address (shortened where possible), date and time of the request, referrer URL, browser type and version, operating system. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in providing a stable, secure service. Logs are deleted or anonymised after a maximum of 30 days.
3. AI advisor and chat
When you interact with our AI advisor, the messages you send (including any profile details you voluntarily provide, such as job goals, prior education or language level) are transmitted to our backend and to the underlying AI model providers to generate a response. Legal basis: Art. 6 (1) (b) GDPR (performance of the requested service) and, where you voluntarily share additional details, Art. 6 (1) (a) GDPR (consent). Please do not enter special-category data (e.g. health, religion) or personal data of third parties. Chat data is retained only as long as needed to provide the conversation and improve service reliability, and is then deleted or anonymised.
4. Account and authentication
If you create an account, we process your email address and authentication metadata to identify you and secure access. Legal basis: Art. 6 (1) (b) GDPR. You can delete your account at any time by contacting us.
5. Backend, hosting and analytics (processors)
Our application and database are hosted on infrastructure provided by Supabase (via Lovable Cloud) within the EU where possible. AI responses are generated through model providers integrated via the Lovable AI Gateway. Product analytics are provided by PostHog Inc. on EU infrastructure (eu.i.posthog.com). All of these providers act as processors under Art. 28 GDPR on the basis of data processing agreements. Where data is transferred to third countries, we rely on EU Standard Contractual Clauses (Art. 46 GDPR).
6. Cookies, local storage and analytics
We use two categories of browser storage: (a) Strictly necessary storage required to deliver the Service (e.g. language preference, session, conversation state, your consent choice). Legal basis: § 25 (2) No. 2 TDDDG together with Art. 6 (1) (f) GDPR. No consent is required. (b) Optional product analytics via PostHog, used only after you give consent through our cookie banner. With consent, PostHog stores a randomly generated identifier in cookies/local storage to measure pageviews, feature usage and aggregate funnels. Without consent (or after you decline), PostHog runs in memory-only mode: no cookies, no local storage, no cross-session identifier — only an anonymous pageview counter for the current tab. Legal basis: § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time by clearing this site's browser storage; the banner will then appear again. We do not use advertising cookies and we do not share analytics data with third parties for marketing.
7. Newsletter
If you subscribe to our newsletter, we process your email address using the double opt-in procedure on the basis of your consent (Art. 6 (1) (a) GDPR, § 7 (2) No. 3 UWG). You can withdraw your consent at any time via the unsubscribe link in every email or by contacting us; this does not affect the lawfulness of processing before withdrawal.
8. Course and funding information
Course details displayed in the Service come from the respective training providers and from public funding registers (e.g. KURSNET of the Bundesagentur für Arbeit). When you click through to a provider, that provider becomes the controller for any personal data you share with them. We are not affiliated with the Bundesagentur für Arbeit and do not transmit your data to authorities.
9. Recipients of data
Personal data is shared only with: (a) processors acting on our behalf (hosting, AI model providers, email delivery); (b) authorities where we are legally obliged to do so. We do not sell personal data and do not use it to train third-party AI models.
10. Retention
We store personal data only for as long as necessary for the purposes described above or as required by statutory retention obligations (e.g. tax and commercial law). Afterwards, data is deleted or anonymised.
11. Your rights
Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7 (3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77), e.g. the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). To exercise your rights, contact us at sravan.vankam@outlook.com.
12. Changes to this policy
We may update this Privacy Policy to reflect changes to the Service or to legal requirements. The current version is always available on this page.