Privacy Policy

Last updated: 2026-06

Overview

We ([Your legal name / company]) process personal data to operate Bestehn. This policy explains what we collect and why, under the GDPR.

Data we collect

Account (email, name), learning activity (exam attempts, written and transcribed spoken answers, scores, progress), payment data (handled by Stripe — we never store card details) and technical data such as your IP address, used briefly for security, rate limiting and abuse prevention.

Legal bases

We process your account and learning data, the AI assessment of your answers and the handling of your purchases to perform our contract with you (Art. 6(1)(b) GDPR); invoices and payment records to meet statutory retention duties (Art. 6(1)(c)); security measures such as rate limiting and abuse prevention, and recording which channel brought you, on the basis of our legitimate interests (Art. 6(1)(f)); optional analytics and marketing emails only with your consent (Art. 6(1)(a)), which you can withdraw at any time with effect for the future.

Processors

Supabase (auth + database), Vercel (hosting + cookieless, anonymous web analytics), Stripe (payments), Resend (email), OpenAI (AI grading/generation). Each processes data only on our instructions under a data processing agreement (Art. 28 GDPR). Some of these providers are based in the USA: transfers rely on the EU adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified (Art. 45 GDPR), and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards at the contact address below.

Voice recordings

Speaking answers you record are sent for transcription and assessment, then the audio is discarded — we do not store your audio files. Only the text transcript, scores and feedback are kept in your account so you can review your progress.

How you found us

When you create an account we record which channel brought you (for example: a search engine, a social network, or a link from another site) and, if there was one, the campaign tag in the link. We store the referring website's name only — never the full address, and never the words you searched for. Nothing is stored on your device for this. Legal basis: our legitimate interest in knowing which channels work (Art. 6(1)(f) GDPR); you may object at any time.

Data retention

Account and learning data are kept while your account exists and deleted when you delete your account. Payment records are retained as long as tax law requires (7 years in Austria).

Your rights

Under the GDPR you can access, correct, export, restrict, object to, or delete your data (delete your account in Settings). You may also complain to a supervisory authority (in Austria: dsb.gv.at). Contact: support@bestehn.com.

Automated assessment

Your written and spoken answers are assessed automatically by an AI system so you receive feedback immediately. These are practice estimates: they produce no legal effect, they do not determine access to any exam, course or qualification, and nothing about you is decided by them. You can ask us to have an assessment reviewed by a person at any time.

Cookies

We use essential cookies for login and (with consent) analytics. You can manage consent at any time.