Privacy Policy

Last updated: 27.10.2026

1. The key points

• The controller for KollegPass is Saifuna Rysalieva, based in Kyrgyzstan.
• We process your data to provide KollegPass to you: account, learning progress, AI features and leaderboards.
• We do not show ads, do not use advertising tracking and do not sell data.
• We collect statistics only with your consent and without cookies.
• Our database is located in the EU (Frankfurt am Main). Some service providers are outside the EU, for example in the USA.
• You have rights, for example to access, erasure and objection.

2. Controller

Saifuna Rysalieva
Ulan Street 27, Bishkek 720016, Kyrgyzstan
E-Mail: privacy@kollegpass.de

3. Representative in the EU (Art. 27 GDPR)

Because our registered office is outside the EU, we have appointed a representative in the EU:

[EU_REPRESENTATIVE]

You can also contact our representative about any data protection matter.

4. Data protection officer

You can reach us at privacy@kollegpass.de with any data protection question.

5. What data we process and why

5.1 Visiting the website and the app

• Data: IP address, date and time, requested address, previously visited page (referrer), browser and operating system, status code, amount of data transferred, security signals (for example to detect bots).
• Purpose: to deliver the website, keep operations stable, detect and stop attacks.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and working service.
• Retention: at most days. Longer only if we need the data to investigate a specific security incident.

5.2 Using KollegPass as a guest

As a guest, the app stores your progress only in your browser (local storage). We do not receive this data. When you use the app, it loads content from our servers. This creates the data described in section 5.1.

If you create an account later, you can transfer your guest progress to your account.

Storing data on your device is based on § 25(2) no. 2 TDDDG. More in the notice on cookies and storage.

5.3 Signing in with Google, Apple or Telegram

• Data we receive:
  • from Google: name, e-mail address, profile picture and Google ID;
  • from Apple: Apple ID, e-mail address (possibly a relay address from Apple) and, at first sign-in, your name if you share it;
  • from Telegram: Telegram ID, name, username and profile picture. We do not request your phone number.
• Purpose: to create your account, sign you in and protect against misuse.
• Legal basis: Art. 6(1)(b) GDPR (contract).
• Retention: until you delete your account.
• Notes: Google (in the EEA and Switzerland: Google Ireland Limited), Apple (in the EEA, the United Kingdom and Switzerland: Apple Distribution International Limited, Ireland) and Telegram (Telegram Messenger Inc.) process your data during sign-in as separate controllers. Their privacy policies apply. The provider learns that you are signing in to KollegPass. We load the provider's sign-in function only when you click the respective button. We do not automatically use your profile picture from the provider as your public avatar.

5.4 Account, profile and learning progress

• Data: account ID, nickname, avatar, language, target Studienkolleg(s), course type, exam date, German level, answers, results, mock exams, learning streaks, settings. Optional: your real name and a photo.
• Purpose: to provide the learning features, save your progress and create your study plan.
• Legal basis: Art. 6(1)(b) GDPR. For your real name and your photo: your consent (Art. 6(1)(a) GDPR). A photo can reveal special categories of data, for example ethnic origin or religion. By uploading it, you also give your explicit consent for this (Art. 9(2)(a) GDPR). You can delete your name and photo at any time.
• Retention: until you delete your account. We delete accounts that have not been signed into for months. If we can reach you, we tell you beforehand.
• Study plan: From your results we calculate a study plan and a readiness value. This is an automated evaluation (profiling), but it has no legal effect on you (see section 7).

5.5 Ranked tests, leaderboards and result cards

• Data: participation, answers, points, time taken, rank, target Studienkolleg, your visibility setting and fair-play data (section 5.12).
• What others see: depending on your setting
  • "Nickname only": nickname, avatar, points and rank;
  • "Show name": your real name and, if available, your photo, points and rank;
  • "Hide me": nothing.
    The per-college leaderboard also shows which Studienkolleg you are preparing for. Leaderboards can be seen by.
• Purpose: to run ranked tests and show leaderboards.
• Legal basis: participation and display with nickname: Art. 6(1)(b) GDPR, because leaderboards are part of the ranked tests you choose to use. Display of your real name and photo: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.
• Retention: results for as long as your account exists. Weekly leaderboards are visible for. After that they are kept only without names and nicknames. If you delete your account, we remove or anonymise your entries.
• Result cards: When you tap "Share", we create an image with your result. You and the recipients decide what happens to a shared card.

5.6 AI tutor and AI feedback

• Data: your messages and texts, the task, necessary context (for example language, course type and level), the AI's answers, technical data and a pseudonymous ID used to detect misuse. We do not pass your name or e-mail address to the AI provider.

• Purpose: to answer your questions, give feedback on your texts, prevent misuse and apply usage limits.

• Processor: Anthropic, PBC (USA). Anthropic processes the data only on our behalf and may not use it to train AI models. Anthropic deletes inputs and outputs within 30 days. Exception: if Anthropic's systems detect a possible breach of its usage policies, Anthropic may keep inputs and outputs for up to 2 years and safety classification scores for up to 7 years.

• Legal basis: Art. 6(1)(b) GDPR, because you use the AI feature. For misuse protection: Art. 6(1)(f) GDPR.

• Retention with us: chat history and feedback for or until you delete them or your account.

• Human review: We look at conversations only when necessary, for example if you report a problem, if misuse is suspected or if the law requires it.

• More in the AI notice.

5.7 Purchases through Dodo Payments

• Role: Dodo Payments sells the passes and processes your payment data as a separate controller. The Dodo Payments privacy policy applies. We do not receive your full payment details, for example card numbers.
• Data we give to Dodo Payments: the selected product, language and a pseudonymous ID so that we can link the purchase to your account.
• Data we receive from Dodo Payments: order number, product, price, tax, country, e-mail address, name, payment status and information about refunds and chargebacks.
• Purpose: to unlock your pass, send confirmations, handle withdrawals and cancellations, support, legal obligations.
• Legal basis: Art. 6(1)(b) GDPR; for legal obligations Art. 6(1)(c) GDPR; for defending against claims Art. 6(1)(f) GDPR.
• Retention: until the end of the third calendar year after the contract ends. Longer if tax or commercial law requires it.

5.8 E-mails about your contract

• Data: e-mail address, name, contract details, content of your declaration, date and time.
• Purpose: We send the confirmations required by law: contract confirmation after the purchase, acknowledgement of receipt for a withdrawal and confirmation of a cancellation.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with § 312f, § 312k and § 356a of the German Civil Code (BGB); also Art. 6(1)(b) GDPR.
• Service provider: [EMAIL_SERVICE_PROVIDER]
• Retention: until the end of the third calendar year after the contract ends.
• We do not send newsletters or marketing e-mails.

5.9 Referral programme

• Data: your invitation code, who invited whom (account IDs), date of sign-up, whether the bonus condition is met, bonuses granted and data for detecting misuse (section 5.12).
• What the inviting person learns: that someone signed up through their link and whether the bonus was granted.
• Legal basis: Art. 6(1)(b) GDPR; misuse protection: Art. 6(1)(f) GDPR.
• Retention: after the bonus is granted.
• Until you sign up, your browser stores the invitation code (see cookies and storage).

5.10 Reminders via Telegram bot and web push

Telegram bot

• Data: Telegram ID and chat ID, your reminder settings and the bot's messages.

• Purpose: to send learning reminders and notices about your account.

• Legal basis: your consent (Art. 6(1)(a) GDPR). Telegram is based outside the EEA, and there is no EU adequacy decision for that country. The transfer to Telegram is therefore based on your explicit consent (Art. 49(1)(a) GDPR). Risk: the level of data protection may be lower than in the EU, and there are no standard contractual clauses with Telegram.

• Withdrawal: at any time with the /stop command in the bot or in the settings.

• Retention: until you withdraw your consent or delete your account.

Web push

• Data: your push subscription (a technical address and keys of your browser) and your settings.
• Purpose: to send learning reminders to your device.
• How it works: Notifications pass through the push service of your browser maker, for example Google, Mozilla, Apple or Microsoft. These services may be based in the USA. The content of the notification is encrypted.
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
• Withdrawal: at any time in the settings or in your browser.
• Retention: until you withdraw your consent or the subscription becomes invalid.

Reminders contain no advertising.

5.11 Support and contact

• Data: your contact details, the content of your request and, if necessary, data from your account.
• Purpose: to answer your request.
• Legal basis: Art. 6(1)(b) GDPR for questions about your contract, otherwise Art. 6(1)(f) GDPR (interest in answering requests).
• Retention: until the end of the third calendar year after the last contact.

5.12 Fair play, security and misuse protection

• Data: answer times and answer patterns in ranked tests, technical events during a test (for example whether the app was left), signs of multiple accounts, IP address, use of the referral programme and of the AI features.
• Purpose: to detect cheating, multiple accounts and misuse; to keep leaderboards fair; security.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is fair competition and a secure service. Partly also Art. 6(1)(b) GDPR.
• Important: We do not use device fingerprinting. Automated checks only flag anomalies. A human decides on measures.
• Retention:. Longer only if we need the data in a specific case.

5.13 Notices and complaints under the Digital Services Act

• Data: name and e-mail address of the person reporting, content of the notice, the content concerned, our decision with reasons and your complaint.
• Purpose: to handle notices and complaints and give reasons for decisions.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 DSA; also Art. 6(1)(f) GDPR.
• Retention: after the case is closed. Longer if we need the data for legal claims.
• If we suspect a criminal offence that threatens people's life or safety, we inform the competent authorities (Art. 18 DSA).

5.14 Statistics with Cloudflare Web Analytics – only with consent

• Data: pages visited, previously visited page, browser, operating system, country and loading times. For this, a script reads performance data from your browser. It sets no cookies and does not track you across other websites. Cloudflare processes your IP address to transmit the measurement.
• Purpose: to understand how KollegPass is used and to improve loading times. We only see aggregated numbers.
• Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
• Withdrawal: at any time in the privacy settings.
• Retention:

5.15 Our Telegram community

Our community on Telegram is a separate service on the Telegram platform. Telegram's terms and privacy policy and the community rules apply there. As administrators, we see your public Telegram profile and your messages in the group. We use them only to run and moderate the community (Art. 6(1)(f) GDPR).

5.16 Legal obligations and legal defence

We also process data when a law obliges us to do so (Art. 6(1)(c) GDPR) or when we need to establish or defend legal claims (Art. 6(1)(f) GDPR).

6. Do you have to provide data?

Without the sign-in details we cannot create an account. Without purchase data you cannot buy a pass. All other information, for example your real name, photo or reminders, is optional.

7. Automated evaluations

KollegPass evaluates your answers automatically: points, study plan, readiness value and AI feedback. This is profiling within the meaning of Art. 4(4) GDPR. However, there are no decisions that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). Fair-play checks only flag anomalies. A human decides on measures.

8. Recipients

We also share data where necessary: with our EU representative, with authorities and courts when we are legally obliged to, and with advisers (for example lawyers) who are bound by confidentiality.

We use ElevenLabs for the synthetic voices in the listening exercises. We do not share any of your data for this, because the audio is created in advance.

9. Transfers to countries outside the EU

Our seat in Kyrgyzstan. We are based in Kyrgyzstan. There is no adequacy decision of the European Commission for Kyrgyzstan. The level of data protection may therefore differ from that in the EU, for example regarding access rights of authorities. Because we offer KollegPass to people in the EU, the GDPR nevertheless applies to us in full (Art. 3(2) GDPR).

When you use KollegPass, you give your data directly to us. In the view of the European Data Protection Board, this is not a "transfer" within the meaning of Chapter V GDPR. The GDPR still protects your data in full.

Our database is located in the EU. Our team in Kyrgyzstan accesses it remotely, for example for support and operations. Where our service providers in the EU transfer data to us in the process, we use the EU standard contractual clauses.

Service providers outside the EU.

• USA (Cloudflare, Anthropic, Supabase support): Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). In addition, and for the other providers, we use the EU standard contractual clauses.
• Singapore (Supabase): EU standard contractual clauses.
• Dodo Payments: EU standard contractual clauses.
• Telegram: your explicit consent (section 5.10).

You can get a copy of the standard contractual clauses on request at privacy@kollegpass.de.

10. How long we keep data

We keep data only as long as we need it for the respective purpose. The periods are listed in section 5. Statutory retention obligations take precedence. After that we delete or anonymise the data. Backup copies are overwritten after days at the latest.

11. Your rights

• access your data (Art. 15 GDPR),
• rectification of incorrect data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

You can use many rights directly in the app: download your data, edit your profile, delete your account. Otherwise write to privacy@kollegpass.de. To make sure no one else gets your data, we may ask you to identify yourself, for example by signing in to your account.

Right to object (Art. 21 GDPR)
Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object at any time on grounds relating to your particular situation. We will then stop processing the data, unless we have compelling legitimate grounds that override your interests, or the processing serves legal claims. To object, write to privacy@kollegpass.de.

12. Complaint to a supervisory authority

You can complain to any data protection supervisory authority, in particular in the EU country where you live or work or where the infringement took place. A list of authorities is available from the European Data Protection Board.

13. Minors

• You may use KollegPass from age 16. If you are 16 or 17, you need your parents' consent.
• Passes can only be bought from age 18.
• If we learn that someone under 16 has an account, we delete it.
• Users under 18 cannot show their real name and photo in leaderboards.
• The AI features have additional safety measures for young people (see the AI notice).

14. Data security

We protect your data with technical and organisational measures, for example: encrypted transfer (TLS), encrypted storage, access only for people who need it, two-factor sign-in for our team, logging, regular backups and pseudonymous requests to the AI provider. There is no absolute security on the internet. In case of a data breach, we inform the authorities and you where the law requires it.

15. Cookies and similar technologies

The notice on cookies and storage explains which data is stored on your device and why.

16. Changes

We update this privacy policy when KollegPass or the law changes. We inform you about important changes in the app. You can always find the current version on kollegpass.de.