Privacy Policy

The controller responsible for data processing on this website is:

German with Marvin LLC, Marvin Hagen Graf (Sole Member),
30 N Gould St Ste N, Sheridan, WY 82801, USA
Email: marvin@germanwithmarvin.com

We process personal data only to the extent necessary to provide a functional website and our content and services. The legal bases are in particular Art. 6(1)(b) GDPR (performance of a contract), (a) (consent) and (f) GDPR (legitimate interest).

This website is hosted by Vercel Inc. (Walnut, CA, USA). When you access the site, technically necessary data (e.g. IP address, date/time, page requested, browser type) is processed to deliver and secure the site (Art. 6(1)(f) GDPR).

To use the platform you can create an account. We process your name, email address and password (stored encrypted), as well as your learning progress. Our backend provider is Supabase Inc. (Singapore; server infrastructure in the USA among others). Legal basis: Art. 6(1)(b) GDPR.

Subscription payments are processed by Stripe (Managed Payments / Merchant of Record). Stripe collects the payment and handles applicable tax; we do not store card details. You get instant access after checkout and can cancel anytime. Legal basis: Art. 6(1)(b) GDPR.

Lesson videos are embedded via YouTube (Google Ireland Ltd.) in privacy-enhanced mode. In this mode YouTube sets cookies only once you actively play a video; data may then be transmitted to Google. Legal basis: Art. 6(1)(f) GDPR.

Our teacher can connect a Google Calendar to the booking system so that your 1-on-1 lessons are added to the calendar and existing appointments are taken into account when showing available times. This Google connection is used only by the account owner (the teacher); students do not connect their own Google accounts.

When the calendar is connected, we request only the minimum Google OAuth scopes needed for this feature:

• .../auth/calendar.events — to create and remove the lesson appointments we schedule;
• .../auth/calendar.readonly — to read existing busy times so that lessons are not double-booked.

How we protect this data:Google access tokens are stored encrypted and transmitted only over encrypted connections (TLS/HTTPS). They are kept in access-controlled infrastructure (Supabase) protected by row-level security and restricted to the owner's account. We access calendar data only to show availability and to manage lesson appointments — we do not otherwise read, store or share your calendar content.

No secondary use: Google user data is never used for advertising, is not sold, and is not used to develop, improve or train generalized AI/ML models. It is not shared with third parties except as strictly necessary to provide this feature or where required by law.

Revoking access: The owner can disconnect the calendar at any time in the app and can revoke access at myaccount.google.com/permissions. On disconnection or account deletion, the stored Google tokens are deleted.

Limited Use: Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Some students unlock the app with an access code obtained through external platforms. Any payments made on those platforms are handled by the respective providers under their own privacy policies.

We use technically necessary cookies to keep you signed in (login session). Without them, logging in is not possible. Legal basis: Art. 6(1)(f) GDPR / § 25(2) TDDDG (strictly necessary cookies).

With your consent we use Google Ads(Google Ireland Ltd.) to measure the success of our advertising — for example whether a sign-up followed an ad click. This may set cookies and, for "enhanced conversions", transmit a hashed (irreversible) form of your email address to Google to match a conversion. We use Google Consent Mode: in the EU/EEA, UK and Switzerland these technologies stay disabled until you agree in the cookie banner, and you can decline. Legal basis: Art. 6(1)(a) GDPR / § 25(1) TDDDG (consent).

To provide our service we use the following processors:

• Vercel Inc. (hosting, USA)
• Supabase Inc. (account & database, USA/Singapore)
• Stripe (payment processing / merchant of record, USA & Ireland)
• Google Ireland Ltd. / Google LLC (YouTube video hosting; Google Ads conversion measurement; Google Calendar API for the booking calendar integration, used by the account owner; EU/USA)

This may involve transferring personal data to the USA. Where required, we base such transfers on appropriate safeguards (e.g. EU Standard Contractual Clauses under Art. 46 GDPR or the EU-US Data Privacy Framework where the provider is certified).

We store personal data only as long as necessary for the stated purposes or as required by law. If you delete your account, the associated data is deleted unless retention obligations apply.

Under the GDPR you have the following rights:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17)
• Restriction of processing (Art. 18), data portability (Art. 20)
• Objection (Art. 21), withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, a message to marvin@germanwithmarvin.com is enough.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence.