Privacy policy

1. Controller

The controller for the data processing is Proralis UG (haftungsbeschränkt), Zeppelinstraße 1, 01324 Dresden, represented by managing director Eric Reichelt.

Email: kontakt@proralis.de. Phone: 0162 7077721.

2. Terms and principles

We only process personal data as far as this is necessary to provide a functional app and our content and services. Legal bases are in particular Art. 6 (1) lit. b GDPR (contract), lit. f GDPR (legitimate interest) and lit. a GDPR (consent).

Your data is processed on servers within the European Union unless expressly described otherwise.

3. Account and sign-in

To use merkbar you create an account. In doing so we process your email address, a hashed password and optionally your name. This data is needed to provide your personal learning account (Art. 6 (1) lit. b GDPR).

To confirm your email address and for security messages we send emails via our own mail server (see the email section).

4. Your learning content

Your decks, cards, learning progress, streaks and statistics are stored in a Postgres database at our hosting provider within the EU. The legal basis is the performance of the usage contract (Art. 6 (1) lit. b GDPR).

This data remains stored as long as your account exists. You can delete your account and the associated data at any time.

5. Import from GoodNotes and PDF processing

When you upload files from GoodNotes or as a PDF, they are processed on our servers to detect cards from them. To recognize text from handwritten or image content we transmit the relevant page content to our processor OpenAI (see the AI section).

The uploaded original files are only processed as long as necessary for extraction and are deleted afterwards. Only the detected cards in your deck, which you confirm in the preview, are stored permanently.

6. AI processing (OpenAI)

For the AI grading of your free answers and for text recognition during import we use the OpenAI programming interface. The content required in each case (such as your answer, the question and the model answer, or the page content to be recognized) is transmitted to OpenAI and briefly processed there.

OpenAI acts as a processor for us. A transfer to the USA may take place and is safeguarded by appropriate guarantees. According to OpenAI, content transmitted via the programming interface is not used to train the models. The legal basis is the performance of the contract and our legitimate interest in a working learning assessment (Art. 6 (1) lit. b and lit. f GDPR).

7. Email delivery

System messages such as confirmation and security emails are sent via our own SMTP server. In doing so your email address and the message content are processed. To keep delivery traceable we log technical metadata (such as time and status).

The legal basis is the performance of the contract and our legitimate interest in secure operation (Art. 6 (1) lit. b and lit. f GDPR).

8. Server logs

When our services are accessed, technically necessary access data is processed, such as IP address, time, the requested resource and the user agent. This data is required for secure and stable operation and is only kept briefly.

The legal basis is our legitimate interest in secure operation (Art. 6 (1) lit. f GDPR).

9. Cookies and local storage

We use technically necessary cookies and comparable storage techniques to keep you signed in and to save your settings. These are required for operation and need no consent (Art. 6 (1) lit. f GDPR, section 25 (2) TDDDG).

Analytics techniques (see the next section) are only set after you have given consent. We store your decision so that we do not present it to you again on every visit.

10. Analytics with PostHog (only with consent)

Only if you agree do we use PostHog to evaluate usage anonymously and improve the app. Without your consent PostHog is not loaded and no analysis takes place.

We run PostHog on the provider's EU infrastructure. Processed data includes, for example, pages visited, interactions and technical context. The legal basis is your consent (Art. 6 (1) lit. a GDPR), which you can withdraw at any time with effect for the future.

To document your consent we store that and when you agreed or declined, together with technical context data.

11. Payment processing (future)

For future paid offerings, payment processing via Stripe is planned. As soon as you use a paid service, the data required for payment is transmitted to Stripe and processed there under its own responsibility. Until activation no such processing takes place.

We will update this policy as soon as paid features are available.

12. Progressive web app

merkbar can be installed as an app (progressive web app). For this your browser stores technical resources locally so that the app loads quickly and offline-capable parts work. This does not transmit personal learning content to third parties.

13. Your rights

You have the right to information, correction, deletion, restriction of processing, data portability and objection. You can withdraw consent given at any time with effect for the future.

You also have the right to complain to a data protection supervisory authority, for example the Saxon Data Protection Commissioner. To exercise your rights a message to kontakt@proralis.de is enough.

14. Changes to this policy

We adjust this privacy policy when processes, services or the legal situation change. The version published on this page always applies.