BauPros Privacy Policy
The following notices provide an overview of what happens to your personal data when you use BauPros Academy. Personal data is any data that can be used to identify you personally. The use of the Academy's learning content is provided via paid subscriptions; payment processing takes place via our payment service provider Paddle (Merchant of Record); details on this can be found below under section 4 and in the Terms and Conditions as well as the Withdrawal Policy.
Craftra GmbH — BauPros division Alex Underberg (Managing Director) Unter Linden 1, 50859 Köln, Germany Phone: +49 15888 649527 · Email: info@baupros.com
Data Protection Officer: There is no statutory obligation to appoint a data protection officer; please direct data protection inquiries to info@baupros.com.
| Data Category | Purpose | Legal Basis |
|---|---|---|
| Account (email, password hash) | Provision of access | Art. 6 Abs. 1 lit. b DSGVO |
| Profile (name, country, trade, German level, language, years of experience) | Personalisation of learning content | Art. 6 Abs. 1 lit. b DSGVO |
| Learning progress, quiz/exam results | Provision of the learning offering | Art. 6 Abs. 1 lit. b DSGVO |
| AI tutor histories (questions/answers) | Answering learning questions | Art. 6 Abs. 1 lit. b DSGVO |
| Audio/text inputs to the speaking/writing exercises | Exercise evaluation (transient) | Art. 6 Abs. 1 lit. b DSGVO |
| Server/auth logs, technically necessary cookies | Operation & security | Art. 6 Abs. 1 lit. f DSGVO |
| Cookieless, anonymous reach measurement | Stability/reach without personal reference | Art. 6 Abs. 1 lit. f DSGVO |
| Purchase/invoice data (name, email, billing country/address, payment method, transaction ID, purchased service) — no full card data held by us | Processing of paid access/credits via Paddle (Merchant of Record) | Art. 6 Abs. 1 lit. b and lit. c DSGVO (tax/commercial law obligations) |
No profiling and no automated decision-making with legal effect within the meaning of Art. 22 DSGVO takes place. No data is shared for advertising purposes.
Data processing agreements (DPAs) exist or will be concluded with the providers listed below. Data processing takes place primarily within the EU; for providers with possible third-country relevance, the EU Standard Contractual Clauses are applied.
- Vercel (hosting/delivery) — EU region. Delivery of the application, server logs.
- Supabase (database, authentication, file storage) — EU region (Frankfurt). Storage of account, profile, progress, and media data.
- Anthropic (AI tutor / AI explanations) — processing of the inputs directed at the AI tutor transiently for response generation. No clear names are transmitted to the AI model; the inputs are not used to train third-party models.
- OpenAI (AI-supported evaluation of writing/speaking exercises as well as pre-generated speech output/images) — processing of the exercise inputs transiently for evaluation; no permanent storage by the provider for its own purposes, no training with the inputs.
- Resend (email dispatch) — sending of transactional emails (registration, password reset). Processes email address + mail content.
- Paddle (Paddle.com Market Ltd., United Kingdom — payment processing & sale as Merchant of Record) — for paid orders, processes name, email, billing country/address, payment method, and transaction data for payment processing, fraud prevention, and tax-compliant invoicing. The full payment-method/card data is processed directly at Paddle or its payment partners, not at our end. For the third-country relevance (UK), the European Commission's adequacy decision applies, or the EU Standard Contractual Clauses are applied.
- Account, profile, and learning progress data: for the duration of the existing user account.
- After account deletion: deletion or anonymisation, insofar as no statutory retention obligations preclude this.
- AI tutor/learning aid histories: up to 12 months.
- Server/auth logs: as a rule 30 days.
- Transient AI/exercise inputs are not permanently stored after evaluation.
Under the DSGVO, you have the right at any time to:
- Access (Art. 15) to the data stored about you,
- Rectification (Art. 16) of inaccurate data,
- Erasure (Art. 17) — account deletion is possible directly in the profile,
- Restriction of processing (Art. 18),
- Data portability (Art. 20) — data export is possible directly in the profile,
- Objection to processing based on Art. 6 Abs. 1 lit. f (Art. 21),
- Withdrawal of consent given, with effect for the future (Art. 7 Abs. 3),
- Complaint to a supervisory authority (Art. 77).
Competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
To exercise your rights, an informal message to info@baupros.com is sufficient.
This platform uses exclusively technically necessary cookies (login/session) that are required for operation; pursuant to § 25 Abs. 2 TDDDG, no consent is required for these. No marketing or tracking cookies are set. The reach measurement is cookieless and anonymous (no personal reference, no cross-device recognition).
Parts of the learning content, the explanatory audio/images, and the AI tutor are created or operated with the support of AI. No clear names are transmitted to the AI tutor and the exercise evaluation; processing takes place transiently and without profiling.
Transmission is encrypted (TLS). Access to personal data is restricted on the server side by access controls (Row Level Security) to the respective authorised person.
As of: Juni 2026.