Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Provimedia GmbH
Weidenweg 12
74321 Bietigheim-Bissingen
Germany

Phone: +49 (0)7142-3442727
Email: info@provimedia.de

2. Overview of Data Processing

LearnCastAI is a platform for creating AI-generated learning podcasts. The following information provides an overview of the types of data processed and the purposes of their processing.

Types of Data Processed

• Personal data (e.g., names, email addresses)
• Content data (e.g., entered topics, questions, preferences)
• Biometric data (voice recordings for voice cloning, only with explicit consent)
• Usage data (e.g., learning progress, quiz results)
• Meta/communication data (e.g., IP addresses, timestamps)

Categories of Data Subjects

• Platform users
• Website visitors

Purposes of Processing

• Providing the service and its features
• Creating personalized learning podcasts
• Managing user accounts
• Security measures
• Communication with users

3. Legal Bases

The processing of your personal data is based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): You have given your consent to the processing of your personal data for one or more specific purposes.
• Contract performance (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which you are party.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of our legitimate interests.

4. Registration and User Account

The following data is collected during registration:

• Name
• Email address
• Password (stored encrypted)
• Time of registration

This data is required to provide your user account and to use our services. The legal basis is Art. 6(1)(b) GDPR (contract performance).

5. Use of AI Services

To provide our services, we use various AI-based technologies. Your entries and uploaded files (see the table) are transmitted to service providers in the United States of America (USA).

AI Technologies Used

We use all of these services through their paid business interfaces (API), not through consumer apps. The providers process your content as our processors (Art. 28 GDPR) solely for the purposes described here. Under the contractual terms of Google, OpenAI and Anthropic for these interfaces, your content is not used to train their AI models. We do not send email addresses to the AI services; names are only transmitted for the AI functions in study groups (display names of the members). Please do not enter sensitive data about yourself or others in topics, documents or exam answers unless it is needed for learning.

User Profile Analysis

Once a week, we have Google (Gemini) roughly classify how you use LearnCastAI (e.g. student or company, subject area, main purpose), based on the titles and topics of your content and the category of your email domain. We use the result to tailor our offers and information to your use. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can object to this analysis at any time with effect for the future (Art. 21 GDPR); an informal message to the controller (section 1) is sufficient.

Legal Basis for Third-Country Transfer

The transfer to the USA is based on the following grounds, per provider:

• Google LLC, Eleven Labs Inc. and HeyGen Technology Inc.: Adequacy decision of the EU Commission on the EU-US Data Privacy Framework (Art. 45 GDPR); the providers are certified under it.
• OpenAI, Anthropic, Cartesia and Tavily: Standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR), agreed in the providers' data processing agreements.

You can check the current certification status at dataprivacyframework.gov. A copy of the standard contractual clauses is available on request from the controller (section 1).

5a. Voice Cloning (Pro Feature)

Users with a Pro or Max subscription can optionally use the Voice Cloning feature to create a synthetic copy of their own voice for use in podcasts and audiobooks.

Data Processed

For voice cloning, the following data is collected and processed:

• Voice recording: An audio recording of your voice (60–180 seconds)
• Professional Voice Cloning (Max plan only): Longer audio files of your voice (up to 100 MB per file) and a short verification recording in which you read out a displayed text, so that ElevenLabs can confirm that the voice is yours. If several people can be heard in a file, ElevenLabs separates the voices and you select your own — please only upload recordings of your own voice.
• Voice model: A synthetic voice model generated from your recording
• Metadata: User ID, language, gender (as provided by you)

Service Provider

Your voice recording is transmitted to and processed by:

ElevenLabs, Inc.
New York, USA
Website: elevenlabs.io
Privacy Policy: elevenlabs.io/privacy

ElevenLabs uses your recording to create a voice model using their "Instant Voice Cloning" or, on the Max plan, "Professional Voice Cloning" technology. The voice model is stored on ElevenLabs' servers in the United States for as long as it is active in your account.

Legal Basis

Voice recordings constitute biometric data within the meaning of Art. 9(1) GDPR. Processing is based on:

• Your explicit consent (Art. 9(2)(a) GDPR) — You must give separate, explicit consent before recording and submitting your voice. This consent is collected via a dedicated checkbox before the voice cloning process begins.
• Third-country transfer: Your voice data is transmitted to the USA. ElevenLabs is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the EU Commission (Art. 45 GDPR). We point this out to you separately before recording.

Your Rights Regarding Voice Data

• Deletion: You can delete your cloned voice at any time via "My Voice" in your account settings. Upon deletion, we immediately delete both the voice model on ElevenLabs' servers and any local copies.
• Withdrawal of consent: You can withdraw your consent at any time by deleting your voice. The withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Account deletion: If you delete your account, your cloned voice is automatically deleted from both our system and ElevenLabs.

Data Retention

Your original voice recordings (including the verification recording) are transmitted to ElevenLabs during the cloning process and then deleted from our servers. We only store a short audio sample generated with each voice model so that you can preview your voice in the selection. The voice model at ElevenLabs and the sample on our servers remain until you delete your voice or your account is closed. We do not use your voice data for any purpose other than generating audio content at your explicit request.

5b. Oral Exam and Conversation Simulation

In the oral simulation, an AI asks you questions about your learning material or the selected conversation scenario; you answer by voice or text and receive feedback. The questions are read out to you by a synthetic voice (text-to-speech, see section 5).

Process and Recipients

• Questions: Google (Gemini) generates the questions from your learning sources or your details about the scenario.
• Transcription: If you answer by voice, your recording is sent to OpenAI (Whisper) and converted into text. The recording is used only to capture your answer as text; we do not use it to identify you by your voice.
• Evaluation: Google (Gemini) receives the transcript, the question and the related learning sources and produces feedback and a score.

Legal Basis

Processing is necessary to provide the function you started (Art. 6(1)(b) GDPR). For the transfer to the USA, see section 5.

No Automated Decision-Making

Feedback and score are a practice aid for you. They have no legal effect and do not similarly significantly affect you; no automated decision within the meaning of Art. 22 GDPR takes place. We do not pass results on to examination boards, employers or other third parties.

Data Retention

• Voice recordings are deleted automatically depending on your plan: after 30 days (Prüfungs-Flat), 90 days (Pro), otherwise after 7 days (free access and one-time purchases); on the Max plan they are kept until you delete them. Monthly and annual billing are treated the same.
• Recordings that did not lead to an evaluation (e.g. aborted answers) are deleted after 48 hours at the latest.
• Transcripts, feedback and scores remain in your history until you delete the simulation or your account. When you delete a simulation or your account, we remove all associated data including the recordings.

6. Cookies and Sessions

We use technically necessary cookies and sessions for:

• Session cookie: To maintain your login session
• CSRF token: To protect against cross-site request forgery attacks
• cookie_consent: Stores your choice from the cookie banner (retention period: 365 days)

These cookies are essential for the operation of the website and cannot be disabled. They do not contain personal data and are automatically deleted when the session ends or expires.

Attribution of Registrations (Reach Measurement)

To understand which channels bring users to us, we store a coarse origin indicator in your browser on your first visit to our website. These cookies are set by our own server (first-party), contain no identifier that would make you recognizable across devices, and are not transmitted to any third party:

• first_touch: The channel through which you arrived — in strongly simplified form, for example google-organic, chatgpt, or direct. Only the category is stored, never the full address of the referring page and never your search terms (retention period: 90 days)
• first_touch_page: The path of the page on which your visit began, for example /tools/muendliche-pruefung — without parameters (retention period: 90 days)
• utm_source, utm_detail: Identification of a campaign or link through which you arrived, if contained in the accessed address (retention period: 90 days)
• referral_code: Referral code from our referral program, if you arrived via a referral link (retention period: 30 days)

If you register, the value stored at that time is assigned to your user account once, and the cookies are then deleted. If you do not register, they expire after the periods stated above with no further effect. We evaluate this information exclusively in aggregated form to identify which content and channels are effective.

Legal basis: Art. 6(1)(f) GDPR (legitimate interests). Our legitimate interest lies in the needs-based design and the economic planning of our offering. You may object to this processing at any time (contact details under "Controller") and delete the cookies in your browser at any time.

Affiliate program

If you arrive through an affiliate's link, we store their affiliate code in your session on our server and assign your account to that affiliate when you sign up, so they receive their commission. Only if you consent to all cookies in the cookie banner do we also set the affiliate_code cookie (duration 30 days; legal basis your consent, § 25 (1) TDDDG, Art. 6(1)(a) GDPR). The affiliate does not learn who you are.

For affiliates themselves we process name, address, tax data and bank details to perform the affiliate contract and meet statutory retention duties (Art. 6(1)(b) and (c) GDPR). Bank details are stored encrypted; statements are retained for eight years (§ 147 AO, § 14b UStG).

Matomo (Web Analytics)

We use Matomo, a self-hosted open-source web analytics tool. Matomo is hosted on our own servers at provimedia.de — no data is transferred to third parties.

Data collected: Pages visited, referrer URL, browser type, screen resolution, operating system, date and time of access, anonymized IP address.

Legal basis: Art. 6(1)(a) GDPR (consent). Matomo is only activated if you have accepted analytics cookies via our cookie banner.

Google Ads Conversion Tracking

We use Google Ads Conversion Tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to measure the effectiveness of our Google Ads advertising campaigns — i.e. whether a registration or a purchase occurs after you have clicked on one of our ads.

Consent Mode v2: We use Google Consent Mode v2. Without your consent, no advertising cookies are set and no personal identifiers are transmitted — only cookie-less, aggregated signals without personal reference are sent to Google. Only after you click "Accept all" in our cookie banner are cookies set and full conversion tracking activated (signals ad_storage, ad_user_data, ad_personalization, analytics_storage).

Click ID (gclid): If you reach our website via a Google Ads advertisement, the click ID (gclid) provided by Google is stored in a cookie for 90 days and, upon registration, linked to your user account in order to attribute registrations and purchases to the respective advertisement.

Matching of conversion data (Enhanced Conversions): For conversion measurement, we transmit the click ID server-side together with a SHA-256 hashed (pseudonymized) email address to Google. In addition, for logged-in users — only after consent has been given via our cookie banner — when a conversion event is triggered in the browser, your email address is hashed locally using SHA-256 before transmission and sent to Google (Google "Enhanced Conversions"). In both cases, your plain-text email address is not transmitted to Google.

Withdrawal: You can withdraw your consent at any time by deleting the cookies or by making a new selection in our cookie banner.

Legal basis: Art. 6(1)(a) GDPR (consent). Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework (Google LLC is certified) as well as standard contractual clauses.

Further information: https://policies.google.com/privacy.

7. Storage of Learning Progress

To provide you with an optimal learning experience, we store:

• Your progress with flashcards (spaced repetition)
• Quiz results and answers
• Timestamps of the last review

This data is stored on our servers in Germany. For the AI functions in study groups, Google (Gemini) additionally receives the quiz results of a group session (section 5); otherwise this data is not shared with third parties. It serves to improve your learning success through personalized review intervals.

8. Hosting

Our website is hosted by a German hosting provider. The server is located in Germany. Each time you access our website, the following data is automatically stored in server log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access was made (referrer URL)
• Browser and operating system used

This data is stored for security reasons and is automatically deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in security).

9. Your Rights

You have the following rights regarding your personal data:

Withdrawal of Consent

You have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

10. Data Security

We employ technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access:

• SSL/TLS encryption for all data transmissions
• Encrypted storage of passwords (bcrypt)
• Regular security updates
• Access restrictions for employees

11. Data Retention

We only store your data for as long as necessary for the respective purposes:

• Account data: Until deletion of your account
• Podcasts and learning materials: Until deleted by you or your account
• Voice recordings of the oral simulation: 7, 30 or 90 days depending on your plan, on the Max plan until you delete them (details in section 5b)
• Cloned voice and audio sample: Until deleted by you or your account is deleted (section 5a)
• When you delete your account, we remove not only the database records but also all associated files (audio, video, documents, photos, recordings) as well as your voice model at ElevenLabs. Photos and audio files that were transmitted to HeyGen for an avatar video remain there in accordance with HeyGen's retention periods; we do not currently trigger their deletion at HeyGen.
• Server logs: 7 days
• Billing data: 10 years (statutory retention period)

12. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to adapt it to changed legal situations or when changes are made to the service. The current version can always be found on this page.

13. Contact for Data Protection Inquiries

If you have questions about the processing of your personal data or wish to exercise your rights, please contact:

Email: datenschutz@provimedia.de
Post: Provimedia GmbH, Data Protection, Weidenweg 12, 74321 Bietigheim-Bissingen