Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Provimedia GmbH
Weidenweg 12
74321 Bietigheim-Bissingen
Germany

Phone: +49 (0)7142-3442727
Email: info@provimedia.de

2. Overview of Data Processing

LearnCastAI is a platform for creating AI-generated learning podcasts. The following information provides an overview of the types of data processed and the purposes of their processing.

Types of Data Processed

• Personal data (e.g., names, email addresses)
• Content data (e.g., entered topics, questions, preferences)
• Biometric data (voice recordings for voice cloning, only with explicit consent)
• Usage data (e.g., learning progress, quiz results)
• Meta/communication data (e.g., IP addresses, timestamps)

Categories of Data Subjects

• Platform users
• Website visitors

Purposes of Processing

• Providing the service and its features
• Creating personalized learning podcasts
• Managing user accounts
• Security measures
• Communication with users

3. Legal Bases

The processing of your personal data is based on the following legal grounds:

• Consent (Art. 6(1)(a) GDPR): You have given your consent to the processing of your personal data for one or more specific purposes.
• Contract performance (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which you are party.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of our legitimate interests.

4. Registration and User Account

The following data is collected during registration:

• Name
• Email address
• Password (stored encrypted)
• Time of registration

This data is required to provide your user account and to use our services. The legal basis is Art. 6(1)(b) GDPR (contract performance).

5. Use of AI Services

To provide our services, we use various AI-based technologies. Your entered content (topics, questions, preferences) is transmitted to service providers in the United States of America (USA).

AI Technologies Used

Function	Data Processed	Server Location
Script generation	Topic, questions, knowledge level	USA
Fact-checking	Generated script	USA
Source research	Topic, search terms	USA
Text-to-speech (TTS) Cartesia AI, ElevenLabs	Verified script	USA
Voice Cloning (optional) ElevenLabs	Voice recording (audio file)	USA
Flashcard generation	Podcast script	USA
Quiz generation	Podcast script	USA

Legal Basis for Third-Country Transfer

The transfer to the USA is based on:

• Your explicit consent (Art. 49(1)(a) GDPR)
• Standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR)
• EU-US Data Privacy Framework (if the service provider is certified)

Note: The USA may not provide a level of data protection comparable to EU law. US authorities may potentially access your data without equivalent legal remedies being available to you. By using our service and accepting this privacy policy, you consent to this transfer.

5a. Voice Cloning (Pro Feature)

Users with a Pro or Max subscription can optionally use the Voice Cloning feature to create a synthetic copy of their own voice for use in podcasts and audiobooks.

Data Processed

For voice cloning, the following data is collected and processed:

• Voice recording: An audio recording of your voice (60–180 seconds)
• Voice model: A synthetic voice model generated from your recording
• Metadata: User ID, language, gender (as provided by you)

Service Provider

Your voice recording is transmitted to and processed by:

ElevenLabs, Inc.
New York, USA
Website: elevenlabs.io
Privacy Policy: elevenlabs.io/privacy

ElevenLabs uses your recording to create a voice model using their "Instant Voice Cloning" technology. The voice model is stored on ElevenLabs' servers in the United States for as long as it is active in your account.

Legal Basis

Voice recordings constitute biometric data within the meaning of Art. 9(1) GDPR. Processing is based on:

• Your explicit consent (Art. 9(2)(a) GDPR) — You must give separate, explicit consent before recording and submitting your voice. This consent is collected via a dedicated checkbox before the voice cloning process begins.
• Consent for third-country transfer (Art. 49(1)(a) GDPR) — You are informed that your voice data is transmitted to the USA and explicitly consent to this transfer.

Your Rights Regarding Voice Data

• Deletion: You can delete your cloned voice at any time via "My Voice" in your account settings. Upon deletion, we immediately delete both the voice model on ElevenLabs' servers and any local copies.
• Withdrawal of consent: You can withdraw your consent at any time by deleting your voice. The withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Account deletion: If you delete your account, your cloned voice is automatically deleted from both our system and ElevenLabs.

Data Retention

Your voice recording is transmitted to ElevenLabs during the cloning process and is not stored permanently on our servers. The generated voice model remains on ElevenLabs' servers until you delete it or your account is closed. We do not use your voice data for any purpose other than generating audio content at your explicit request.

6. Cookies and Sessions

We use technically necessary cookies and sessions for:

• Session cookie: To maintain your login session
• CSRF token: To protect against cross-site request forgery attacks

These cookies are essential for the operation of the website and cannot be disabled. They do not contain personal data and are automatically deleted when the session ends or expires.

Matomo (Web Analytics)

We use Matomo, a self-hosted open-source web analytics tool. Matomo is hosted on our own servers at provimedia.de — no data is transferred to third parties.

Data collected: Pages visited, referrer URL, browser type, screen resolution, operating system, date and time of access, anonymized IP address.

Legal basis: Art. 6(1)(a) GDPR (consent). Matomo is only activated if you have accepted analytics cookies via our cookie banner.

7. Storage of Learning Progress

To provide you with an optimal learning experience, we store:

• Your progress with flashcards (spaced repetition)
• Quiz results and answers
• Timestamps of the last review

This data is stored exclusively on our servers in Germany and is not shared with third parties. It serves to improve your learning success through personalized review intervals.

8. Hosting

Our website is hosted by a German hosting provider. The server is located in Germany. Each time you access our website, the following data is automatically stored in server log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access was made (referrer URL)
• Browser and operating system used

This data is stored for security reasons and is automatically deleted after 7 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in security).

9. Your Rights

You have the following rights regarding your personal data:

Withdrawal of Consent

You have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

10. Data Security

We employ technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access:

• SSL/TLS encryption for all data transmissions
• Encrypted storage of passwords (bcrypt)
• Regular security updates
• Access restrictions for employees

11. Data Retention

We only store your data for as long as necessary for the respective purposes:

• Account data: Until deletion of your account
• Podcasts and learning materials: Until deleted by you or your account
• Server logs: 7 days
• Billing data: 10 years (statutory retention period)

12. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to adapt it to changed legal situations or when changes are made to the service. The current version can always be found on this page.

13. Contact for Data Protection Inquiries

If you have questions about the processing of your personal data or wish to exercise your rights, please contact:

Email: datenschutz@provimedia.de
Post: Provimedia GmbH, Data Protection, Weidenweg 12, 74321 Bietigheim-Bissingen