Privacy

Privacy policy Last updated: 5 September 2026 1. Controller The controller for data processing on this website is: Martin Gumbrich LangPacks c/o POSTFLEX PFX-949-202 Emsdettener Straße 10 48268 Greven Germany Email: hello@langpacks.com No data protection officer has been appointed, as there is no legal obligation to do so. 2. Overview This website sells digital Anki language packs (.apkg). No third-party marketing or tracking tools are installed (no Google Analytics, Meta Pixel, tag manager or remarketing). For simple reach measurement we run Umami on our own server (see section 5a). There is no cookie banner because we do not use cookies or similar technologies that require consent. 3. Hosting The website and user accounts (PocketBase) run on our own virtual server. The infrastructure provider is netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes technical data as a processor as required to operate the server. Legal bases: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website) and, where a visit is for entering into or performing a contract, Art. 6(1)(b) GDPR. The server is located in the EU. Further information: https://www.netcup.com/de/kontakt/datenschutz 4. Server logs When you visit the website, the web server automatically processes technical access data, in particular: • IP address • date and time of the request • requested URL / status code • referrer (if transmitted) • browser and operating-system identifier (user agent) The purpose is secure, stable operation (error analysis, detecting abuse and attacks). Legal basis: Art. 6(1)(f) GDPR. Web-server logs are generally overwritten or deleted after 14 days, unless a longer retention is required to investigate security incidents. 5. Cookies and local storage We do not set tracking, analytics or marketing cookies. A cookie banner is therefore not required. Strictly necessary storage where needed for a service you have requested: • Website language: cookie “lp_locale” (value de, en or es), stored for one year. Purpose: remember the chosen or suggested interface language. On a first visit without a stored choice, we roughly determine the country from the IP address (without storing the IP) and may also use the browser language (Accept-Language). No location profile is created and this is not used for advertising. • Pack filter (base language) in the shop: stored only locally in your browser (“lp-base-lang”), not sent to us for advertising. • login status of a user account (locally in the browser / technically necessary session) • the payment process with Stripe (see section 7; Stripe cookies are set on Stripe’s own pages) Legal bases: section 25(2) TDDDG (strictly necessary to provide the site in the appropriate language, or login and purchase), Art. 6(1)(f) GDPR (presenting the site intelligibly) or Art. 6(1)(b) GDPR for account and purchase. 5a. Reach measurement (Umami) To understand how the website is used (which pages, where visitors come from, approximate country, device/browser), we run the open-source software Umami on our own server (analytics.langpacks.com, hosted in the EU with netcup). Umami works without cookies and without sharing data with Google or other advertising networks. It processes in particular the page viewed, referrer, browser language, approximate country, screen/device type and a daily rotating, non-personal visitor counter. IP addresses are not stored as a profile. The CMS (Keystatic) is not measured. Purpose: reach and improving the offering. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analysing our own website). You may object by blocking trackers in your browser or by emailing hello@langpacks.com. 6. Contact by email / contact form If you contact us by email or via the contact form on the legal notice page, we process the data you provide (at least your name, email address and the message) in order to reply. Legal basis: Art. 6(1)(b) GDPR if the request is contract-related, otherwise Art. 6(1)(f) GDPR. Data are deleted when the conversation has been completed, unless statutory retention duties apply. 6a. Electronic withdrawal function If you submit a withdrawal via the “Withdraw from contract” button, we process your name, email address, information identifying the contract and any optional notes in order to receive the withdrawal, send an acknowledgement of receipt and handle the request. Legal bases: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (section 356a of the German Civil Code). No user account is required. 7. Orders and payment via Stripe Purchases are processed via Stripe Checkout. When you click the buy button, you are redirected to Stripe’s payment page. Stripe receives the data required for payment, in particular email address, payment data (e.g. card or account details you enter directly with Stripe), amount, currency and technical data for fraud prevention. We do not store complete credit-card numbers. After successful payment, Stripe sends us a confirmation, in particular email address, payment status, Stripe session or payment-intent ID, price ID and the purchased pack. We store this information to provide the download, link the purchase to an account (if you are signed in or the email matches an account) and meet statutory record-keeping duties. For users in the EU, the contracting entity is generally Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Stripe may transfer data to affiliates in the United States, in particular Stripe, LLC, relying on the EU-US Data Privacy Framework and, in addition, Standard Contractual Clauses. For payment processing, Stripe acts in part as an independent controller. Stripe’s privacy policy also applies: https://stripe.com/privacy Data processing agreement / DPA: https://stripe.com/legal/dpa Purposes: contract performance, payment processing, fraud prevention, accounting. Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (tax and commercial duties), Art. 6(1)(f) GDPR (fraud prevention and securing payment). 8. User accounts (PocketBase) An account is optional. Accounts run on our own server with PocketBase. If you register with email and password, we process email address, password (stored only as a hash), verification status and account usage data. Purchase records may be linked to the account (purchased pack, status, Stripe IDs, email). Legal bases: Art. 6(1)(b) GDPR (account contract / providing downloads), Art. 6(1)(f) GDPR (linking purchases, preventing abuse). You can delete your account yourself while signed in, or email hello@langpacks.com. Purchase and invoice data that must be kept by law remain unaffected. 9. Sign-in with Google or Apple If you use Google or Apple sign-in (only if the relevant provider is offered on the login screen), that provider sends us the data needed for sign-in, usually an identifier and your email address. • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy: https://policies.google.com/privacy • Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. Privacy: https://www.apple.com/legal/privacy/ Data may be transferred to the United States (Data Privacy Framework / the provider’s Standard Contractual Clauses). Legal basis: Art. 6(1)(b) GDPR (the sign-in method you chose). This processing does not occur unless you use those buttons. 10. Fonts Fonts used on the website are served locally. Visiting the site does not establish a connection to Google or any other font CDN. 11. Retention • Server logs: generally 14 days • Language preference (lp_locale cookie): one year in the browser, renewed on later visits • Account data: until the account is deleted • Purchase, payment and accounting data: in line with statutory retention duties, in particular up to 10 years (German Fiscal Code / Commercial Code) • Email enquiries: after the matter is closed, unless a retention duty applies • Withdrawal declarations: until the matter is closed and for statutory record-keeping, in particular up to 10 years where the process is relevant for accounting (e.g. a refund) • Reach data (Umami): on our server until we delete them; generally no longer than 24 months 12. Recipients Personal data are disclosed only where necessary for operation, contract performance or a legal obligation, in particular to: • netcup GmbH (hosting) • Stripe (payments) • Google or Apple (only if you use that sign-in) • public authorities where we are legally required to do so Data are not shared for advertising purposes. 13. Third countries We do not transfer data to third countries through tracking. Transfers may occur in the course of payment (Stripe) and — if used — social sign-in (Google/Apple). Where no adequacy decision applies, the providers rely on the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses. 14. Your rights Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, email hello@langpacks.com. 15. Complaint to a supervisory authority You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). A list of German authorities is available from the Federal Commissioner for Data Protection and Freedom of Information: https://www.bfdi.bund.de 16. No automated decision-making No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place. 17. Security The website is transmitted via HTTPS (TLS). Access to accounts, the CMS and the server is additionally protected. Absolute security cannot be guaranteed. 18. Changes We will update this privacy policy if the processing or the legal situation changes. The version published on this page applies.