Privacy Policy
Last updated: May 2026
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is Felix Radel, operating under Learnovax. For privacy-related questions or to exercise your rights, you can contact us through the contact options provided in the app or by email at support@learnovax.de.
2. General Information on Data Processing
We process personal data only to the extent necessary to provide, secure, operate and maintain the Learnovax platform or where there is a legal basis. Learnovax is an AI-powered learning platform. Users can create learning content, upload documents, manage flashcards, create study plans, use AI features and submit support requests.
3. Categories of Data Processed
Depending on how you use the platform, we may process the following categories of data: • Account data, such as email address, login information and account ID • Authentication data, such as data related to email/password login or Google Login • Learning and usage data, such as flashcards, study plans, exams, notes, tasks, progress and settings • Uploads and user content, such as PDF files, text files, images, screenshots, JSON files, documents and voice inputs • AI requests and AI outputs, such as prompts, answers, summaries, analyses, transcriptions or generated learning content • Support data, such as support requests, messages, account reference and processing status • Payment and contract data, where required for subscriptions and payment processing • Technical data, such as IP address, browser, device type, operating system, timestamps, log data and error messages • In-app notifications, such as notices shown within the platform
4. Purposes of Processing
We process personal data in particular for the following purposes: • Providing and operating the platform • Registration, login, password reset and account management • Providing learning features, flashcards, study plans, exam features and document features • Processing uploads and user content to provide the requested features • Providing AI features, including chat, document analysis, speech-to-text, text-to-speech and, where applicable, image/document understanding • Processing paid subscriptions and payments • Handling support requests • Displaying in-app notifications • Technical security, error analysis, abuse prevention and platform stability • Complying with legal obligations
5. Legal Bases
Depending on the processing activity, processing is based on the following legal bases: • Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or pre-contractual measures • Art. 6(1)(f) GDPR, where processing is based on legitimate interests, in particular security, troubleshooting, abuse prevention and platform operation • Art. 6(1)(c) GDPR, where legal obligations apply, such as tax or commercial retention obligations • Art. 6(1)(a) GDPR, where consent is required and obtained
6. Registration, Login and Google Login
A user account is required to use certain features. You may register or log in using email and password or Google Login. When using Google Login, personal data, in particular identity and account information, may be processed between Google, the platform provider and Learnovax. The data processed by Google also depends on your Google account settings and Google’s privacy policies. Password reset emails may be sent to your registered email address.
7. User Content, Uploads and Learning Materials
Users may upload or create content within the platform, including documents, PDF files, images, screenshots, text files, JSON files, flashcards, study plans, notes and voice inputs. This content is processed to provide the features requested by the user, such as document analysis, flashcard creation, learning assistance or AI-based analysis. Please do not upload content that you are not allowed to process, in particular unlawful content, content without the required rights, or personal data of third parties without appropriate authorization.
8. AI Features and OpenAI
Learnovax uses AI features, in particular via OpenAI, L.L.C. and/or affiliated OpenAI companies. User content, inputs, uploaded documents, text excerpts, voice inputs, transcriptions, images or technical context information may be transmitted to and processed by OpenAI to the extent necessary to provide the respective AI feature. This applies in particular to chat features, document analysis, speech-to-text, text-to-speech, summaries, learning questions, flashcard assistance and, where applicable, image or document understanding. We transmit content to OpenAI only to provide the functions requested by the user. Learnovax does not use your content for its own model training purposes unless expressly agreed otherwise. Please do not enter sensitive personal data unless this is necessary for your learning purpose.
9. Payment Processing via Stripe
Payments and subscriptions are processed via Stripe. If you purchase a paid plan, the data required for payment will be transmitted to Stripe or processed directly by Stripe. Processed data may include name, email address, payment information, billing data, transaction data, payment method, IP address and technical information. Learnovax does not store full payment details such as full credit card numbers on its own systems. Stripe’s privacy policy also applies to payment processing.
10. Platform Operation via Base44
Learnovax is technically operated via Base44. Base44 may provide hosting, backend, database, authentication, file storage, technical infrastructure and app functionality. In this context, personal data may be processed, including account data, login data, user content, uploads, technical data, support data and log data. The processing is carried out to provide, secure, maintain and technically operate the platform. Uploaded files are stored via Cloudflare R2. Access to stored files is provided through time-limited signed URLs that allow authorized users solely to view or download their own files within the application.
11. Support, Admin Debug Logs and Error Analysis
If you submit a support request, we process the content you provide as well as related account data, in particular email address, account reference and message content. For error analysis and platform stability, technical error messages, log data, timestamps, device and browser information, affected features and, in individual cases, usage-related context information may be processed in admin debug logs. This processing serves troubleshooting, improving security and ensuring technical operation. Access is limited to what is necessary.
12. In-App Notifications
Learnovax may display in-app notifications within the platform, such as notices, status messages or support replies. We currently do not use external browser push notifications that require you to grant push permission in your browser.
13. Cookies and Similar Technologies
According to the current implementation, we only use technically necessary cookies or similar technologies required for login, session management, security and basic platform functions. We currently do not use advertising cookies, advertising tracking or traditional analytics tools such as Google Analytics. If consent-based cookies or tracking technologies are used in the future, appropriate consent will be obtained.
14. No External Live Chats, Videos or Captcha Services
According to the current implementation, Learnovax does not use external live chat services, embedded YouTube or Vimeo videos, or reCAPTCHA, hCaptcha or comparable captcha services. If such services are integrated in the future, this Privacy Policy will be updated accordingly.
15. Retention Period and Deletion
Personal data is generally stored only as long as necessary for the respective purposes, as long as your account exists, as long as legal retention obligations apply, or as long as legitimate interests justify further storage. If you delete your user account, your account-related data and stored content will, according to the current implementation, be deleted without undue delay unless legal retention obligations or mandatory technical reasons prevent this. Data required to fulfil legal documentation and record-keeping obligations in connection with contract conclusion, consent records, withdrawal processing, and payment handling may be retained beyond account deletion for the legally required or necessary period. Data may remain in technical backups or system logs for a limited period before being automatically overwritten or deleted.
16. Recipients and Categories of Recipients
Personal data may be transmitted in particular to the following recipients or categories of recipients where necessary: • Base44 as technical platform and infrastructure provider • Stripe as payment service provider • OpenAI as provider of AI features • Google in connection with Google Login • Resend (Amazon SES) as email delivery service provider for transactional emails. Note: account data and delivery logs are processed in the USA. • Cloudflare R2 as storage service for uploaded documents • IONOS as DNS and email infrastructure service provider • SendGrid as email delivery service for system and authentication emails (via Base44) • Authorities, courts or other bodies where there is a legal obligation
17. International Data Transfers
When using external service providers, in particular OpenAI, Stripe, Google or technical platform services, personal data may be processed outside the European Union or the European Economic Area. Where required, such transfers are based on appropriate safeguards, in particular adequacy decisions, standard contractual clauses or other mechanisms provided for under the GDPR.
18. Security
We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure. According to the current implementation, data transmission is encrypted via HTTPS. However, absolute security of data transmission or storage cannot be guaranteed.
19. Minor Users
Learnovax is also aimed at students and may therefore be used by minors. Minors may only enter into paid contracts with the consent of their legal guardians. Minors should not enter or upload sensitive personal data unless this is necessary and consent from their legal guardians has been obtained where required.
20. Your Rights
Subject to the requirements of the GDPR, you have the following rights in particular: • Right of access (Art. 15 GDPR) • Right to rectification (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR) • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object (Art. 21 GDPR) • Right to withdraw consent with effect for the future To exercise your rights, you can contact us through the contact options provided in the app or by email at support@learnovax.de.
21. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. You may contact in particular the supervisory authority responsible for your place of residence, your workplace or the registered office of the controller.
22. Changes to this Privacy Policy
We may update this Privacy Policy if legal, technical or organizational changes occur or new features are introduced. The current version is available on the platform.