Privacy Policy

This English version is a convenience translation; only the German version is legally binding.

This Privacy Policy describes what data AI Steps processes, why and for how long. Our principle is to collect as little as possible — the learning path works without advertising tracking, advertising cookies or cross-site profiling.

1. Controller

The controller responsible for processing personal data on this website and in the app is:

Jannik Agethen
Sole proprietorship (Einzelunternehmen)
An Hornsgarten 60
50321 Brühl
Germany
Email: support@prisma-ltd.de

2. Transfers to third countries

Some service providers are based in the USA or process data there. Each provider section states whether such a transfer takes place. It is based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses under Article 46(2)(c) GDPR.

3. Hosting and server logs (Vercel)

The website and the app are hosted by Vercel Inc. (USA). When you access the pages, Vercel processes technically necessary data such as your IP address, time of access, requested page and browser type in server logs. This data is used to deliver the website, maintain security and resolve faults. Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure and stable operation). We do not operate web analytics that create profiles.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

4. Account and sign-in (Clerk)

If you create an account to keep your learning progress across devices, you register through the authentication service Clerk, Inc. (USA). We process your email address, login data and session data; Clerk also processes technical data such as your IP address and browser details to secure sign-ins. Clerk sets technically necessary session cookies (see section 18). Legal basis: Article 6(1)(b) GDPR (performance of a contract). You need an account to access the learning area.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

5. Bot protection during sign-in (Cloudflare Turnstile)

To protect registration and sign-in against automated access, Clerk embeds the Cloudflare Turnstile service of Cloudflare, Inc. (USA). Technical data about your browser and device, including your IP address, is sent to Cloudflare and evaluated to check whether the request comes from a human. Legal basis: Article 6(1)(f) GDPR (legitimate interest in protecting accounts against abuse).

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

6. Sign-in with Google (where offered)

Where offered, you can optionally sign in with your Google account. Google confirms your identity. Through Clerk, we receive your Google account identifier, verified email address, name and profile picture, to the extent that Google provides them. We use this information for sign-in, account association and profile display. This sign-in does not grant us access to Gmail or Google Drive. Legal basis: Article 6(1)(b) GDPR. Further information is available in Google's Privacy Policy.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

7. Learning progress and database (Neon)

We store learning progress (completed sessions, exercise attempts, XP, streak, knowledge level and completed lab tasks) associated with your account in a Postgres database provided by Neon. Storage location: USA (AWS us-east-2, Ohio). When you submit an exercise answer, we send your answer, including any code you entered, to our server. It is assessed there and stored together with the exercise attempt and its result. Answers in learning rooms are also sent to our server for checking; we store confirmed completion in your progress. Your answers from the welcome screen (learning goal, daily time goal, prior experience with Python/PyTorch and whether you start from the beginning or check your level first) are also stored in your progress and shown to you in your profile as your learning plan. The same database holds the subscription and contract data described in sections 11 and 13. Legal basis: Article 6(1)(b) GDPR, and Article 6(1)(c) GDPR for contract records subject to retention obligations.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

8. Abuse prevention (Upstash)

To protect interfaces against abuse, we limit the number of requests per time window using Upstash Redis provided by Upstash, Inc. (USA). For this, we store short-lived counters for a hash of your user identifier or IP address; the counters expire automatically when the respective time window ends. We do not transmit email addresses or values derived from them to Upstash for this: we count how many acknowledgements of receipt go to an address in our own database (section 7). No permanent tracking takes place. Legal basis: Article 6(1)(f) GDPR (security and stability of the service).

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

9. Code exercises in your browser

Executable browser exercises run in an isolated sandbox without network access. Local execution alone does not send the code to our server. When you submit an answer for assessment, however, the code you entered is sent with your answer and stored as an exercise attempt (see section 7). Do not enter passwords, API keys or confidential data in exercise answers.

10. AI tutor (DeepInfra)

If the AI tutor is available and you explicitly submit a question, we send the question, the title of the associated lesson and any code you optionally include to DeepInfra (USA). The provider processes this information with a language model to generate an answer. Complete course content, model solutions and previous chat history are not sent automatically. We do not store a permanent tutor chat history in the application. Processing by the provider is separate; this policy does not promise a particular deletion period at the provider.

The tutor is identified as AI. It does not receive complete account details. Do not enter passwords, API keys, confidential content or unnecessary personal data. Legal basis for processing your explicitly submitted learning question: Article 6(1)(b) GDPR. If the tutor is unavailable, the application indicates this; an answer is then not promised.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

11. Plus subscription and payment (Stripe)

We use Stripe Checkout and the Stripe customer portal for Plus subscriptions. Stripe receives an internal account identifier and the information you enter there, such as your email address, name, billing address, optionally a VAT identification number, and payment details; Stripe stores the name and address on your customer account for the invoice. If you reached the pricing page through a campaign link with a source, we also pass Stripe the source group from section 15 (for example "x"), otherwise "unknown". We store the association with your Stripe customer account, subscription status, expiry date and a record of your consent when ordering (time and version of the texts you agreed to). With the contract we also store the email address you entered when paying, so that the acknowledgement of receipt for a cancellation or withdrawal you declare from that address without signing in is sent at once even at times of high volume (section 13). Card details are not stored on our servers. Legal bases: Article 6(1)(b) GDPR (concluding and performing the subscription) and Article 6(1)(c) GDPR (tax and commercial retention obligations). Further information is available in Stripe's Privacy Policy.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

12. Transactional emails (Resend)

We send transactional emails through Resend (USA). These include the contract confirmation after a Plus purchase with the terms and the cancellation policy, confirmations of cancellations, acknowledgements of receipt for cancellation and withdrawal notices, and the emails of the Plus waitlist (section 14). For this, Resend processes your email address, the content of the message and technical delivery data. Legal bases: Article 6(1)(b) GDPR and Article 6(1)(c) GDPR (statutory obligations to confirm contracts, cancellations and withdrawals), and Article 6(1)(a) GDPR for the waitlist. We do not send a newsletter or other advertising emails; the waitlist only sends the confirmation email and one email when Plus launches to addresses that signed up for it.

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

13. Cancellation and withdrawal on the website

Via Cancel contracts here and Withdraw from contract, you can declare cancellations and withdrawals without signing in. We process the information from the form (for example name, email address, the contract concerned, the type of cancellation, reason and requested date, where you provide them) and the date and time of receipt. We store the declaration (section 7), match it to your subscription where possible and send you an acknowledgement of receipt (section 12); if the declaration comes from the email address you entered when paying, this acknowledgement goes out at once even at times of high volume (section 11). A request limit applies to prevent abuse (section 8). Legal basis: Article 6(1)(c) GDPR (statutory obligation to accept and confirm cancellations and withdrawals).

14. Plus waitlist (Neon, Resend)

While Plus cannot be booked, you can sign up on the waitlist, on the pricing page or on the home page. We will then write to you once, when Plus can be booked. For this, we process your email address, the chosen language, the date and time of your signup and of your confirmation, and the version of the consent text. If you came through a campaign link, we also store its source from a fixed list (for example "x" or "reddit"). The entries are kept in our database (section 7); we send the emails through Resend (section 12).

We use a double opt-in procedure: after signing up, you receive an email with a confirmation link that is valid for seven days; if the daily limit for confirmation emails from your network range has been reached (see below), your signup stays stored and the confirmation email follows later. You only get the launch email once you confirm on the linked page. Before sending, we check with a DNS lookup whether the domain of your address accepts email; if it does not, we delete the signup. To prevent abuse, we limit form submissions per connection (briefly in our server's memory). Per network range (for IPv4 the first three blocks of the address, for IPv6 the first 48 bits), we keep two daily counters in our database, each only under a keyed hash of the network range, never with the IP address itself: one for new signups, beyond whose limit we store no further signup that day, and one for confirmation emails. We send at most two confirmation emails per mailbox and day; for this, we count them under a hash of the address without any "+" suffix.

The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, using the unsubscribe link in every waitlist email or by email to support@prisma-ltd.de. When you unsubscribe, we delete your address immediately; every unsubscribe link we sent you stays valid for this. Otherwise we delete it at the latest 30 days after the launch email. Unconfirmed signups are deleted at the latest 30 days after the signup.

15. Reach measurement without cookies (Upstash, Vercel Web Analytics)

On our server, we count how often the home page, the pricing page, the 14-day challenge page and the sign-up page are opened and roughly where the visits come from. For this, we increase one counter per day, page and source group. The source group comes from a campaign parameter in the link or from the domain of the referring page and is one of a few fixed groups, for example "x", "search" (search engine), "internal" (one of our pages) or "direct" (no referrer). To leave out automated requests and prefetches, we check the browser identifier (user agent) and a few technical headers of the request; the counter does not evaluate the IP address. None of this is stored. Only the daily counters are stored, in Upstash Redis (section 8): without cookies, without browser storage, without an identifier and without a profile. Individual visits can neither be recognised from them nor linked to a person. We delete the counters automatically after 400 days. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the overall reach of our service).

In the same way, we count per day how many people sign up, complete their entry (placement test or starting at zero) and their first lesson, come across Plus content as signed-in Free users, start a payment and complete it; the two payment steps also by source group. So that each person counts only once per step and day, we store a marker in Upstash for at most 25 hours whose name is computed from the day, the step and your user identifier with a secret key; the user identifier itself is not stored there. From the stored learning progress (section 7), we also evaluate in aggregate how many learners come back one and seven days after they started; this creates no new storage. Legal basis: Article 6(1)(f) GDPR (legitimate interest in improving the service based on aggregated figures).

In addition, we use Vercel Web Analytics from Vercel Inc. (USA, section 3) to see which pages are opened and how often. When a page loads, your browser loads a script from our own domain and reports the page opened, the referring page, time, country, browser, operating system and device type. Vercel Web Analytics does not set cookies. To count visits, Vercel computes a hash from the incoming request that expires after one day; no persistent identifier and no cross-site profile is created. We only see aggregated figures. Vercel stores the data according to its retention periods. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the overall use of our pages). Transfer to the USA: as described in section 3.

16. Contact by email

If you email us, we process your email address, your name if you provide it, and the content of your message in order to handle your request. Legal basis: Article 6(1)(b) GDPR where your request concerns a contract, otherwise Article 6(1)(f) GDPR (legitimate interest in answering enquiries).

17. Backups (GitHub, if enabled)

If enabled, we create a weekly backup of our database with GitHub Actions of GitHub, Inc. (USA). The copy is created on a GitHub server, encrypted immediately and stored at GitHub only in encrypted form. We keep the decryption key outside GitHub. Legal basis: Article 6(1)(f) GDPR (legitimate interest in protection against data loss).

Transfer to the USA: based on the EU-US Data Privacy Framework where the provider is certified, otherwise standard contractual clauses under Article 46(2)(c) GDPR.

18. Cookies and browser storage

We store information in your browser or read it only to the extent strictly necessary to provide the service you have expressly requested (section 25(2) no. 2 TDDDG). We use the following storage:

The services embedded in sign-in, Clerk (section 4) and Cloudflare Turnstile (section 5), may additionally set their own technically necessary cookies or browser storage, for example for session security and bot protection. These providers determine their type and duration; details are in their privacy notices.

You can delete this data through your browser's website data settings. Deleting local browser data does not delete exercise attempts already sent to the server. You can request their deletion using the contact in section 1.

We do not use analytics or marketing cookies. The reach measurement (section 15) works without cookies and without browser storage. The separately opened Stripe Checkout and customer portal are additionally subject to the cookie and privacy notices provided there.

19. Retention periods

• Account and learning progress: until you request deletion. You can request deletion by email to support@prisma-ltd.de.
• Billing and contract records (invoices, accounting records, contract confirmations, consent records, cancellation and withdrawal notices): for as long as statutory retention obligations apply (section 147 AO, section 257 HGB), at most ten years.
• Abuse-prevention counters: they expire automatically when the respective time window ends.
• Plus waitlist: until you unsubscribe, then deleted immediately, at the latest 30 days after the launch email. Unconfirmed signups: at the latest 30 days after the signup. Daily counters of confirmation emails per mailbox and of signups and confirmation emails per network range: at the latest 30 days.
• Daily counters of the reach measurement and the funnel: 400 days; they contain no personal data. Markers against double counting: at most 25 hours.
• Server logs and service provider logs: according to the retention periods of the respective provider (Vercel, Clerk, Cloudflare, Stripe, Resend).
• Tutor questions: we do not store a chat history; for processing by the provider, see section 10.
• Backups: encrypted backups are deleted automatically after 14 days. Copies of the database at Neon that we create before the launch or before changes to the database structure, or that arise when a backup is restored, are deleted at the latest 14 days later. In addition, Neon can reset our database to an earlier point in time within the restore window of our Neon plan; until that window ends, deleted data is still present there. If we restore a backup, we delete the previously deleted data again.
• Browser storage: see the durations in section 18.

20. Your rights

You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future (Article 7(3) GDPR). To do so, contact support@prisma-ltd.de. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).

21. Age limit

You may use AI Steps from the age of 16; a Plus subscription can only be concluded by adults or by minors with the consent of their legal representatives (see the Terms and Conditions). The age limit is a rule of our Terms and Conditions. The processing of your data is based on the legal bases stated in the individual sections.

22. Changes

This policy may be updated when the service changes. The version published on this page applies.