Privacy policy

1. Data controller

TK100X GmbH
Julius-Hansel-Straße 22/4, 8052 Graz, Austria
Email: [email protected]

2. Information we collect

• Account information: Email address and authentication data when you create an account or purchase a course.
• Payment information: Payment details are processed by Stripe. We do not store your credit card number. We receive your email, transaction ID, and purchase amount.
• Usage data: Information about how you interact with our services, including learning progress, course completion status, and app preferences.
• User-generated content: Content you create (e.g., drawings in Draw Buddy, roleplay inputs in Skillbase) to provide the service.
• Technical data: IP address, browser type, device information, and access times for security and analytics purposes.

3. How we use your data

We use your information to:

• Provide, maintain, and improve our services and courses.
• Process payments and deliver purchased course access.
• Send transactional emails (purchase confirmations, login codes, account notifications).
• Personalize your experience (e.g., adapting difficulty levels, tracking course progress).
• Communicate with you about updates, security, and support.
• Analyze usage trends to build better products.

Legal basis: Contract performance (Art. 6(1)(b) GDPR) for purchase-related processing, legitimate interests (Art. 6(1)(f) GDPR) for analytics and service improvement, and consent where required.

4. Third-party services

We work with trusted partners to deliver our services:

• Stripe (USA): Payment processing for course purchases. Privacy policy
• Resend (USA): Transactional email delivery (login codes, purchase confirmations). Privacy policy
• Cloudflare (USA): Hosting, CDN, and security services. Privacy policy
• Google Analytics: Website and course analytics. Privacy policy
• Firebase (Google): Authentication and database services for mobile apps.
• OpenAI (USA): Powers AI features in Skillbase and other apps.
• RevenueCat: Subscription management for mobile apps.
• AppsFlyer: Attribution and analytics for mobile apps.

Where data is transferred to the USA, appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

5. Data retention

We retain your account and purchase data for as long as your account is active or as needed to provide you with services. Transaction records are retained as required by Austrian tax law (7 years). You may request deletion of your account at any time, subject to legal retention requirements.

6. Data security

We implement industry-standard security measures including encryption in transit (TLS) and at rest. Authentication uses time-limited one-time codes sent via email. We never sell your personal data to third-party data brokers.

7. Your rights

Under the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your data ("right to be forgotten")
• Restrict processing of your data
• Data portability — receive your data in a structured format
• Object to processing based on legitimate interests
• Lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at)

You can exercise these rights by contacting us at [email protected] or using the deletion tools provided within our apps.

8. Cookies

Our websites use essential cookies for authentication and session management. We use Google Analytics for usage analysis. You can control cookie settings in your browser.

9. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on our website.

10. Contact us

For privacy-related questions, please contact us at [email protected].