Privacy Policy

1. Controller

The controller responsible for processing your personal data pursuant to Art. 4(7) GDPR is:

WebUp GbR
Aaron Vermeulen
Auf der Höhe 3a, 78576 Emmingen-Liptingen, Germany
Email: contact@schedlr.de

2. Data We Collect and Why

2.1 Account Data

When you register, we collect your email address and a password (stored in hashed form only — we never see your plaintext password). This data is required to create and manage your account.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.2 User Profile Data

During onboarding you provide optional profile data such as your target exam date, preferred study schedule, and module priorities. This data is used exclusively to generate and personalise your study plan.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.3 Training & Performance Data

When you use the app, we record your module results, scores, and session timestamps. This data powers your analytics dashboard and readiness score, and is stored only in your account.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.4 Payment Data

SCHEDLR does not collect or store payment information itself. When you purchase a Pass you are redirected to Stripe, who processes the payment. We only receive a confirmation of successful payment and your Stripe customer reference. See Section 4.3 for details on Stripe.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

2.5 Contact Messages

When you use our contact form, we process your email address, subject, and message so that we can answer your request. Cloudflare Turnstile also processes technical connection and browser data to protect the form from automated abuse.
Legal basis: Art. 6(1)(b) GDPR for contract-related enquiries and Art. 6(1)(f) GDPR for abuse prevention.

2.6 Server & Access Logs

Our hosting provider (Vercel) automatically records standard server log data including IP addresses, request timestamps, pages accessed, and browser type. These logs are used exclusively for security monitoring and are retained for a maximum of 30 days.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating a secure service.

3. Cookies

SCHEDLR uses technically necessary cookies to keep you logged in during your session (authentication cookies set by Supabase). Because these are strictly necessary for the service to function, no separate consent is required for them under § 25(2) TTDSG.

With your consent, we also use analytics cookies (PostHog) to understand how the app is used, and advertising cookies (Google Ads) to measure the effectiveness of our ad campaigns. Neither is active until you opt in via the cookie banner, and you can withdraw your consent at any time — see "Cookie Settings" in the footer of any page.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG — your consent.

4. Service Providers (Data Processors)

We use the following third-party service providers who process personal data on our behalf. All processors are bound by data processing agreements (DPAs) in accordance with Art. 28 GDPR.

5. Data Retention

We retain your personal data only as long as necessary for the purpose it was collected:

• →Account & profile data: Until you delete your account, or after 24 months of inactivity.
• →Training & performance data: Until you delete your account.
• →Payment records: 10 years from the date of the transaction, pursuant to § 147 AO (German Tax Code).
• →Server logs: Maximum 30 days.

6. Your Rights under the GDPR

You have the following rights with respect to your personal data. To exercise any of them, contact us at contact@schedlr.de .

• →Right of access (Art. 15 GDPR): You may request a copy of all personal data we hold about you.
• →Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
• →Right to erasure (Art. 17 GDPR): You may request deletion of your data, subject to legal retention obligations.
• →Right to restriction (Art. 18 GDPR): You may request that we restrict processing of your data in certain circumstances.
• →Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
• →Right to object (Art. 21 GDPR): You may object to processing based on legitimate interest (Art. 6(1)(f)).
• →Right to lodge a complaint: You have the right to complain to a supervisory authority. The competent authority for Baden-Württemberg is the Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg (LfDI BW), www.baden-wuerttemberg.datenschutz.de .

7. Children's Privacy

SCHEDLR is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at contact@schedlr.de and we will delete it promptly.