Privacy policy
Last updated:
1. Controller
Zyloft, Musterstraße 1, 10115 Berlin, Germany. Email: hello-devventura@zyloft.eu.
2. Data we process
Visiting the website. Our hosting provider processes technical data (IP address, time, requested page, browser) to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Server logs are deleted after [X] days.
Analytics. If enabled, we use a cookieless analytics service ([Plausible / Umami]) that counts page views without cookies or persistent identifiers. No personal profile is created (Art. 6(1)(f) GDPR).
Your account. When you sign up we store your name, email address, a hashed password (if you set one) and your language preference to provide the service (Art. 6(1)(b) GDPR). If you sign in with Google, we receive your name, email address and profile picture from Google.
Your learning progress. To provide the courses we store which projects you started and when (this also determines the 7-day free trial), your chosen programming language, which milestones and stretch tickets you marked as done, and the design notes you write, including when you submitted them (Art. 6(1)(b) GDPR). Design notes are only visible to you. Your code stays on your own computer; we never receive it.
Payments. Plans are sold through Polar Software, Inc. ("Polar", polar.sh), which acts as our reseller and merchant of record. When you buy a plan, you buy it from Polar: Polar collects your payment and billing details, calculates and pays VAT, issues invoices and processes them under its own privacy policy as an independent controller. We never receive your card details. From Polar we receive your Polar customer ID, the plan you bought and its status (active, cancelled, renewal date), which we need to give you access (Art. 6(1)(b) GDPR). [Check this description against your agreement with Polar.]
Emails. Transactional emails (sign-in links, receipts, account notices) are sent via [Resend]. They are necessary to provide the service (Art. 6(1)(b) GDPR).
3. Cookies and local storage
We use one strictly necessary cookie to keep you signed in (§ 25(2) TDDDG). If you change the colour theme, your choice is stored in your browser's local storage. We do not use tracking or advertising cookies.
4. Processors and transfers
We use the following processors: [hosting provider], [database provider], [Resend] and, if enabled, [analytics provider]. Polar handles payments as an independent controller (see above). Where data is transferred outside the EU/EEA, this is based on an adequacy decision or standard contractual clauses.
5. Retention
We keep your account data while your account exists. When you delete your account, we delete your personal data unless we are legally required to keep it (for example invoices for 10 years).
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). You can download your data and delete your account in the account settings. You also have the right to lodge a complaint with a supervisory authority.