Privacy policy

This policy explains what personal data CaptionLearn (captionlearn.com) processes, why, and what your rights are under the General Data Protection Regulation (GDPR).

Konstantin Duczek
Schillerstraße 21
12207 Berlin
Germany
Email: support@captionlearn.com

The site runs on Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit, Vercel processes your IP address, user agent, requested URL and timestamp to deliver the pages and protect against abuse. Logs are retained for a short period. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). Transfer to the USA is covered by the EU-US Data Privacy Framework and standard contractual clauses.

The forms for signing up, signing in, resetting your password and resending the confirmation email are protected by Vercel BotID, so that automated programs cannot create accounts or try passwords. A script served from our own domain checks technical properties of your browser to tell a person from an automated program; the result is sent only with those forms, and Vercel verifies it together with your IP address and the request headers. BotID sets no cookies and stores nothing in your browser. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting accounts and the service against automated abuse); reading these browser properties is strictly necessary for the secure sign-in you request (§ 25(2) TDDDG).

We use Vercel Web Analytics to count page views and referrers. It sets no cookies and stores no identifier in your browser; a visitor hash derived from the request is discarded after 24 hours and cannot be linked back to you. Legal basis: Art. 6(1)(f) GDPR.

CaptionLearn sets only cookies that are required to run the service (§ 25(2) TDDDG): a session cookie when you are logged in, and a cookie that remembers the interface language you chose (one year). There are no tracking or advertising cookies, so no consent banner is shown.

To use the service you create an account with an email address and password. We store the email, a password hash, your name if you enter one, verification tokens and the time of your last login. Verification and password-reset emails are sent through Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg). Legal basis: Art. 6(1)(b) GDPR (contract).

Emails about CaptionLearn. If you tick the box at sign-up or in your account, we email you occasionally about CaptionLearn: new features, video tips and a reminder when you haven't been around for a while (Art. 6(1)(a) GDPR, consent). If you buy a paid plan, we may send you such emails about CaptionLearn without that box (§ 7(3) UWG, Art. 6(1)(f) GDPR); we tell you so at checkout and in every email. You can unsubscribe or withdraw your consent at any time at no cost, with the link in every such email or in your account. For each of these emails we store when it was sent and whether a link in it was opened, and we look at whether you used CaptionLearn afterwards, to see whether the emails are useful (Art. 6(1)(f) GDPR). They contain no tracking pixels.

When you watch a video we store its YouTube ID and the time you watched it (history), the words you save together with the sentence, timestamp and meaning (vocabulary), and which words you looked up in which sentence, so they stay free to open again. The translations themselves are cached per video and sentence, not per user. This is the core of the service. Legal basis: Art. 6(1)(b) GDPR.

Account and learning data are stored in a Postgres database at Neon (Neon Inc., USA) and usage counters (rate limits, monthly lookup quota) in Upstash Redis (Upstash Inc., USA). Both databases are located in Frankfurt, Germany (AWS eu-central-1); both providers act as processors under a data processing agreement with standard contractual clauses. To limit repeated sign-up, sign-in and password-reset attempts, the rate-limit counters there contain your IP address; they are deleted after one hour at the latest.

Videos play in YouTube's embedded player (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When a video loads, YouTube receives your IP address and may set its own cookies and link the view to your Google account if you are signed in. We have no control over this processing; see Google's privacy policy. Subtitles are fetched by our server, not by your browser, and cached per video without any reference to you. Legal basis: Art. 6(1)(b) GDPR, since playing the video is the service you requested.

When you tap a word, the word and its surrounding sentence are sent to DeepL SE (Maarweg 165, 50825 Cologne, Germany) for translation. No account data is transmitted; DeepL does not store the text under its API terms. Legal basis: Art. 6(1)(b) GDPR.

Paid plans are billed through Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). Mollie processes the payment details you enter; we receive only a customer ID, subscription ID, payment status and the payment method type. Mollie is an independent controller for the payment itself; see Mollie's privacy policy. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR (tax record keeping, 10 years under § 147 AO).

Account and learning data are kept for as long as your account exists and are deleted when you delete the account. Cached transcripts and translations contain no personal data and are kept indefinitely. Payment records are kept for the statutory 10 years. Server logs are deleted after a short period by the hosting provider.

You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability (Art. 15 to 21 GDPR). You can delete your account and all learning data yourself at any time from the account page. For any other request, email support@captionlearn.com. You may lodge a complaint with a data protection supervisory authority, for example the one in your federal state.

We will update this policy when the service or the processors change. The date at the top shows the current version.