Skip to main content

Privacy Policy

Privacy Policy

Last updated: June 2026

Responsible Party

Thinkable Education Technologies Lucia Happe, Kai Marquardt, Jens Happe GbR
Alter Schlachthof 19
76131 Karlsruhe
Germany

Email: education@thinkable.space

Overview

We process personal data only to the extent necessary to provide our educational platform, and in accordance with the General Data Protection Regulation (GDPR). This policy explains what data we collect, for what purpose, and on what legal basis.

Data We Process and Purposes

  • Account and login data: We use the service Clerk for registration and sign-in. This processes data such as your name, email address and login information in order to provide your user account (Art. 6(1)(b) GDPR). See the Clerk Privacy Policy for more information.
  • Payment data: Payment is handled by our reseller Paddle (see below). We do not store full payment details such as card numbers ourselves.
  • Learning progress: To show your progress through the expeditions, we store which lessons have been completed (Art. 6(1)(b) GDPR).
  • Technical data and server logs: When you access the website, technical data such as IP address, browser type, operating system and access time are processed to ensure operation and security (Art. 6(1)(f) GDPR).
  • Communication data: We process content you send us by email or through our contact form in order to handle your request (Art. 6(1)(b) or (f) GDPR). The contact form collects your name, your email address and your message. To protect against automated abuse we additionally store a keyed hash of your IP address; the IP address itself is not stored, and the hash serves only to limit how many messages one sender can submit per hour (Art. 6(1)(f) GDPR).

Payment Processing by Paddle

Order and payment processing is handled by Paddle.com, which acts as the Merchant of Record and as an independent data controller. To process the purchase, prevent fraud and meet tax and legal obligations, we share the data required for this (such as name, email address and billing country) with Paddle. Paddle may transfer data to third countries and bases such transfers on appropriate safeguards such as EU Standard Contractual Clauses. For details, see Paddle's privacy policy.

Service Providers and Recipients

We share personal data with carefully selected service providers. The hosting and authentication services listed below act as processors on our behalf and on our instructions (Art. 28 GDPR); Paddle acts as an independent controller (see "Payment Processing by Paddle"). Data is transmitted in encrypted form via SSL/TLS. Where data is transferred to third countries (such as the USA), we base such transfers on appropriate safeguards such as EU Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework.

  • Clerk (authentication, processor): name, email address and session data; located in the USA. Clerk Privacy Policy
  • Vercel (hosting and Web Vitals, processor): technical connection and request data; located in the USA. Vercel Privacy Policy
  • Neon (database hosting, processor): account and progress data created in the platform; located in the USA/EU. Neon Privacy Policy
  • Paddle (payment processing, Merchant of Record, independent controller): name, email address and billing country; located in the United Kingdom/EU and third countries. Paddle Privacy Policy
  • Google Analytics (audience measurement, processor, only with your consent): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; transfer to Google LLC in the USA possible. Google Privacy Policy

Performance Measurement (Web Vitals)

To measure and improve the loading speed of our website, we use Vercel Speed Insights. This collects performance metrics (so-called Core Web Vitals such as load times). Speed Insights sets no cookies, does not create user profiles, and evaluates the collected data only in aggregated, anonymised form. The legal basis is our legitimate interest in a fast and stable website (Art. 6(1)(f) GDPR). For more information, see the Vercel Privacy Policy.

Audience Measurement with Google Analytics (consent only)

On our public information pages we use Google Analytics 4 to understand which content actually helps parents and children, and where our pages are unclear.

Google Analytics is loaded only after your explicit consent. Until you agree, no script is loaded from Google, no connection to Google is made, and no cookie is set. The legal basis for storing and reading information on your device is § 25(1) TDDDG, and for the subsequent processing Art. 6(1)(a) GDPR (consent).

We collect the page visited, the time and duration of the visit, an approximate region of origin, the referring website, and technical details about browser and device. Google Analytics 4 truncates IP addresses before storing them; no full IP address is recorded. We do not link this data to your account and do not use it for advertising.

Where we measure: public pages only (home, expedition overview, curriculum, story, blog, articles, research, thinking challenges and checkout). No measurement takes place in the protected learning areas: on the pages where children work with the learning content, Google Analytics is not loaded. We also do not measure on the legal pages or the contact form.

Third-country transfer: the provider is Google Ireland Limited. A transfer to Google LLC in the USA cannot be excluded. It is based on EU Standard Contractual Clauses and Google's certification under the EU-US Data Privacy Framework. Despite these safeguards, access by US authorities cannot be entirely ruled out; your consent expressly extends to this (Art. 49(1)(a) GDPR).

Withdrawal: you can withdraw your consent at any time with effect for the future using the "Privacy settings" link in the footer. Withdrawing is as easy as giving consent and does not affect the lawfulness of processing carried out beforehand.

Cookies

Without your consent we use only technically necessary cookies that are essential for operating the platform. No consent under § 25(2) no. 2 TDDDG is required for these, as they are strictly necessary for the services you have expressly requested. We do not use advertising or marketing cookies.

  • Sign-in and session cookies (Clerk): keep you logged in after sign-in and secure your session; required for protected areas.
  • NEXT_LOCALE: stores your language choice (German or English); lifetime around one year.
  • Your privacy decision: your answer to the consent prompt is stored locally in your browser (local storage, not a cookie, never transmitted to us) so we do not ask again on every page. It is discarded after one year and the question is asked again.

Only if you have consented, these are added:

  • _ga and _ga_* (Google Analytics): distinguish visitors in order to group individual page views into one visit; lifetime up to two years. They are set only after your agreement.

Data Retention and Deletion

We store personal data only for as long as necessary for the stated purposes or as required by statutory retention obligations:

  • Account and login data: for the duration of your user account; after account deletion it is removed promptly (generally within 30 days), unless statutory retention obligations apply.
  • Learning progress: for the duration of your user account; it is removed when the account is deleted.
  • Payment and invoicing data: processed as part of the handling by Paddle. Tax- and commercial-law-relevant records are retained for the statutory periods (generally 6 to 10 years under § 257 HGB and § 147 AO).
  • Technical data and server logs: generally deleted or anonymised within a few weeks.
  • Communication data: deleted once your enquiry has been fully handled, unless statutory retention obligations apply.

Children's Data

Our service is aimed at children and young adults aged 10 and over. For users under the age of 16, the consent of a parent or legal guardian is required (Art. 8 GDPR). The paid account and payment are set up by an adult. We only process the data from children that is necessary for the learning service, and we explain how data is used in simple, easy-to-understand language. Up to three learner profiles for children can be created inside the parent account; we store only a freely chosen display name for each, together with that profile's learning progress. Children do not get their own account or their own login credentials. Learner profiles can be deleted at any time from the parent account, which also removes the associated learning progress. Parents and guardians may request access to their child's data, request its deletion, and withdraw a given consent at any time.

Automated Decision-Making

We do not carry out decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

Data Breaches

In the event of a personal data breach, we notify the competent supervisory authority without undue delay and, where there is a high risk to your rights and freedoms, also the affected individuals without undue delay (Art. 33 and 34 GDPR).

Privacy Contact

For privacy enquiries, you can reach us at education@thinkable.space.

We have not appointed a Data Protection Officer.