Privacy Policy

EuraStudy is a free, non-commercial learning project that is currently in an open beta phase. There is no company behind it, and the service is not operated with the intention of making a profit.

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is the private individual who operates this project. As EuraStudy is in its beta phase, contact is possible exclusively by email:

Email: eurastudy@gmail.com

Protecting your data is of particular importance to us. We therefore process your data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR). In this Privacy Policy, we inform you about the most important aspects of data processing in connection with our website and our learning platform.

3.1Access Data / Server Log Files

Each time our website is accessed, information that your browser transmits to our server is recorded automatically. This information is stored temporarily in a so-called log file and comprises:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Website from which access takes place (referrer URL)
• Browser used and, where applicable, the operating system of your device
• Name of your internet access provider

Processing takes place pursuant to Art. 6(1)(f) GDPR in order to safeguard our legitimate interests in improving the stability and functionality of our website. The data is not disclosed to third parties or used for other purposes. We do, however, reserve the right to subsequently review the server log files should there be specific indications of unlawful use.

3.2Registration and User Account

Registration is required in order to use certain features of our platform. The data collected in the process serves to provide our services and comprises:

• First and last name
• Email address
• Password (stored encrypted)
• School (optional)
• Grade level (optional)

This data is processed on the basis of Art. 6(1)(b) GDPR for the performance of the user agreement and for taking pre-contractual steps.

3.3Learning Progress and Usage Behaviour

In order to be able to offer you personalised learning content, we record the following while you use our platform:

• Learning materials and exercises completed
• Learning progress and test results
• Frequency and duration of use of certain features
• Individual settings and preferences

This data is processed on the basis of Art. 6(1)(b) GDPR for the performance of the user agreement. The data is used to provide you with a personalised learning environment and to improve your learning experience.

3.4Cookies and Similar Technologies

We use cookies only to the extent technically necessary for the operation of the platform. Cookies are small text files that are stored on your device.

• Technically necessary cookies: These are required for basic functionality, in particular to keep you signed in (login and session management).
• Functional cookies: es-gate-onboarded remembers that your account setup is complete so pages open without a loading gate (12 months); a locale cookie remembers your interface language; es-consent stores your choice from the cookie notice (12 months). Reading preferences and progress live in your browser's local storage and are not used for tracking.

We do not use advertising, marketing or cross-device tracking cookies. The processing of technically necessary and functional cookies takes place pursuant to Art. 6(1)(b) GDPR in order to provide the service you have requested. Product usage analytics (see section 3.5) runs only with your consent, which you can give or decline in the cookie notice.

You can configure your browser so that it informs you when cookies are being set and allows cookies only in individual cases, excludes the acceptance of cookies for certain cases or in general, and activates the automatic deletion of cookies when the browser is closed. Disabling cookies may limit the functionality of this website.

3.5Analytics (Vercel Analytics)

To improve our service, we use Vercel Analytics, a privacy-friendly analytics service provided by our hosting provider Vercel Inc. (USA). Vercel Analytics works without cookies and without persistent identifiers. No cross-device profiles are created, and no data is disclosed or sold to advertising networks.

Only aggregated, largely anonymised usage data is recorded, such as pages visited, approximate region of origin, device type and the referring page (referrer). The identification of individual persons is not intended.

Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in a data-minimising analysis of website usage in order to improve our free service.

In addition, and only if you consent via the cookie notice, we collect first-party product usage events (pages opened, features used) together with a temporary session identifier stored in your browser for the duration of the tab session (sessionStorage). This data stays with us, is not shared with third parties, and is processed pursuant to Art. 6(1)(a) GDPR. If you choose “only necessary”, no usage events are collected and no identifier is stored. You can revisit your choice at any time by deleting the es-consent cookie in your browser settings.

3.6Public YouTube Search, Thumbnails and Player

Public YouTube search and playback work without connecting a YouTube account. When you submit a search, EuraStudy sends the search phrase and selected interface locale from our server to YouTube Data API Services. Google receives the requested search data and EuraStudy's API-project and server network data, but not your browser IP address from that server-side API request. Search responses may be cached by EuraStudy for up to 24 hours to reduce repeat API requests and are not attached to a connected YouTube account. Please do not enter unnecessary personal or sensitive information into the search field.

After a search, your browser loads result thumbnails directly from YouTube/Google image hosts such as i.ytimg.com and yt3.ggpht.com. When you choose a video, your browser loads the privacy-enhanced embedded player directly fromyoutube-nocookie.com. These direct connections disclose network and usage data to Google, including your IP address, browser and device information, referrer/origin, request time, the requested thumbnail or video, and player interactions. Google may also read or store technical identifiers in accordance with its own policy. This happens whether or not you connect a YouTube account; the player is not loaded until you actively choose a video.

YouTube is a service provided by Google LLC. For users in the European Economic Area and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is generally the Google entity responsible for processing under Google's privacy terms. EuraStudy processes the search request and initiates the selected playback pursuant to Art. 6(1)(b) GDPR in order to provide the feature you requested. Before use, the Music Room states that use of YouTube features means agreement to this Privacy Policy and the YouTube Terms of Service. Google's own processing is described in the Google Privacy Policy. If you do not agree, do not use the YouTube search or player; the house music library remains available.

3.7Optional YouTube Connection

You can voluntarily connect your YouTube account to the music listening room. EuraStudy then uses YouTube API Services with read-only permission to display your channel profile, subscriptions, playlists and playlist videos, and videos you have liked. EuraStudy cannot publish, edit, like or delete content on your behalf.

The Google access and refresh credentials needed for the connection are stored encrypted at rest. The selected channel identifier and name are stored with the connection; library pages are requested from YouTube when opened and may be cached only for the current browser-tab session, separated by channel. They are not copied into an EuraStudy media library. Stored YouTube API data is refreshed or deleted within 30 days, and is deleted earlier if authorization can no longer be verified. You can disconnect at any time in the listening room; EuraStudy then attempts to revoke the Google grant and deletes the stored connection credentials and cached library data. You can also revoke access in your Google Account permissions. Processing is based on your consent under Art. 6(1)(a) GDPR.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Your use of the integration is also subject to the YouTube Terms of Service and the Google Privacy Policy.

As a matter of principle, your personal data is not transferred to third parties, unless:

• You have given your express consent to do so (Art. 6(1)(a) GDPR)
• The disclosure is necessary for the performance of the contract with you (Art. 6(1)(b) GDPR)
• There is a legal obligation to disclose the data (Art. 6(1)(c) GDPR)
• The disclosure is necessary to safeguard legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in not having your data disclosed (Art. 6(1)(f) GDPR)

4.1Service Providers, Processors and Independent Providers

To operate this free platform, we use a number of technical providers. Some process personal data on our behalf; others, including Google for its own YouTube services, process data under their own responsibility and privacy terms:

• Hosting and delivery of the website: Vercel Inc. (USA)
• Database, sign-in and file storage: Supabase (database, authentication and storage service)
• AI-assisted learning and grading features: AI services such as DeepSeek and Google Gemini, to which the content necessary to respond to your input (e.g. your question or an answer submitted for assessment) is transmitted.
• YouTube features: YouTube API Services, thumbnail hosts and the embedded player provided by Google. Public search, thumbnails and playback are contacted when you actively use those features; private library data is requested only after you separately connect an account and grant read-only access.

We do not use any payment service providers, as EuraStudy is entirely free and no payments are charged. Where necessary, we conclude agreements with processors pursuant to Art. 28 GDPR in order to ensure that your data is processed in compliance with the law.

Some of the providers listed under section 4.1 — in particular our hosting provider, the AI services used and Google/YouTube when you use a YouTube feature — may process personal data in countries outside the European Union or the European Economic Area (so-called third countries). When data is processed in a third country, the applicable provider safeguards and transfer mechanisms are described in its privacy information.

For data transfers to the USA, we rely on the EU Standard Contractual Clauses and additional safeguards in order to guarantee an adequate level of data protection.

We store personal data only for as long as is necessary for the purposes for which it is processed, or for as long as statutory retention periods apply:

• User account data: for as long as your account exists and beyond that for the duration of statutory retention periods
• Learning progress: for as long as your account exists
• Public YouTube search responses: up to 24 hours in EuraStudy's server cache; Google determines its own retention for data it receives under the Google Privacy Policy
• YouTube connection credentials: until you disconnect YouTube, revoke access, delete your EuraStudy account, or authorization can no longer be verified; stored API metadata is refreshed or deleted within 30 days
• Server log files: 14 days
• Communication data: 3 years after the last contact

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15 GDPR): You have the right to obtain information about the personal data we have stored about you.
• Right to rectification (Art. 16 GDPR): You have the right to request the rectification of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): You have the right to request the erasure of the personal data we have stored about you, unless processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transfer to another controller.
• Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, insofar as the processing is based on legitimate interests.
• Right to withdraw consent (Art. 7(3) GDPR): You have the right to withdraw consent you have given at any time with effect for the future.

To exercise your rights, you can contact us at any time using the contact details above. Please note that we must identify you before we can act on your request.

If you are of the opinion that the processing of your personal data infringes the GDPR, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The competent authority is in particular the supervisory authority of the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

We take technical and organisational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

The measures we have taken include, among others:

• Encryption of data transmission (HTTPS/TLS)
• Encryption at rest for stored YouTube connection credentials
• Password hashing and secure password policies
• Regular security updates of the systems used
• Access restrictions and access controls
• Regular backups to prevent data loss

This Privacy Policy is currently valid and is dated 18 July 2026. Due to changes in legal or regulatory requirements or the further development of our service, it may become necessary to amend this Privacy Policy. The respective current version of the Privacy Policy can be accessed on this website at any time.