BlaueZebraBlaueZebra

Privacy policy

1. Controller

The controller responsible for processing personal data on this website is:

Mehr Gruppe s. r. o.
Hollého 1703/53
083 01 Sabinov
Slovak Republic

Email: hello@blauezebra.com
Phone: +49 151 28042775

2. The key points

  • You can use the course, the worksheets (PDF) and all other content without creating an account and without giving us your email address. Only the technical connection data needed to deliver the website is processed (see Section 3).
  • We count visits with Cloudflare Web Analytics, which sets no cookies and stores nothing in your browser (see Section 3). We do not use advertising services or Google Analytics, and no tracking cookies.
  • A free account is optional. It saves your learning progress so that you can continue on all your devices. Without an account, no learning progress is stored in your browser.
  • Videos and social networks are only linked, not embedded.

3. Hosting and delivery of the website (Cloudflare)

This website is delivered via Cloudflare: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Whenever a page is requested, Cloudflare processes technically necessary data, in particular the IP address, date and time, the requested address, the referrer URL, browser and operating system (user agent) and the status of the request.

The purpose is to deliver the website securely, reliably and quickly, including protection against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service. To protect against attacks, Cloudflare may set technically necessary security cookies (for example “__cf_bm” or “cf_clearance”). Where this involves access to your device, it is strictly necessary to provide the website you requested (Section 109(8) of Slovak Act No. 452/2021 Coll. and, where applicable, Section 25(2) no. 2 TDDDG).

For the account functions (addresses under /api/), our program at Cloudflare logs the requests in order to detect errors. These logs may contain the IP address and browser data and are deleted automatically after 7 days. This 7-day period applies to our own request logs, not to all data processed by Cloudflare; how long Cloudflare keeps other data is described in its privacy policy. Our own error entries contain no email addresses. If something fails, we receive an automatic email notification that only names the type of error.

Cloudflare processes the data on our behalf under a data processing agreement. Transfers to Cloudflare in the USA rely on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, under which Cloudflare is certified; for transfers not covered by an adequacy decision, the standard contractual clauses incorporated into Cloudflare’s data processing agreement apply. You can request a copy of the applicable transfer safeguards by emailing hello@blauezebra.com. More information: https://www.cloudflare.com/privacypolicy/

Visitor statistics (Cloudflare Web Analytics): to see which pages are used and how quickly they load, each page loads a small script from Cloudflare (static.cloudflareinsights.com). It sends the address of the page (without parameters), the page you came from, your browser, operating system and type of device, and technical loading times to our own domain; Cloudflare derives the country from the connection. The script sets no cookies and does not store or read anything in your browser’s storage. Cloudflare uses the IP address only to deliver this data and discards it at the nearest Cloudflare data center; it is not stored. We only see aggregated statistics, not individual visitors, and we do not combine them with your account. Cloudflare keeps the detailed data for 7 days and then only aggregated data, which we can view for up to six months. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to improve the website and keep it fast. You can object at any time (Section 12) or block the script in your browser.

4. Storage in your browser

Storage of and access to information in your browser is governed by Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications and, where applicable, Section 25 TDDDG. We only store what is needed for a function you have expressly asked for; storing your sign-in beyond the current browser session happens only after your active choice:

  • Display: if you switch dark mode off or on in the menu, we store this choice in your browser’s local storage (“bz.theme”) so that the page keeps your choice. It contains no account identifier and no learning data, is not sent to us and remains until you delete the website’s stored data in your browser.
  • Sign-in: only when you sign in to your account do we set cookies: “bz_at” (access key, valid for at most 1 hour), “bz_rt” (keeps you signed in) and “bz_in” (only the note “signed in”). “bz_in” lets the page show the account menu and contact the account service only when you are signed in; it does not give access to your account – the server checks your session for every account request. Scripts on the page cannot read “bz_at” and “bz_rt” (HttpOnly). By default, “bz_rt” and “bz_in” are kept only until you close the browser. Only if you actively tick “Keep me signed in on this device” (not ticked by default) are they kept between browser sessions until you sign out – for at most 400 days after each use, renewed when used; this is based on your consent, which you can withdraw at any time by signing out. All sign-in cookies are deleted when you sign out.

Necessary storage for a function you requested is exempt from consent (Section 109(8) of Act No. 452/2021 Coll.; where applicable, Section 25(2) no. 2 TDDDG); keeping you signed in between browser sessions is based on your consent (Section 109(8); where applicable, Section 25(1) TDDDG). You can delete stored data at any time in your browser settings.

5. Free user account (Supabase)

The account is optional and intended for people aged 16 or over; we do not offer account registration to younger children (Art. 8 GDPR, Section 15 of Slovak Act No. 18/2018 Coll.). The course content remains available to everyone without an account. To register, we only need your email address. You can choose to add your job (from a list, including “Other”); the account works just the same without it. The purpose of your job information is to suggest vocabulary and stories relevant to your work; we use it for no other purpose. We do not disclose your job information to employers, employment agencies or advertisers; it is processed only by us and by the service providers described in this policy to operate and back up your account.

In the account we process:

  • email address, preferred language and – if you gave it – your job,
  • your learning progress: completed scenes (with time), scenes marked as important (⭐), the last scene you opened and your own notes on scenes,
  • the time the account was created and of your last activity,
  • for sign-in and sessions, technical data such as IP address, browser identification and sign-in times.

The legal basis is Art. 6(1)(b) GDPR (providing the free account you asked for); for the optional job information it is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by choosing “Prefer not to say” for your job under “My account”; the information is then deleted from your account. After you confirm your email address, your job is kept only in your account profile, not in the sign-in system. To prevent misuse, we count how often a sign-in code is requested for an email address or from an IP address; for this we only store hashed identifiers (SHA-256 hashes of the email address or IP address, not the address itself) and a daily job deletes them once they are older than one day (Art. 6(1)(f) GDPR). If you request a code to register but never enter it, the registration (email address and, if given, your job) is deleted by a daily job once it is older than 24 hours, i.e. within two days at the latest.

The database and sign-in are operated on our behalf by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, under a data processing agreement. Our account database and authentication service are hosted in Frankfurt am Main (Germany). Supabase may process relevant data outside the EU where necessary for support and platform operations, including through Supabase, Inc. in the USA; transfers to Singapore and the USA are covered by the European Commission’s standard contractual clauses incorporated into Supabase’s data processing agreement. More information: https://supabase.com/privacy

Backup copies: so that account data is not lost after a technical fault, a backup copy of the account database (profile, learning progress, notes and sign-in data) is made once a day by a backup service provider working on our behalf. Backup copies are kept for at most 30 days and are then deleted automatically. We only use a backup to restore the database after a fault or to test that restoring works; temporary copies made for a test are deleted afterwards. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting your data against loss. Backup data may be processed in the USA; such transfers rely on the adequacy decision for the EU–U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses.

Storage period and deletion: we keep your account data until you delete the account. You can delete it yourself at any time under “My account” → “Delete my account” (for security, with a code sent by email) or ask us by email.

  • Database: your profile, learning progress, notes and sign-in data are deleted immediately. All sign-ins end immediately, including on other devices, because every request checks whether the session still exists.
  • Technical logs are not deleted one by one but expire automatically: logs of our program at Cloudflare after 7 days; at Supabase, the sign-in (authentication audit) log – IP address, browser identification, time, type of action – and the logs of database and interface requests, which may contain the IP address, are kept for a limited period set by our Supabase plan, currently at most 7 days. Writing the sign-in log to the account database is switched off.
  • Backup copies: deleted data remains in the backup copies (see above) for at most 30 days and is then deleted automatically. If we ever have to restore a backup, we delete again all accounts that were deleted after it was made, before the account functions are reopened. For this purpose only, we keep a separate deletion record for about 35 days after a deletion has been completed (a daily job removes it). For account deletions, we record only the internal account number, an operation ID, the status and the time – no email address and no learning data. In the same way, when you delete your job information or a note, we record only that it was deleted (internal account number, the type of deletion, the scene where applicable, and the time – not the content), so that a restored backup cannot bring it back; this record is removed after about 35 days. We store these records with Cloudflare R2 in its EU jurisdiction (see Section 3). The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 17 GDPR (making sure that your deletion is effective).
  • Messages you have sent us: see Section 9.

6. Sign-in emails

To register, to sign in and before deleting the account, we send you an email with a 6-digit code and, where applicable, a sign-in link. The code is only in the body of the email, not in the subject. The sender is hello@notify.blauezebra.com. The emails are sent via Cloudflare’s email service (see Section 3); your email address and the content of the message are processed for this. We have switched off the storage of message copies (email preview). Cloudflare retains email-delivery event data for 31 days; this includes the sender and recipient addresses, the subject, message identifiers, delivery times, delivery status and error information. We use these records to investigate delivery problems.

If an email cannot be delivered or a complaint is reported as spam, Cloudflare puts the address on a block list (suppression list) so that no further emails are sent to it. Temporary delivery failures normally result in suppression for 24 hours, and other eligible permanent failures for 7 days. Suppression may have no automatic expiry after a spam complaint, where a mailbox or domain does not exist, or where recipient-side failures persist. If your address is suppressed, contact us; we will review whether the suppression can be removed and involve Cloudflare support where necessary.

The legal basis for sending the code you requested is Art. 6(1)(b) GDPR; for the delivery records and the block list it is Art. 6(1)(f) GDPR – our legitimate interest is reliable delivery and not sending emails to addresses that refuse them. These emails contain no advertising.

7. Protection against automated misuse (Cloudflare Turnstile)

On the sign-up and sign-in pages we use Cloudflare Turnstile so that programs (bots) cannot trigger large numbers of sign-in emails. Turnstile is only loaded when you click “Send me a code”, i.e. when you expressly request a sign-in code; merely opening a page loads nothing from Cloudflare Turnstile. The check usually runs invisibly; a box to click only appears in doubtful cases.

Cloudflare processes technical characteristics of your connection and browser for this, in particular IP address, TLS characteristics, user agent and the website making the request. According to Cloudflare, this data is not used to identify you, to build profiles or for advertising.

For the bot check protecting our sign-in process, we rely on Art. 6(1)(f) GDPR; our legitimate interest is preventing automated misuse and unwanted sign-in emails. Access to information on your device only happens after you request a sign-in code. Cloudflare states that it separately processes the technical signals to improve Turnstile as an independent controller and relies on its own legitimate interests for that purpose; how long Cloudflare keeps this data is set out in its Turnstile Privacy Addendum, which also gives Cloudflare’s privacy contact. On transfers to the USA, see Section 3. More information: https://www.cloudflare.com/turnstile-privacy-policy/

8. Newsletter

We do not currently send a newsletter and do not offer a newsletter sign-up on this website. If this changes, we will first add the service used, the consent and any evaluation of opens or clicks to this privacy policy.

9. Contact by email or phone

If you contact us by email or phone, we process your details (for example name, email address, phone number, content and time of the message) to answer your request. Emails to hello@blauezebra.com are received by Cloudflare (see Section 2) and forwarded to the mailbox of our email service provider, where we read and answer them. The email service provider may also process the messages in the USA; such transfers rely on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, under which the provider is certified.

If an error message appears on the website, you can use “Report this problem” to open a prepared email to us. It contains the address of the page (without parameters), the text of the error message, the time and your browser type. Nothing is sent automatically; you decide in your email program whether to send the message.

The legal basis is Art. 6(1)(b) GDPR where your request concerns your account, otherwise Art. 6(1)(f) GDPR (answering requests, fixing errors). We delete the messages once they are dealt with and no statutory retention obligations apply.

10. Links to videos and social networks

Our videos on YouTube and our profiles on Instagram, TikTok, Facebook and our WhatsApp channel are only linked; nothing from these services is loaded on our website. Only when you click a link do you leave our website, and the provider concerned processes your data under its own responsibility. Please check its privacy information there.

11. Search in the course

The search in the course runs in your browser. Parts of the search index are loaded from our website for this; your search terms are not sent to us and are not stored.

12. Your rights

Within the statutory requirements, you have the following rights:

  • right of access under Art. 15 GDPR
  • right to rectification under Art. 16 GDPR
  • right to erasure under Art. 17 GDPR
  • right to restriction of processing under Art. 18 GDPR
  • right to data portability under Art. 20 GDPR
  • right to object under Art. 21 GDPR
  • right to withdraw consent under Art. 7(3) GDPR
  • right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR

Right to object: you may object at any time, on grounds relating to your particular situation, to our processing based on Art. 6(1)(f) GDPR. Contact hello@blauezebra.com.

Copy of your account data: you can request a copy of your account data (email address, the time your account was created and you last signed in, profile, learning progress and notes) in a structured, commonly used and machine-readable format (JSON) by emailing hello@blauezebra.com. This export does not limit your right of access under Art. 15 GDPR, which also covers other personal data we still process about you and the information required by that Article; the right to data portability under Art. 20 GDPR applies where its statutory conditions are met. Please use your account email address where possible; if this is not possible, contact us so that we can agree a proportionate way to verify your identity. We respond without undue delay and normally within one month; if a lawful extension is necessary, we will explain the reason within that month.

Change and delete it yourself: you can change your language and job under “My account”; there you can also delete the account and sign out on all devices.

You can withdraw consent at any time with effect for the future. The lawfulness of processing until the withdrawal is not affected.

13. Right to complain to a supervisory authority

You can complain to a data protection supervisory authority, in particular the authority of your usual place of residence, your place of work or the place of the alleged infringement. The authority responsible for the controller’s registered office is:

Úrad na ochranu osobných údajov Slovenskej republiky
Galvaniho 7/B
821 04 Bratislava
Slovak Republic

14. No obligation to provide data; no automated decisions

You do not have to create an account or give us your email address to use the course. Technical connection data is processed when you access the website (see Section 3). An email address is necessary to provide an account; job information is optional. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR); suggestions based on your job have no such effect.

15. Date and changes

Last updated: October 2026. We will update this privacy policy when our website, the services we use or the legal requirements change, and we will inform you before using your personal data for a new purpose and obtain consent where required.