Privacy policy

1. Controller

Maximilian Kammerer Stifterstraße 16 4722 Peuerbach Austria Email: hello@cuscara.com Telephone: +43 681 81162549

The controller within the meaning of the General Data Protection Regulation (GDPR) is Maximilian Kammerer.

2. Data we process

• Account data: email address, authentication status, and a technical account ID. Passwords are processed by the authentication service; Cuscara does not receive passwords in plain text.
• Learning and content data: selected universities, programmes, subjects, learning progress, points, practice and exam attempts, question reports, and learning content created or uploaded by users where those features are used.
• Technical data: IP address, browser and device information, requested pages, timestamps, and technical error or security information where processed by hosting and infrastructure providers.

3. Purposes and legal bases

Cuscara currently does not use advertising profiles, newsletters, analytics services, or retargeting services.

• Providing accounts, learning features, requested content, and authentication for contract performance under Article 6(1)(b) GDPR.
• Protecting, stabilising, troubleshooting, and preventing misuse of the service based on our legitimate interests under Article 6(1)(f) GDPR.
• Handling requests and complying with legal obligations where necessary for pre-contractual measures, contract performance, or under Article 6(1)(c) GDPR.

4. Cookies and local browser storage

Technically necessary Supabase Auth cookies are used for sign-in and the secure server-side session. The browser may also store preferences such as the colour theme, temporary drafts, and the state of an active exam locally. These local storage items support functionality and are not advertising or tracking cookies.

Optional analytics, advertising, or social-media cookies are not enabled in the current live configuration.

5. Service providers and recipients

Supabase (Supabase Pte. Ltd.) is used for authentication, the database, and private file storage. Supabase also sends the authentication emails required for registration and password recovery.

Vercel (Vercel Inc.) is used for hosting, delivery through a global network, server-side functions, and deployment infrastructure.

The current Vercel Production environments do not contain an AI provider key, payment-provider key, or analytics-provider key. If this changes, this policy will be updated before the corresponding processing begins.

6. Storage location and international transfers

The primary Supabase Development and Production projects are located in West EU (Ireland), eu-west-1. According to Supabase, the selected region determines the location of primary database, Auth, and Storage data; backups, logs, Edge Functions, and subprocessors may differ.

Vercel uses global Edge and hosting infrastructure. Depending on the service, technical data may be processed outside the European Economic Area. The providers’ current privacy information, data-processing agreements, and transfer mechanisms apply to those processes.

7. Retention and deletion

Account and learning data are generally kept for as long as the account and the relevant feature are needed. Deletion can be requested by emailing hello@cuscara.com. We verify requests to prevent unauthorised deletion and delete the affected data from active systems unless a legal retention obligation or overriding reason requires continued storage.

Technical backups and logs may remain for longer according to the retention rules of the infrastructure providers. They are not used for advertising and are deleted or overwritten under the providers’ applicable rules.

8. Rights of data subjects

Subject to the statutory requirements, data subjects may request access, rectification, erasure, restriction of processing, data portability, and may object to processing. Consent can be withdrawn at any time with effect for the future.

Requests should be sent to hello@cuscara.com. We respond without undue delay and within the statutory deadlines; an appropriate identity check may be required for security.

You also have the right to lodge a complaint with the Austrian Data Protection Authority: https://www.dsb.gv.at/.

9. Data protection officer and sensitive data

No separate data protection officer has currently been appointed. Cuscara does not request special categories of personal data. Users should not upload health data, third-party credentials, or other sensitive content in learning materials unless it is necessary for the requested use.

Cuscara currently does not make automated decisions producing legal or similarly significant effects on users.

10. Changes to this privacy policy

This privacy policy may be updated when features, providers, or legal requirements change. The current version is available on this website.