Privacy Policy

This policy explains how TechCrafters GmbH processes personal data when you use SPS-Academy, in line with the EU General Data Protection Regulation (GDPR).

1. Controller

TechCrafters GmbH, Schulstrasse 12, 78652 Deißlingen, Germany. Contact: info@techcrafters.de.

2. What we collect

• Account data: your email address, display name, and a securely hashed password.
• Learning data: your projects, code submissions, exercise/challenge progress, and questions you post.
• Company membership: if your account was created for a company that booked SPS-Academy, the fact that it belongs to that company. This determines who else can see your progress — see section 4.
• Technical data: sign-in timestamps and the IP address seen by the server, used for security (rate limiting / abuse prevention) and to operate the service.
• An activity record: actions that change something are recorded with who performed them, what they affected, the result and the IP address they came from — including failed sign-in attempts. We use this to keep the platform secure and to be able to show who changed what. Only we can read it; your employer cannot.

3. Purposes & legal basis

• Providing the service and your account — performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention, and keeping the service reliable — legitimate interests (Art. 6(1)(f)).
• Sending account emails (invitations, password resets) — contract / legitimate interests.

We do not use advertising or third-party tracking, and we do not sell personal data. To understand how the site is used, we collect our own privacy-friendly, aggregate analytics (which pages are viewed and visit counts) — with no cookies, no third parties, and no personal profiles — on the basis of our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

4. If your account belongs to a company

Many accounts exist because a company booked SPS-Academy for its people — either you registered with an invitation code from your employer, or somebody there created the account for you. Your account is then linked to that company, and one or more people at the company hold a company administrator role. They are employees of your company, not of TechCrafters GmbH.

A company administrator can see, for the people in their own company only:

• your display name and email address;
• whether your account is active, when it was created, when you last signed in, and when you were last active;
• which courses your company has access to, how many exercises you have completed, and the resulting percentage;
• the detail behind that figure: per chapter and per exercise, the status, the number of attempts and the date you completed it.

They can also create further accounts for the company, re-send a set-password link, email you a reminder to continue your training, and revoke your access to the platform.

A company administrator cannot see your saved playground projects or the code you submit, the questions you ask us, your individual quiz answers, any page-view statistics, our internal activity record, or anything at all about another company. They cannot change course content.

We process this data to provide the service to your company under our contract with it (Art. 6(1)(b) GDPR) and in the legitimate interest of documenting the training it has booked (Art. 6(1)(f) GDPR). Your company decides for itself what it does with what it sees and is responsible for that use. [Have counsel confirm whether your customer contracts make the company a separate or a joint controller, and state that here.]

Your data download (Settings → Privacy & data) names the company your account is linked to, so you can always see which employer has this visibility. If your account is not linked to a company, none of the above applies and no other user of the platform can see your data.

5. Hosting & processors

The application and database are hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, within the EU. Strato acts as a processor under a data-processing agreement (Auftragsverarbeitungsvertrag). Outgoing email is sent via our configured SMTP provider [name your SMTP provider].

6. Cookies & local storage

We do not use tracking or advertising cookies. We store a small amount of data in your browser’s local storage: a sign-in token (to keep you logged in) and your language and theme preferences. These are strictly necessary for the service to function. For aggregate usage analytics we additionally store a random, temporary session identifier in your browser’s session storage; it contains no personal data and is discarded when you close the tab.

7. Retention

We keep your account data for as long as your account exists. When you delete your account, your personal data is erased promptly. Sign-in event logs are retained for up to [e.g. 90 days] for security, then deleted or anonymised. Backups are rotated and expire within [e.g. 30 days].

Revoking access is not deletion. If your employer or we deactivate your account, you can no longer sign in but your learning data is kept — only deleting the account removes it, and only you can do that. Invitation codes you were given remain recorded as used even after erasure, so an invitation cannot admit more people than it was issued for.

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. You can download all your data and delete your accountat any time from Settings → Privacy & data. The download also names the company your account belongs to, if any. You may also contact us at info@techcrafters.de. You have the right to lodge a complaint with a supervisory authority.

9. Changes

We may update this policy; material changes will be announced in the app.