Privacy Policy

Note: This English version is a translation provided for your convenience. The German version is the authoritative and legally binding original.

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to this privacy policy below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section "Information on the controller" of this privacy policy.

How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data you enter into a form. Other data is collected automatically by our IT systems, or with your consent, when you visit the website. This is primarily technical data (e.g. internet browser, operating system, or time of the page view). This data is collected automatically as soon as you visit this website.

What do we use your data for?

Part of the data is collected to ensure the error-free provision of the website and the services offered. Other data may be used to analyze your user behavior – currently, however, only with your consent.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you may withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and any other questions regarding data protection.

2. Hosting

Vercel

We host this website with Vercel. The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (hereinafter "Vercel").

When you visit our website, your personal data is processed on Vercel's servers. This may include, in particular, your IP address and technical connection data transmitted automatically by your browser (browser type and version, operating system, referrer URL, hostname of the accessing computer, time of the server request). This is necessary to deliver the website to you and to ensure the stability and security of its operation.

Vercel operates a global content delivery network (CDN). Your data may therefore also be processed outside the European Union, in particular in the USA. We have concluded a data processing agreement with Vercel (Data Processing Addendum) in which Vercel undertakes to protect our visitors' data and to process it only on our instructions. Any transfer of data to third countries is based on the EU Commission's standard contractual clauses.

The use of Vercel is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable, secure, and fast presentation and provision of our website.

Further information can be found in Vercel's privacy policy at: https://vercel.com/legal/privacy-policy.

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

UnitEd – unite education e.V. Schwarzpappelweg 6a 22391 Hamburg Germany

Email: hello@uniteducation.net

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

Storage period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for erasure or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons no longer apply.

General information on the legal bases of data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, where special categories of data under Art. 9(1) GDPR are processed. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your terminal device (e.g. via device fingerprinting), data processing is additionally carried out on the basis of § 25(1) TDDDG (the German Telecommunications and Digital Services Data Protection Act). Consent can be withdrawn at any time. If your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data where required for compliance with a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The legal bases applicable in each individual case are explained in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our association's activities, we work with various external parties. This sometimes requires the transfer of personal data to these external parties. We only pass on personal data to external parties where this is necessary for the performance of a contract, where we are legally obliged to do so (e.g. disclosure of data to tax authorities), where we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or where another legal basis permits the transfer. When using data processors, we only pass on personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. The lawfulness of the data processing carried out before the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

WHERE DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work, or the place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

The supervisory authority competent for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, www.datenschutz-hamburg.de.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

Access, rectification and erasure

Within the framework of the applicable legal provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of the data processing, and where applicable a right to rectification or erasure of this data. You can contact us at any time about this and any other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restriction of processing applies in the following cases:

If you contest the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you may request the restriction of data processing instead of erasure.
If we no longer need your personal data, but you need it for the exercise, defense or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from "http://" to "https://" and by the lock symbol in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies

Our website uses only technically necessary cookies. These are required to provide the basic functions of the website and your personal workspace:

session – an encrypted httpOnly cookie that stores your session and your workspace settings (e.g. the connected GitHub repository and the selected AI model) for up to 30 days.
oauth_state – a short-lived cookie that protects the GitHub sign-in process against attacks and is deleted once sign-in is complete.
fu – a signed httpOnly cookie that counts daily usage of our free AI quota and resets every day.
ue_consent – a cookie that stores the choices you make in our cookie banner (analytics and external content, on or off) for 6 months, so we can honor them on every page.

These cookies are necessary for the operation of the website and the provision of the functions you request. They are set on the basis of § 25(2) no. 2 TDDDG; the associated data processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (our legitimate interest in stable and secure operation).

Consent banner and web analytics

When you first visit our website, our cookie banner asks for your consent to optional categories. Your choice is stored in the ue_consent cookie listed above; you can change or withdraw it at any time via "Cookie settings" in the footer.

With your consent, we use Vercel Analytics, a usage-statistics service by Vercel Inc., USA (see section 2), to understand how our website is used. Vercel Analytics works without cookies and does not track you across websites; it processes information such as pages viewed, the referring page, device and browser type, and your approximate country. The service is activated only after you opt in via the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) and remains inactive otherwise.

Third-party content such as embedded YouTube videos and Tally forms is loaded only after you have consented via the cookie banner or by clicking the respective placeholder (see sections 6 and 9). We do not use any marketing or advertising cookies.

Contact form and other forms

If you send us inquiries via a form, the information you provide in the form, including the contact details you enter there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent.

The processing of this data is based on Art. 6(1)(b) GDPR where your inquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where this has been obtained; consent can be withdrawn at any time.

The data you enter in forms will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for storing the data no longer applies (e.g. after your inquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

For forms on this website (e.g. feedback, volunteer applications, or membership applications) we use the Tally service. Details can be found in the "Plugins and tools" section of this privacy policy.

Inquiries by email, telephone or social media

If you contact us by email, telephone or social media, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent.

The data you send us via contact inquiries will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for storing the data no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Registration and workspace via GitHub

For your personal workspace, you can sign in with your GitHub account. GitHub is provided by GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

When you sign in via GitHub, we receive basic profile data from GitHub (username, publicly listed name and profile picture) as well as an access token that allows us to act on your behalf. At your request, we create a private repository in your GitHub account in which your workspace content is stored – such as your materials, plans, and the transcripts of your conversations with the AI assistant. Access takes place via our GitHub App with the permissions you grant; access tokens are stored exclusively in your encrypted session cookie. We do not operate our own database holding your workspace content.

Your content therefore remains in your GitHub account and under your control: you can view, export, reuse with other tools, share, or delete it at any time, and you can remove our app at any time in your GitHub settings. Repositories are created as private by default; whether you keep content private or share it publicly is then your own responsibility. Please note that GitHub's own processing of your data is governed by GitHub's privacy policies.

Processing is based on Art. 6(1)(b) GDPR (provision of the service you requested). GitHub is certified under the EU-US Data Privacy Framework (DPF); details and further information can be found in GitHub's privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.

5. AI-powered features (chatbot)

We offer AI-powered features, in particular a chatbot (AI assistant) that supports teachers in planning and creating teaching materials.

Technical implementation via the Vercel AI Gateway

Your requests to the AI assistant are routed through the Vercel AI Gateway (provider: Vercel Inc., USA) to various AI model providers. We test and switch the models used in the background in order to achieve the best possible results; the provider or model answering your request may therefore vary. In doing so, the content of your inputs and any context data required for the response (e.g. content from your workspace) is transmitted to the gateway and the respective model provider. Processing in the USA and possibly other third countries cannot be excluded; where available, it is based on the EU Commission's standard contractual clauses or the EU-US Data Privacy Framework.

No training on your data – where possible

We configure our requests so that your data is, as far as possible, not used to train AI models ("opt-out"). However, individual model providers may ignore this setting; we have no control over this. Please therefore do not enter particularly confidential personal data into the chatbot – in particular no data about students.

Your own API key ("bring your own key")

If you wish, you can provide your own API key from a supported provider (currently OpenAI, Anthropic, Google, or OpenRouter). Your requests then run through your own contractual relationship with that provider, and you retain full control over the terms and data processing; the privacy policies of the respective provider apply in addition. Your key is stored exclusively in your encrypted session cookie and is used only for your own requests.

Without your own key, we provide a free quota via the Vercel AI Gateway, which is subject to fair, daily-limited use (see the "Cookies" section).

Legal bases and notes

Processing is based on Art. 6(1)(b) GDPR (provision of the AI features you requested). No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place. Please note that AI-generated content may be inaccurate or incomplete; review it on your own responsibility before use (see also our Terms of Service).

6. Social media

We maintain a presence on social networks (currently Instagram, LinkedIn, and YouTube) to share information about our work and stay in touch with the community. This website merely links to our profiles; no social media plugins are embedded. Therefore, no data is transmitted to these platforms when you visit our website – only when you follow a link do you leave our website, and the terms of the respective platform apply. The same applies to the "share" links in our articles (e.g. Facebook, X, LinkedIn, WhatsApp): they are plain links that only establish a connection to the respective platform when clicked.

Instagram

We operate a page on Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When you visit our Instagram page, Meta processes personal data about you – even if you do not have an Instagram account yourself. Meta also provides us, as the page operator, with statistical evaluations of the use of our page (so-called "Insights"), which consist only of aggregated, anonymized data. Where personal data is processed in this context, we and Meta are jointly responsible (Art. 26 GDPR). The joint obligations have been set out in an agreement, the text of which can be found here: https://www.facebook.com/legal/controller_addendum. You can exercise your data subject rights (e.g. access or erasure) directly with Meta; if you exercise them with us, we will forward your request to Meta.

The operation of our Instagram page is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in public relations and communication with our community. Data transfer to the USA is based on the EU Commission's standard contractual clauses; Meta is additionally certified under the EU-US Data Privacy Framework (DPF).

Further information can be found in Instagram's privacy policy: https://privacycenter.instagram.com/policy/.

We operate a page on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

When you visit our LinkedIn page, LinkedIn processes personal data about you and provides us with statistical evaluations (so-called "Page Insights"). Where personal data is processed in this context, we and LinkedIn are jointly responsible (Art. 26 GDPR); the corresponding agreement can be found at: https://legal.linkedin.com/pages-joint-controller-addendum. You can exercise your data subject rights directly with LinkedIn; requests sent to us will be forwarded to LinkedIn.

The operation of our LinkedIn page is based on Art. 6(1)(f) GDPR (legitimate interest in public relations and communication). LinkedIn is certified under the EU-US Data Privacy Framework (DPF).

Further information can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

YouTube

We operate a channel on YouTube and embed individual YouTube videos on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Embedded videos (including their preview images) are loaded only after you have consented to external content via our cookie banner or by clicking the video placeholder. Videos are then loaded via the domain "youtube-nocookie.com" (extended privacy mode). According to Google, information about you is only stored, or a connection to YouTube's servers established, once you play the video. However, when you play a video, Google may still collect data about you (in particular your IP address) and set cookies – even if you are not logged in to Google; we have no control over this processing.

The loading of embedded videos is based on your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via "Cookie settings" in the footer. Operating our YouTube channel itself serves to present our work vividly and is based on Art. 6(1)(f) GDPR (legitimate interest in appealing public relations). Google is certified under the EU-US Data Privacy Framework (DPF).

Further information can be found in Google's privacy policy: https://policies.google.com/privacy.

7. Donations via GoFundMe

We use the GoFundMe platform for donation campaigns. It is operated by GoFundMe Inc., USA; for users in the European Economic Area, GoFundMe Ireland Limited, Ireland, acts.

Our website merely links to our campaigns on GoFundMe. When you follow the link and donate, your data (e.g. name, contact details, payment information) is processed by GoFundMe as an independent controller; payment data is not processed by us. Where GoFundMe provides us with information about donations received (e.g. name and amount), we process this to use donations properly, to fulfill statutory record-keeping obligations, and where applicable to issue donation receipts, on the basis of Art. 6(1)(c) and (f) GDPR.

A transfer of data to the USA cannot be excluded; according to its own statements, GoFundMe bases such transfers on appropriate safeguards such as the EU Commission's standard contractual clauses. Further information can be found in GoFundMe's privacy policy: https://www.gofundme.com/c/privacy.

8. Newsletter

Newsletter data

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter (double opt-in). Further data such as your name is not collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The processing of the data entered into the newsletter registration form is based exclusively on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent to the storage of the data and the email address, as well as its use for sending the newsletter, at any time, for example via the "unsubscribe" link in the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

The data you provide to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us in a blacklist where this is necessary to prevent future mailings. The data from the blacklist is used only for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Storage in the blacklist is not limited in time. You may object to the storage if your interests outweigh our legitimate interest.

Acumbamail

We send our newsletter using the Acumbamail service. The provider is Acumbamail, S.L., Av. Rey Santo 3D, 13001 Ciudad Real, Spain (European Union).

When you subscribe, the email address you enter is transmitted to Acumbamail's servers and stored and processed there on our behalf for the purpose of sending the newsletter — including the double opt-in confirmation email and the welcome email (data processing agreement). According to its own statements, Acumbamail processes this data within the European Union.

Processing is based on your consent (Art. 6(1)(a) GDPR); see the "Newsletter data" section above for how to withdraw it.

Further information can be found in Acumbamail's privacy policy: https://acumbamail.com/en/privacy-policy/.

9. Plugins and tools

Tally

For forms on this website (e.g. feedback, volunteer applications, and membership applications), we use the Tally service. The provider is Tally BV, based in Belgium (European Union).

Embedded forms are loaded only after you have consented to external content via our cookie banner or by clicking the form placeholder; the feedback widget loads Tally only when you click it. When you open and complete a form, your entries are transmitted to Tally's servers and processed there on our behalf (data processing agreement); according to its own statements, Tally hosts data in Europe. Processing is based on Art. 6(1)(b) GDPR where your entries relate to the performance of a contract or are necessary for pre-contractual measures (e.g. a membership application); otherwise it is based on our legitimate interest in the effective handling of your inquiries (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR) where this has been obtained.

Further information can be found in Tally's privacy policy: https://tally.so/help/privacy-policy.

Fonts (hosted locally)

This site uses fonts (including Poppins, Nunito, Inter, and Geist Mono) to display text consistently. The fonts are stored locally at our hosting provider and delivered together with the website. When a page is loaded, no connection is made to third-party servers (e.g. Google); in particular, no data such as your IP address is transmitted to third parties.