Privacy Policy

1. Controller and scope

This policy covers the website easylanguagebooks.com with its shop, and the online practice at platform.easylanguagebooks.com, both operated under the name Easy Language Books. The controller under the General Data Protection Regulation (GDPR) is:

Yehor Chulkov, sole proprietor (Einzelunternehmer)

Gertrude-Fröhlich-Sandner-Straße 2, Turm 9/Etage 9, 1100 Wien, Österreich

E-mail: [email protected]

The same operator also runs Deutsch mit Yehor (deutsch-mit-yehor.com and its learning platform platform.deutsch-mit-yehor.com). Both brands have one controller, and the learning platform is one system: an account opened on one brand's platform also works on the other's. Each platform shows only its own brand's courses.

We have not appointed a data protection officer; Article 37 GDPR does not require one for us.

2. Hosting and server logs

The website, the shop and the online practice run on servers rented by the operator from Hetzner Online GmbH, in a data centre in Helsinki, Finland (EU).

When you visit the website, the server automatically processes technical request data: your IP address, the date and time, the requested page, your browser's user agent and the referrer, if transmitted. These data are necessary to deliver the website and keep it secure; without them, it cannot be displayed. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interests in reliable delivery and in protecting the website and its infrastructure.

Server and access logs are kept for up to 30 days.

3. Cloudflare and recipients

The pages are delivered through the network of Cloudflare, Inc., which provides DNS, content delivery (CDN) and TLS and processes the same request data, including your IP address, to deliver and protect the website. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in secure and reliable operation. Data may be transferred to the USA in the process. How long Cloudflare keeps these data, and on which safeguards it relies for transfers, is set out in Cloudflare's privacy policy.

Recipients outside the European Economic Area (EEA) are named in the sections below, together with the safeguards they rely on. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Article 45 GDPR); otherwise on the Standard Contractual Clauses (Article 46(2)(c) GDPR). We do not sell your data.

4. Cookies, pixels and similar technologies

This website shows no cookie banner. The pixels and Google Analytics described below load for every visitor on every page of this website and set cookies or similar identifiers in your browser.

Meta Pixel. The Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland, measures the effectiveness of our advertising on Facebook and Instagram (conversion tracking) and makes it possible to show visitors of this website suitable advertising there (retargeting). It reports page views, the viewing of a book page, the click on a buy button (opening the payment page) and a purchase on the thank-you page (with the book, amount and order number) to the operator's Meta dataset in its Meta business account. It sets the cookies _fbp and, if you came through an ad, _fbc (90 days). Data may be transferred to the USA; Meta is certified under the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses apply in addition. Details: Meta's privacy policy.

TikTok Pixel. The TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, measures the effectiveness of our advertising on TikTok and makes it possible to show visitors of this website suitable advertising there. It reports page views, the viewing of a book page, the click on a buy button and a completed payment, and sets cookies such as _ttp (13 months) and ttcsid. Data may be transferred to countries outside the EU (TikTok stores data, among other places, on servers in the USA, Malaysia and Singapore); for this, TikTok relies on adequacy decisions of the European Commission and Standard Contractual Clauses. Details: TikTok's privacy policy.

Google Analytics. Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, shows us how this website is used. It reports page views, the viewing of a book page, the click on a buy button and a purchase on the thank-you page (with the book, amount and order number) to the operator's Google Analytics property; it receives no name and no e-mail address. It sets the cookies _ga and _ga_<container-id> (up to 2 years). Google Analytics 4 does not log or store IP addresses: it uses them only to derive a coarse location and then discards them. Google signals and ad personalisation are switched off. Event data are kept for 14 months. Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses apply in addition. Details: Google's privacy policy.

Where a purchase came from. The website also stores, for 30 days, in its own cookie (elb_attr) and in your browser's local storage (elb-attr): your first visit (referring website, landing page, time), the campaign parameters (utm parameters) of your first visit through a tagged link, and your last click on an ad (platform, click identifier fbclid or ttclid, campaign, ad set and ad, time). When you click a buy button, these details, the Meta cookies _fbp and _fbc, TikTok's _ttp, and your IP address and user agent at that moment are sent to our server and stored with the Stripe payment session (section 6), so that we can attribute a purchase to the ad or link through which you came. After a purchase, the order confirmation page keeps two markers in local storage, elb-purchase- and elb-ga-purchase-, each followed by the end of the order number, so that the purchase is reported only once to Meta and TikTok and only once to Google Analytics.

Visit log. Each page load sends one line to our server: the page, the language, any utm parameters, whether an fbclid was present together with a 12-character hash of it, the host name of the referring website and the device class (for example phone or desktop). This log contains no IP address, no e-mail address and no full user agent.

The legal basis for the pixels, Google Analytics, the visit log and this storage is our legitimate interest in measuring and improving our advertising and our website (Article 6(1)(f) GDPR). You can object at any time by e-mail to [email protected], and you can prevent the storage by blocking or deleting cookies and trackers in your browser.

Fonts and images are served from our own server; no fonts or embedded content are loaded from third parties. The website uses no analytics tool other than Google Analytics and no trackers other than those described in this section.

5. Contact by e-mail

If you contact us by e-mail, we process your e-mail address, the content of your message and any information you provide in order to answer your enquiry. The legal basis is Article 6(1)(b) GDPR for enquiries about a contract or steps requested before a contract, and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in answering enquiries.

Messages to [email protected] arrive in a mailbox on our own mail server (Mailcow) on the Hetzner server described in section 2; a copy is forwarded to the operator's Gmail mailbox at Google. Google may transfer data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR).

Enquiries are kept until the matter is settled, and beyond that while claims could still arise from it.

6. Purchases

To process the purchase of an e-book, we process the data required for it (name, e-mail address, billing address, order and payment details) on the basis of Article 6(1)(b) GDPR.

• Payment: when you click a buy button, our server creates a Stripe Checkout session and forwards you to Stripe's payment page. The sale is processed through Stripe Managed Payments (“Sold through Link”, see the Terms, section 2). On the payment page, Stripe collects your e-mail address, name, billing address and payment details; card data never reach our servers. Stripe and Link receive the data required for payment, fraud prevention, invoicing and VAT and process them as independent controllers; data may be transferred to the USA. With the order we also store with Stripe the details of where the purchase came from (section 4), and the IP address, user agent and click and pixel identifiers at the buy click, for measuring our advertising. Details: Link's privacy policy, Stripe's privacy policy.
• Delivery and e-mails: the e-mail with the link to your personal download page, the confirmation of your download consent and the receipt of a withdrawal are sent from [email protected] through Amazon Simple Email Service (Amazon Web Services, data centre in Frankfurt am Main, eu-central-1) as our processor. Replies reach our mailbox as described in section 5.
• What the shop stores: the order numbers of fulfilled orders; for each order, the state of its download page (order, e-mail address, files); one line per download consent (section below); and withdrawal statements.
• Download consent (for e-books bought from 31 October 2026): if you agree on the download page that provision begins immediately, we store the wording you ticked and its version, the language, the time, your IP address and user agent, and the order, in order to confirm the consent to you and to be able to prove it (Article 6(1)(c) GDPR in conjunction with § 18(1)(11) and § 7(3) FAGG).
• Withdrawal: if you use the online withdrawal function (“Withdraw from the contract”), we store your name, e-mail address, the contract you withdraw from, how we can reach you and the time of receipt, in order to process and confirm the withdrawal (Article 6(1)(c) GDPR in conjunction with § 13a FAGG).
• Internal notification: our server informs us about new orders (book, amount, e-mail address, order number), refunds and withdrawals (for withdrawals also the name and your details in the form) through the messaging service Telegram (Article 6(1)(b) and (f) GDPR).
• Measuring our advertising: to measure the effectiveness of our advertising on Facebook, Instagram and TikTok (conversion tracking), our server sends an event when the payment page is opened (InitiateCheckout) and after a purchase (Purchase; at TikTok CompletePayment) to the Conversions API of Meta Platforms Ireland Ltd. and to the Events API of TikTok Technology Limited (addresses in section 4), independently of the pixels in your browser. We send the IP address and user agent at the buy click, the click identifier of an ad (fbclid or fbc; at TikTok ttclid) and the pixel identifier (fbp; at TikTok ttp), where present, and the book, amount and currency. After a purchase we also send the order number and, hashed (SHA-256): to Meta, your e-mail address, name, city, postcode and country, and your phone number if you gave one; to TikTok, your e-mail address and phone number. The legal basis is our legitimate interest in measuring our advertising (Article 6(1)(f) GDPR); you can object at any time by e-mail to [email protected]. Data may be transferred to the USA and other countries outside the EU; for Meta and TikTok, see section 4.
• Online practice: after payment, the shop passes your e-mail address and name to our platform platform.easylanguagebooks.com, which opens your learning account (or enrols your existing account in the book's course) and e-mails you a sign-in link (Article 6(1)(b) GDPR; see section 7).

7. Online practice on platform.easylanguagebooks.com

The online practice for each book runs on our learning platform at platform.easylanguagebooks.com. It is the same platform that also serves Deutsch mit Yehor, under the Easy Language Books brand; the controller is the operator named in section 1.

• Account data: e-mail address, first and last name, password (encrypted) or sign-in provider (for example Google sign-in), optional date of birth and profile picture, preferred language, e-mail verification status, sign-in times, creation and modification timestamps. Purpose: setting up and managing your account, sign-in, system messages, preventing fraud and abuse. Legal basis: Article 6(1)(b) GDPR. Sign-in runs through AWS Cognito (Amazon Web Services, Frankfurt, eu-central-1); your session is kept in your browser's local storage, not in a cookie. Some sign-in e-mails (sign-up code, password reset) and the Google sign-in screen show the Deutsch mit Yehor address, because both brands share one account system.
• Learning profile and progress: target and native language, learning goals, estimated level (CEFR), time zone, enrolled courses, completed exercises, time spent, results and your individual answers. Purpose: showing your progress, suggesting what to review, adapting exercises, improving the courses. Legal basis: Article 6(1)(b) GDPR; where we analyse these data statistically to improve the courses, also our legitimate interest in developing the platform (Article 6(1)(f) GDPR).
• AI tutor and graded answers: the text of your messages to the AI tutor and its replies, a derived learning profile (for example recurring mistakes and strengths), and your free-text answers in writing and speaking exercises. To generate replies and to grade answers, these are sent to our processor OpenAI (USA). If you speak instead of typing, the recording is also sent to OpenAI to be turned into text; we do not store the recording itself. If the tutor asks for human help with a question it cannot answer, that question is forwarded to the administrator over Telegram with your pseudonymous user ID. Legal basis: Article 6(1)(b) GDPR. Please do not enter particularly sensitive data (for example about your health) that you do not need for learning. The AI features support your learning but make no decisions with legal or similarly significant effects on you (Article 22 GDPR).
• Bug reports and support messages: the description you enter, the affected page, an optional screenshot, browser console logs, user agent and screen size, and related server logs; the content of your support enquiries. The administrator is notified via Telegram or ntfy with your pseudonymous user ID and the text, without your name or e-mail address. Legal basis: Article 6(1)(f) GDPR (a working platform) and, for support, Article 6(1)(b) GDPR.
• Course reviews: if you write a review, your rating and comment are shown publicly with your name and profile picture (Article 6(1)(f) GDPR). You can ask us at any time to delete or anonymise your review.
• Activity log and IP addresses: a technical log of significant actions (for example sign-in, course start) for security, abuse detection and error diagnosis (Article 6(1)(f) GDPR). The application does not deliberately store IP addresses in its database; they are processed transiently by our hosting, Cloudflare and the services named here.
• Error tracking: Sentry (Functional Software, Inc., USA; data stored in the EU region, Frankfurt) receives error reports from your browser (browser, page, program trace) and from our server error reports, server logs and, for one request in ten, performance data; in individual cases these may contain your user ID or e-mail address. We send Sentry no IP addresses; when your browser transmits an error report, Sentry necessarily sees the IP address of that connection. Sentry sets no cookies and builds no usage profile. Legal basis: our legitimate interest in a stable platform (Article 6(1)(f) GDPR).
• Local storage: the platform keeps your sign-in session, your language and onboarding flags (for example “introduction already seen”) in your browser's local storage. This is strictly necessary for the service you request (§ 165(3) TKG 2021). On the Easy Language Books platform, no analytics, advertising or other consent-based tools load, so it shows no cookie banner.
• E-mails: the platform sends its e-mails (sign-in link, system messages) from [email protected] through Amazon SES.

Processors and recipients of the platform: Amazon Web Services (Cognito, DynamoDB, S3, SES, CloudWatch; sign-in, database, file storage, e-mail delivery and logging; Frankfurt, Germany), Hetzner Online GmbH (our servers; Helsinki, Finland), DeepL (machine translation of learning content; processing in the EU), OpenAI (AI tutor, grading, speech recognition; USA), Cloudflare (delivery and protection; IP address and request data), Telegram and ntfy (notifications to the administrator, as described above) and Sentry (error diagnostics). For OpenAI, Cloudflare, Telegram, ntfy and Sentry, data may be processed outside the EU/EEA, on the basis set out in section 3. We have a data processing agreement (Article 28 GDPR) with every processor.

Minimum age: you can register from the age of 16; if you are under 18, you need the consent of a parent or guardian to buy. If we learn that we have received data from someone under 16, we delete them promptly.

8. Retention

• Order records (order number, e-mail address, book, amount, download page) and payment records: seven years (§ 132 of the Austrian Federal Fiscal Code, BAO).
• Download consents: with the order, for as long as we may need to prove the consent.
• Withdrawal statements: like payment records, up to seven years, as proof of the withdrawal and the refund.
• Where a purchase came from (section 4): 30 days in your browser; once sent with an order, it is kept with that order at Stripe.
• Google Analytics (section 4): event data for 14 months at Google; the cookies _ga and _ga_<container-id> for up to 2 years in your browser.
• Platform account, learning profile, progress and tutor chats: for as long as your account exists, or until you ask for deletion.
• Server and operational logs: up to 30 days. Platform backups: up to 90 days, so deleted data may remain in backups for that period before they are overwritten.
• Bug reports and support messages: as long as reasonably necessary to resolve the issue, then deleted or anonymised.

Beyond that, we keep personal data only as long as necessary for the purposes named or as long as statutory retention obligations apply. Data subject to a statutory retention obligation are blocked from further use rather than deleted.

9. Your rights

Subject to the statutory conditions, you have the rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21 GDPR); you may object to processing for advertising measurement at any time. We will then stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for establishing, exercising or defending legal claims.

To exercise your rights, an informal message to [email protected] is sufficient. You can delete your platform account yourself at any time in your account settings. You may also lodge a complaint with a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. In Austria: Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, [email protected].

Last updated: November 2026.

Translations into other languages are provided for convenience.