Privacy Policy

1. Information We Collect

Information You Provide

• Account Information: Name, email, password (encrypted) and, if you sign in with Google or Apple, the account identifier that provider gives us
• Exam Data: Essays, reading answers, listening responses, speaking-exam voice recordings, scores, and progress
• Payment Information: Billing details (processed by Stripe on the website and by Apple for purchases made in the iOS app)
• Organization Data: School names, teacher-student relationships (for organization accounts)
• Referral Data: Referral code usage, referrer-referee relationships, and referral timestamps
• Onboarding Data: your answers during setup (target exam, level, exam date and, if you choose to answer, how you heard about us) and which setup steps you completed, skipped or closed. We use this to improve the setup flow (legitimate interest, Art. 6(1)(f) GDPR) and keep it until you delete your account. You can object at any time.

Information We Collect Automatically

• Usage Data: Pages visited, features used, time spent, exam completion rates
• Device Information: IP address, browser type, device type, operating system
• Cookies: See our Cookie Policy for details
• Creator Link Data: When you open a creator's link (scoreup.pro/c/…), we count the click without storing anything on your device and without recording your IP address. If you accept analytics cookies, your browser keeps the creator code for up to 30 days. If you arrived through a creator's link, the sign-up form shows that creator's code pre-filled, and you can clear it. If you keep it and it belongs to an active creator partnership, we store it on your new account. If you accepted analytics cookies, the code your browser kept is also stored on your account when you log in. We store the first and the most recent creator code you arrived through, each with the time you arrived.
• First Visit Data: When you first visit ScoreUp, we note how you arrived: the campaign tags in the link (utm_source, utm_medium, utm_campaign), the domain of the website that sent you (not the full address), the first page you opened, and whether you came from an AI assistant such as ChatGPT. Without analytics cookies, this stays only in the open page and is gone when you reload or close it. If you accept analytics cookies, your browser keeps it for up to 30 days. When you create an account, we store it on your new account, never on an existing one, to see which channels bring learners to us. It is deleted with your account.

Information from Third Parties

When you sign in with Google or Apple, we receive your name and email address. With Apple you can choose to hide your email; we then receive a relay address that Apple creates for you. We do not receive or store a profile picture. From Stripe, we receive payment confirmation and transaction status (not your card numbers). From Apple, we receive the signed receipt of a purchase made in the iOS app.

2. How We Use Your Information

• Provide the Service: Create your account, authenticate you, process exam submissions, and deliver AI-generated feedback
• Process Payments: Handle exam credit package purchases, Unlimited monthly plan subscriptions and their monthly renewals, applicable organization plan renewals, and refunds—through Stripe on the website and through Apple for purchases in the iOS app
• Improve Our Service: Analyze how the product is used and develop new features
• Personalize Your Experience: Recommend practice materials based on your skill level
• Communicate: Send service announcements, respond to support requests, and (with consent) promotional materials
• Legal & Security: Comply with laws, enforce our Terms, and protect against fraud
• Referral Program: Track referral relationships, process rewards, and detect fraudulent activity using IP addresses and email patterns
• Creator Partnerships: Credit a sign-up or purchase to the creator whose code you used, or whose link you followed in the 30 days before buying, and calculate that creator's commission. Creators see each purchase made with their code (date, amount, and their commission) but never your name, email address or account

Legal Basis for Processing (GDPR Art. 6)

3. How We Share Your Information

AI Service Providers

Your essays, answers, and speaking-practice voice recordings (including the notes you type in Teil 3 of telc C1 and telc C1 Hochschule Listening) are sent to OpenAI, Anthropic, and Google (Gemini) for AI grading. We have enterprise agreements prohibiting these providers from using your data to train their public models. Before anything is sent for the first time, we ask for your explicit permission (before you start a Writing or Speaking exam or telc C1 / telc C1 Hochschule Listening, and when you use “Ask AI Why”). You can withdraw it at any time under Profile → Privacy & Security; Reading and Listening keep working without it, except telc C1 and telc C1 Hochschule Listening. One narrow exception: in IELTS Reading and Listening, a short typed answer that does not literally match the answer key may be checked for equivalence by an AI model: first TypeSafe's Jev model, which we reach through Cloudflare; if Jev is not sure, Anthropic (Claude), with Google (Gemini) as a backup. Only the word or words you typed are sent, together with the question and its answer key, with nothing that identifies you. In Cambridge B2 First, what you write in Writing goes to OpenAI, Anthropic, and Google (Gemini) like every essay; Reading and Use of English has the same narrow exception as IELTS: an answer you typed in Part 2 or Part 4 that the answer key does not cover is checked for equivalence by Anthropic (Claude), with Google (Gemini) as a backup, and only the words you typed for that question are sent, together with the question and its answer key, with nothing that identifies you; nothing from Listening is sent.

Automated Decision-Making

Payment Processor

Stripe handles payments made on the website. They receive your billing information directly and comply with PCI DSS standards. Purchases made in the iOS app are handled by Apple through your Apple Account. In both cases we never see your full card number.

Analytics and Session Replay

On the website, and only after you accept analytics cookies, we use PostHog (hosted in the EU) and Google Analytics 4 to understand how the product is used. Both receive your usage data; PostHog also receives your account ID, name and email so that we can connect a problem report to what happened. PostHog additionally records session replays: a reconstruction of what happened on the page, including the answers you type during an exam. Password, email and phone fields are masked. We use replays to find and fix defects. The mobile app uses neither tool.

Hosting, Storage and Email

Our servers and databases run on Google Cloud in Frankfurt, Germany. Speaking-exam recordings are kept in Google Cloud Storage in the same region and are deleted automatically after 30 days. Emails are delivered by Resend (Resend, Inc., USA), which receives your email address and the content of the message and processes them in its EU region eu-west-1 (Ireland). We do not track whether you open our emails or click links in them.

Tree Planting (Tree-Nation)

For every payment, we fund the planting of one tree through Tree-Nation. We share no personal data with Tree-Nation: every tree is planted in ScoreUp's name, not in yours.

Weekly Growth Analysis (Anthropic)

To review how our service is developing, once a week we analyze aggregate statistics with Anthropic's Claude model (Anthropic PBC, USA). Only weekly totals are sent for this analysis: the numbers of sign-ups, activations, and payments together with the week's total revenue, email send and delivery counts, app launches, website visitor counts, and Google and Bing search statistics. Any number below 5 is hidden, and a search term is included only if it was shown at least 5 times. Your name, email address, account ID, IP address or any other information that could identify you is never sent for this analysis. Anthropic works under the same enterprise agreements as the AI services above and may not use this data to train its models.

Push Notifications (Mobile App)

If you allow notifications in the iOS app, Apple Push Notification service receives your device's push token and the text of each notification we send: that an exam has been graded, or that your study streak is about to end. We send no advertising by push. You can switch notifications off in your profile's notification settings or in your phone's settings. We delete the token when you log out or delete your account; if you turn notifications off in your phone's settings, we delete it the next time you open the app. We also delete a token that has not been used for 30 days. In the Android app the same applies to Google Firebase Cloud Messaging; on Android 12 and older the app cannot see the phone's notification setting, so there we delete the token when you log out or delete your account, or after 30 days without use.

Measuring our app ads (App Store, Google Play)

When you install our iOS or Android app, the App Store or Google Play can tell us whether one of our own ads led to the installation.

• On iOS, the operating system gives the app an attribution token. We send it to Apple's AdServices service, which returns the IDs of the campaign, ad group, keyword and ad, your country or region, the conversion type, and the date of the ad click or view.
• On Android, we read the install referrer from Google Play: the campaign parameters of the link (source, medium, campaign), Google's click ID (gclid), and the times of the click and the installation.

We store this with a random ID for the installation. If you then create an account in the app, we link it to your account. We use it only to measure which of our own ads bring learners and lead to sign-ups and purchases. We do not use it to track you across other companies' apps or websites. We do not use your device's advertising identifier (IDFA/AAID), and we share nothing with advertisers.

In the EU, the EEA, Switzerland and the United Kingdom, the app asks for your consent first (Art. 6(1)(a) GDPR, § 25(1) TDDDG); without it, nothing is read. You can withdraw your consent at any time in the app's settings. Elsewhere we rely on our legitimate interest in measuring our own advertising (Art. 6(1)(f) GDPR); you can object at any time with the same switch. Only new installations are measured: an app updated from an earlier version reads and sends nothing, and shows neither the question nor the switch.

The attribution token is deleted within 24 hours. The attribution data is deleted after 13 months; the link to your account ends at the latest when your account is deleted.

Other Sharing

• Organization Accounts: Teachers/admins can view student progress and submissions
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In case of merger or acquisition (with notice)
• Anonymized Data: Aggregated statistics that cannot identify you

4. Data Retention

• Account Data: Retained while your account is active; deleted within 90 days of account deletion
• Exam Data: Retained for progress tracking; deleted within 90 days of account deletion
• Speaking Recordings: Deleted automatically 30 days after the exam
• Payment Records: Retained for 8 years (tax and legal compliance)
• Backup Data: May persist up to 90 days after deletion in secure backups
• Server and Security Logs (including IP addresses and requested URLs): Deleted automatically after 30 days at the latest
• Login Attempts (email address, IP address, browser identifier, time and result), which we keep to protect your account from attacks: Deleted automatically after 30 days
• Analytics Data (PostHog and Google Analytics 4, only with your consent): Kept as long as we need it to analyze usage, and deleted automatically when the retention period set in each service ends

Request data deletion anytime by contacting contact@scoreup.pro.

Withdrawals, Cancellations and Abuse Protection

• Withdrawal declarations: When you withdraw from a contract, including through our online withdrawal function, we process your name, your email address, the contract concerned, the date and time of receipt and your IP address in order to carry out the withdrawal and to be able to prove it. Legal basis: Art. 6(1)(c) GDPR in conjunction with Sections 355–357a BGB. We keep these details for three years from receipt (Sections 195, 199 BGB). If you delete your account, we keep a record that is still needed for a refund or proves one, without your name and IP address, until the end of those three years (Art. 17(3)(b) and (e) GDPR); all other records are deleted with the account.
• Usage before a withdrawal: When you withdraw, we record how many exams you had started by then, in order to calculate the proportionate compensation and to protect against misuse. Legal basis: Art. 6(1)(c) GDPR (calculation under Section 357a BGB) and Art. 6(1)(f) GDPR (our legitimate interest in preventing misuse). This figure is stored with the withdrawal declaration and deleted with it.
• Cancellation declarations: When you cancel via “Cancel contracts here”, we process your name, your email address, the kind of cancellation, any reason you give, your IP address and the time of receipt in order to carry out and confirm the cancellation (Section 312k BGB). Legal basis: Art. 6(1)(c) GDPR. We keep these details for three years from receipt (Sections 195, 199 BGB); if you delete your account, we delete them with it.
• Speaking exam starts: If a daily limit on Speaking exams applies to your account, we store your email address, the exam type and the start time of each Speaking exam in order to apply that fair-use limit and to calculate the compensation if you withdraw. Legal basis: Art. 6(1)(b) and (f) GDPR. We delete these entries after 15 days, and earlier if you delete your account.

We process no card data for any of this and derive no card fingerprint from it: payment data is processed by Stripe as described under “Payment Processor” in Section 3.

5. Your Rights and Choices

All Users Can:

• Access: Request a copy of your personal data
• Correct: Update your account information in settings
• Delete: Delete your account and request data removal
• Opt-Out: Unsubscribe from marketing emails anytime

EU/EEA Users (GDPR)

You have additional rights including: data portability, restriction of processing, objection to processing, and the right to lodge a complaint with your local data protection authority.

Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI, the Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

Right to Withdraw Consent

Where we rely on your consent to process personal data (e.g., marketing communications, analytics cookies), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent by adjusting your cookie preferences, unsubscribing from emails, or contacting us at contact@scoreup.pro.

California Users (CCPA)

You have the right to know what data we collect, request deletion, and not be discriminated against for exercising your rights. We do not sell personal information.

6. Children's Privacy

7. International Data Transfers

ScoreUp Pro is operated from Germany (European Union). Your data is primarily stored and processed within the EU. Some service providers, including our AI providers, process data outside the EU under the safeguards described below.

Transfers to Third Countries: Some of our service providers are based in the United States or may process data there: OpenAI, Anthropic, Google (Gemini, Google Analytics, Firebase Cloud Messaging), Apple (Sign in with Apple, App Store purchases, Apple Push Notification service), Stripe, Resend, Cloudflare and TypeSafe. For these transfers, we implement:

• The EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission of July 10, 2023), where the provider is certified under it
• Otherwise, Standard Contractual Clauses (SCCs) approved by the EU Commission
• Data Processing Agreements (DPAs) with all processors
• Technical and organizational security measures

8. Security Measures

• Encryption: All data encrypted in transit (TLS/SSL) and at rest
• Password Protection: Passwords hashed using bcrypt
• Access Controls: Role-based access limits employee data access
• Monitoring: Continuous security monitoring and regular audits

While we implement strong security, no system is 100% secure. Report any security concerns to contact@scoreup.pro.

9. Cookies

We use cookies to keep you signed in and secure and, only with your consent, for analytics. Your theme and language are kept in local storage, not in cookies. See our Cookie Policy for the full list and how to manage them.

10. Changes to This Policy

We may update this Privacy Policy, for example when the law changes or we add features. We announce material changes in advance by email and in the app, and we update the "Last Updated" date. Continued use of the Service is not treated as consent to a change; where the law requires your consent for a new processing, we ask for it separately before that processing starts.

11. Contact Us

Data Controller:

Kadir Korkusuz
ScoreUp Pro
Friedrich-Dessauer-Straße 8
60438 Frankfurt am Main
Germany

Contact for Privacy Inquiries:

Email: contact@scoreup.pro
Phone: +49 157 83508553
Subject: "Privacy Inquiry"
Response Time: 2-3 business days (GDPR requests: within 30 days)

Data Protection Officer: We are not required to appoint a Data Protection Officer (Art. 37 GDPR, § 38 BDSG). For all data protection inquiries, please contact us directly using the information above.