Privacy Policy

Controller

Cornelius Berger
Brückenaue 14
51491 Overath
Germany
Email: cornelius@cornelius-berger.de

Hosting

This website is hosted by ProWebMa.de. When you visit the site, the host automatically processes server log files (IP address, date and time of access, page requested, browser type, referrer URL). This data is used to ensure reliable operation and security of the website (legal basis: Art. 6(1)(f) GDPR — legitimate interest). A data processing agreement pursuant to Art. 28 GDPR is in place with the host. ProWebMa in turn uses Hetzner Online GmbH (Germany) as its own sub-processor for the underlying server infrastructure.

SSL/TLS Encryption

This site uses SSL/TLS encryption. You can recognise an encrypted connection by „https://“ and the lock icon in your browser bar.

Cookies

Our website uses technically necessary cookies (e.g. for login status), which do not require consent. Cookies for statistics and marketing purposes (see the Google and Meta sections) are only set after your explicit consent via the cookie banner (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

Notwendig

Statistik (nur nach Einwilligung)

Marketing (nur nach Einwilligung)

Cookie-Einstellungen ändern

Registration and User Account

When you register an account, we process your email address, a password of your choosing (stored as a secure hash) and the time of registration. Processing is carried out to provide the user account and perform the contract (Art. 6(1)(b) GDPR). We send a verification email to confirm your email address. You can delete your account at any time; the associated data will then be removed unless statutory retention obligations apply.

Sign-in with Google (OAuth)

You can optionally sign in with your Google account. In that case Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) transmits your email address and name to us. Processing is based on Art. 6(1)(b) GDPR (providing the login). For more information see the Google Privacy Policy.

Spam Protection (CleanTalk)

To protect against abusive registrations we use the anti-spam service CleanTalk (CleanTalk Inc., USA). Your IP address and the data entered during registration are transmitted to CleanTalk for spam checking. The legal basis is our legitimate interest in protecting the website from spam and abuse (Art. 6(1)(f) GDPR); a data processing agreement pursuant to Art. 28 GDPR is in place with CleanTalk. EU standard contractual clauses are in place for any transfer to the USA. More information: CleanTalk Privacy Policy.

IP-Based Location Detection (Price Display)

On the pricing page, we determine an approximate country from your IP address to show you a more realistic “from” price before the final price is calculated by Stripe in the next step. This lookup happens exclusively locally on our server using an offline IP-range database (IP2Location LITE); your IP address is not transmitted to any external geolocation service. The IP address itself is not stored or logged for this purpose, only processed for the duration of the request. The legal basis is our legitimate interest in an accurate price display (Art. 6(1)(f) GDPR).

Payment Processing (Stripe)

We use the payment provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland) for token purchases. The data required for payment processing (name, email address, payment details, billing address) is processed directly by Stripe; we ourselves never receive full payment details. The legal basis is Art. 6(1)(b) GDPR (contract performance). Stripe may transfer data to the USA; EU standard contractual clauses and certification under the EU-US Data Privacy Framework are in place. More information: Stripe Privacy Policy. We retain invoice data in accordance with statutory retention periods.

Google Analytics and Google Ads

If you have given consent via the cookie banner (Art. 6(1)(a) GDPR), we use Google Analytics and Google Ads conversion tracking in the logged-out area of the website (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure reach and optimise advertising campaigns. The logged-in area is not tracked. IP addresses are processed in truncated form. Google may transfer data to the USA (EU standard contractual clauses, EU-US Data Privacy Framework). You can withdraw your consent at any time via the cookie settings. More information: Google Privacy Policy.

Meta Pixel (Facebook/Instagram)

If you have given consent via the cookie banner (Art. 6(1)(a) GDPR), we use the Meta Pixel in the logged-out area (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) to measure the effectiveness of ads on Facebook and Instagram. For the collection and transmission of data via the Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR); Meta makes the essence of that arrangement available at facebook.com/legal/controller_addendum. Meta alone is responsible for its further processing of the data. Meta may transfer data to the USA (EU standard contractual clauses, EU-US Data Privacy Framework). You can withdraw your consent at any time via the cookie settings. More information: Meta Privacy Policy.

Feature Requests and AI-Assisted Processing

The title and description of your feature requests and bug reports are automatically transmitted to the Anthropic API (Anthropic, PBC, USA) for duplicate/spam detection and translation (German/English) (Art. 6(1)(f) GDPR — legitimate interest in a working, multilingual public wishlist). EU standard contractual clauses are in place for the transfer to the USA. The detailed error log excerpt of a bug report is excluded from this and is never sent to Anthropic. Anonymised titles of public feature requests are additionally published as a public roadmap on GitHub (without name or email address). Please do not include personal data of third parties in feature requests.

What Data the Solver Processes

When you use stundenplan-berechnen.de, the following pseudonymised data is transmitted to the CBTT Solver to calculate the timetable:

• Numeric WordPress user IDs (sequential integers without names or contact details)
• Availability data (weekday, time, preference) per user ID
• Configuration parameters (lesson duration, repetition intervals, weekdays)

Names, email addresses and other contact details are not transmitted and never leave your own WordPress installation. The numeric IDs are pseudonymised personal data (Art. 4(5) GDPR): for us they cannot be resolved without the mapping table in your WordPress database, while for you as the controller they remain attributable. We therefore consistently treat them as personal data and enter into a data processing agreement pursuant to Art. 28 GDPR with you when you use the hosted solver.

Self-Hosted Solver vs. SaaS Solver

Self-hosted solver (recommended): If you run the solver on your own server, no third party can link the numeric IDs to real identities. This option offers the highest data protection standard and is recommended for schools with strict privacy requirements.

SaaS solver (hosted by Cornelius Berger at solver.stundenplan-berechnen.de): When using our hosted solver, the numeric IDs are processed on our servers and deleted immediately after calculation. To further minimise risk, we recommend using pseudonyms or first names only as WordPress display names.

When you use the hosted solver, a data processing agreement (DPA) pursuant to Art. 28 GDPR automatically becomes part of the terms of use — unlocking the teacher area requires accepting both the DPA and the General Terms of Use in your account — and covers all data transmitted to the hosted solver; the full text is always available in your account. For solver operation we use Strato AG (VPS hosting for the license server and dispatcher, Germany) and, optionally, Amazon Web Services EMEA SARL (region eu-central-1, Frankfurt) for additional solver compute as sub-processors; the latter is carried out exclusively within the EU. When self-hosting the solver, we do not act as a processor at all — no DPA is required in that case.

Retention Period

Input data and calculation results are automatically deleted from the solver server’s memory at the latest 5 minutes after a job completes. Account data is retained until the account is deleted; invoice and accounting data is subject to statutory retention periods (§ 147 German Fiscal Code, § 257 German Commercial Code).

Processing of Student Data

If you use the plugin to collect availability data from your students, you are the data controller for that processing (Art. 4(7) GDPR); in the case of the hosted solver, we act as your processor (Art. 28 GDPR). You are responsible for the legal basis of the collection — typically this rests on performance of the teaching contract with the parents/guardians (Art. 6(1)(b) GDPR) rather than the students‘ own consent. For minor students, we recommend informing parents/guardians as part of enrolment.

Automated Decision-Making

The solver calculates schedule proposals using a deterministic mathematical method (constraint solver). No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place: the result is a proposal without legal effect, and a responsible person always decides whether to publish it.

Necessity of Providing Data

Providing your email address is required to set up a user account; without it, no account can be created. All other information is voluntary.

Other Processing Activities

If you contact us by email, we process your information to handle your enquiry (Art. 6(1)(b) or (f) GDPR); the email is deleted once it is no longer needed for that purpose. The self-service withdrawal form (email address + invoice number) processes this information solely to identify and process your request (Art. 6(1)(b) GDPR). Like the website host, the solver server (Strato, optionally AWS) also automatically processes technical connection log files when accessed, to ensure reliable and secure operation (Art. 6(1)(f) GDPR).

Right to Object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time to that processing for reasons arising from your particular situation (Art. 21(1) GDPR). We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds. An informal email to cornelius@cornelius-berger.de is sufficient.

Your Rights

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure („right to be forgotten“, Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — logged-in users can also export their data directly in their account via „My Data“
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply email the contact address above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Data Protection Commissioner of North Rhine-Westphalia, Germany.

Currency of this Privacy Policy

Last updated: July 2026. We will update this privacy policy whenever website features or the legal situation change.