Privacy Policy

Maksim Grachev, Gleisstraße 20, 04229 Leipzig, Germany. Contact: help@stipendium.berlin.

When you visit the site, the hosting infrastructure may process technical request data such as IP address, timestamp, requested URL, browser information and error logs. This is necessary to deliver and secure the service and to diagnose faults. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in operating a secure service).

Payments are processed by Stripe. Stripe receives the payment and contact information you enter at checkout. We use the checkout session identifier, payment status and email address to verify your purchase, grant access and provide customer support. The legal bases are Article 6(1)(b) GDPR (performance of the purchase contract) and Article 6(1)(c) GDPR where transaction records must be retained by law.

Learn more in the Stripe Privacy Policy.

If you request an access link, your purchase email is sent to Resend solely to deliver the transactional message. We do not use access emails for marketing. Learn more in the Resend Privacy Policy.

If you separately request funding alerts, we send a confirmation email and add your email address to the BSS Navigator funding-alert list only after you confirm it. The legal basis is Article 6(1)(a) GDPR (consent). Resend stores the contact and delivers these updates. You can withdraw consent at any time using the unsubscribe link in an alert or by emailing help@stipendium.berlin. Withdrawing consent does not affect earlier lawful processing.

After a verified purchase, BSS Navigator stores a signed, HttpOnly access cookie for up to 180 days. It is strictly necessary to remember that your browser has access to the paid database. It is not used for advertising or cross-site tracking. You can delete it in your browser and restore access using the email from your purchase.

We use PostHog Cloud EU to understand which pages and acquisition channels are useful and whether visitors start checkout or use Personal Match. PostHog is configured in cookieless mode: it does not store cookies, local storage or session storage, and we have disabled session replay, automatic interaction capture and user profiles. We send only page views and a small set of explicitly named product events; email addresses and questionnaire answers are not included. Query strings are removed from URLs before analytics events are sent.

PostHog may process technical request data to produce privacy-preserving aggregate analytics. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in measuring and improving the service). We also respect supported browser Do Not Track signals. Learn more in the PostHog Privacy Policy.

We use Lovable for hosting and deployment, Stripe for payment processing, Resend for transactional and consented funding-alert email, and PostHog Cloud EU for cookieless analytics. These providers may process data in countries outside the EEA subject to the safeguards described in their respective privacy documentation.

Purchase records are retained for the period required by applicable tax and commercial law. Funding-alert emails are retained until you unsubscribe or request deletion. Support correspondence is retained only as long as needed to resolve the request and document relevant transactions. Technical logs are retained according to the hosting provider's operational and security settings.

Subject to the conditions of the GDPR, you may request access, correction, deletion, restriction, portability or object to processing. You may also lodge a complaint with a competent data protection authority. Contact us at help@stipendium.berlin to exercise your rights.