Privacy Policy

Version 1.3 – last updated 22 October 2026

Controller

The controller for the processing described here within the meaning of the GDPR is: Enuncy UG (haftungsbeschränkt) Feldstrasse 6 46535 Dinslaken Germany

Account data

To create and operate your account we store your e-mail address, a cryptographic hash of your password (never the password itself), whether your address has been confirmed, the date you registered, and the security settings you enable, such as two-factor authentication. Legal basis is Art. 6 (1) (b) GDPR: without this data we cannot provide you with an account.

Signing in with Google

You can sign in with a Google account instead of a password. If you do, Google tells us your e-mail address and a Google user identifier, and Google learns that you signed in to Enuncy. We never receive your Google password. This only happens once you actively choose the Google button, and the legal basis is Art. 6 (1) (b) GDPR. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may transfer data to Google LLC in the United States. If you prefer not to involve Google, register with an e-mail address and password instead.

Consent records

When you accept the Terms of Service and this Privacy Policy, we store which document you accepted, the version number, and the time of acceptance. We are required to be able to demonstrate consent, so the legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR.

Subscriptions and payments

If you take out a paid subscription, we store the plan and billing interval you chose, its status, the current billing period, and the customer and subscription identifiers that Paddle assigns, so that we can unlock the right content and show your subscription on the Billing page. We do not store your billing address, your payment details, your payments or your invoices. Legal basis is Art. 6 (1) (b) GDPR.

Our order process is conducted by our online reseller Paddle.com Market Limited, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom. Paddle is the Merchant of Record for all our orders. In Paddle's checkout you enter your name, e-mail address, country, address details where required, and your payment details directly with Paddle, which processes them as an independent controller to sell you the subscription, take payments, charge taxes, issue invoices, prevent fraud and meet its legal obligations. Details are in Paddle's privacy notice.

When you open the checkout, we pass your e-mail address and our internal user identifier to Paddle, so that the subscription can be linked to your account. In return, Paddle tells us the status of your subscription and your Paddle customer identifier. Legal basis is Art. 6 (1) (b) GDPR. The European Commission has found that the United Kingdom ensures an adequate level of data protection (Art. 45 GDPR).

Discord

If you connect your Discord account under Account, Discord, Discord tells us your Discord user ID and your username. We store both together with the time you connected and the result of the last role update. We use them only to add you to the Enuncy Discord server, to give you the role that belongs to your plan, and to change or remove that role when your plan changes or ends. We never receive your Discord password, and we do not keep the access token Discord gives us for connecting. Legal basis is Art. 6 (1) (b) GDPR. You can disconnect at any time on the same page; the link is also removed when you delete your account.

The Discord server itself is run by Discord Inc., San Francisco, United States, under its own terms and privacy policy. Discord participates in the EU-U.S. Data Privacy Framework, on which the European Commission's adequacy decision under Art. 45 GDPR is based.

Learning progress

We record which lessons and exercises you have worked through, so that the app can show you where you left off and unlock the content your plan includes. This data is tied to your account, is not used to profile you, and is not passed on to anyone. Legal basis is Art. 6 (1) (b) GDPR.

Server log data

Our server records the usual technical data for each request: IP address, date and time, the resource requested, the response status, the referring page and your browser identification. We need this to deliver the site, to investigate faults and to defend against attacks. Legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is a working and secure service.

Cookies

We only use cookies that the service needs to function: a session cookie that keeps you signed in, a token that protects forms against cross-site request forgery, a short-lived cookie that secures connecting your Discord account, a short-lived cookie that shows you the result of an account action (for example a changed password), and cookies that remember your display settings (the light or dark theme, and whether the mouth animations use the colors of the style images). There is no advertising, no analytics, no tracking pixel and no third-party statistics tool on this site. Because these entries are strictly necessary to provide the service you requested, they do not require consent under section 25 (2) TDDDG. You can delete them at any time in your browser settings, but you will then be signed out.

Fonts and external content

The typeface used on this site is delivered from our own server. Apart from the payment window described below, no fonts, scripts or other resources are loaded from third-party servers, so your IP address is not passed to any content delivery network when you open a page.

When you open Paddle's payment window, on the checkout page or through a payment link from Paddle, your browser loads Paddle's checkout script from Paddle's servers (cdn.paddle.com). Paddle then receives your IP address and the technical data your browser sends with every request. This only happens at that moment and only on those pages. Legal basis is Art. 6 (1) (b) GDPR.

Processors

We use the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

Hosting is provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The server that runs Enuncy and our encrypted backups are located in data centres in Germany.

E-mail delivery for confirmation and cancellation messages is also provided by STRATO GmbH.

Transfers outside the EU

The server that runs Enuncy, its database and our backups are located in Germany. Your data leaves the European Union only if you use a feature that involves a provider outside it, each described above: taking out a subscription, where Paddle in the United Kingdom receives your data; signing in with Google, where Google may transfer data to Google LLC in the United States; and connecting your Discord account to Discord Inc. in the United States. For the United Kingdom, the European Commission has found an adequate level of data protection (Art. 45 GDPR). Google and Discord participate in the EU-U.S. Data Privacy Framework, on which the Commission's adequacy decision under Art. 45 GDPR is based.

How long we keep your data

Account data, learning progress, subscription records and the Discord link are kept for as long as your account exists and are deleted when you delete it. We keep no invoices or payment records: Paddle retains them as the seller under its own statutory obligations. Consent records are kept for as long as the underlying contractual relationship exists and afterwards for the duration of the statutory limitation period, because they are our proof that consent was given. Server logs are deleted automatically after 14 days unless a specific incident requires us to keep them longer.

Deleting your account

You can delete your account yourself under Account, Personal data. If a paid subscription is still running you have to cancel it first. Deletion is confirmed by e-mail and, once you follow that link, your account and the personal data tied to it are removed and all your sessions are ended. Invoices and payment records are held by Paddle, not by us, and are not affected.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Nothing on this site decides anything about you without a person being involved.

Security

We protect your data with appropriate technical and organisational measures. Every connection to Enuncy is encrypted, passwords are stored only as salted cryptographic hashes, and access to the server and the database is limited to the people who run Enuncy.

Your rights

You have the right to obtain information about the data we hold on you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to have data erased (Art. 17 GDPR), to have processing restricted (Art. 18 GDPR), and to receive your data in a portable format (Art. 20 GDPR). You may object at any time to processing based on our legitimate interest (Art. 21 GDPR). Where processing rests on your consent, you may withdraw it at any time with effect for the future, which does not affect what was lawful before.

To exercise any of these rights, write to Contact@Enuncy.com. We answer within one month (Art. 12 (3) GDPR). You can also export or delete your data yourself under Account, Personal data.

Right to complain

If you believe we are handling your data unlawfully, you can complain to a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany. You may also turn to the supervisory authority where you live.

Changes to this policy

We update this policy when the service changes or the legal situation requires it. If a change is material, we will ask you to accept the new version the next time you sign in. The version and date at the top of this page always tell you which text is currently in force.