Privacy Policy

1. Introduction

This privacy policy explains which personal data we process when you use SotiLearn, why we do so and what rights you have. SotiLearn works without an account. We only process data that we need to run the website, and data you choose to send us.

2. Controller

3. Legal Bases

Under the GDPR, we process your data on the following legal bases:

• Legitimate interest (Art. 6(1)(f) GDPR) for delivering the website securely, for anonymous usage statistics and for protecting our forms against spam.
• Contract (Art. 6(1)(b) GDPR) for storing and showing tours you create and share, as described in our terms of use.
• Consent (Art. 6(1)(a) GDPR) if you voluntarily give us your email address with an error report. You can withdraw it at any time.

4. Visiting Our Website

When you visit our website, your browser automatically sends technical data to our server: IP address, date and time, requested page, referring website, browser and operating system. We need this data to deliver the website and keep it secure. It is stored in log files, not combined with other data and deleted after a short time. The website runs on a server of Hetzner Online GmbH (Gunzenhausen, Germany), which processes this data on our behalf.

Fonts are delivered from our own server, so your browser does not connect to Google or other font services. The simulations run in an isolated frame and load nothing from third parties.

5. Cookies and Local Storage

We set one technically necessary cookie, sotilearn-lang. It remembers the language you chose, so that the website opens in it next time, and is stored for one year. It contains nothing but the language code. If you switch between light and dark mode, your choice is saved in your browser's local storage (sotilearn-theme) and never sent to us. We do not use cookies for analytics or advertising.

6. Usage Statistics (Matomo)

We use the open-source software Matomo to see which pages and features are used, so we can improve SotiLearn. Matomo runs on our own server, so no data is passed on to third parties. It sets no cookies, IP addresses are anonymised, and the data is not combined with other data. We only record which pages and features are used, never the content you type in.

Data processed: anonymised IP address, visited pages, time spent, browser, operating system, device type and referring website.

7. Error Reports

If you report an error, we store your message, the language, the simulation and tour step you were on, the state of the simulation (settings and camera) and a screenshot of the simulation. Your email address is optional; we only use it to ask about or reply to your report. We use this data only to fix errors. Reports are stored in our database on our own server in Germany (self-hosted Supabase).

8. Tours by Teachers

If you create a tour and share it, we store the tour (title, text, steps and simulation settings) and the time it was created or changed. Anyone with the share link can open it. Editing needs the secret edit link; we only store a one-way converted form (hash) of it. We store no name or email address with a tour, so please do not put personal data of yourself or your students into it. Tours are stored in our database on our own server in Germany.

9. Spam Protection (Cloudflare Turnstile)

To protect error reports and tour sharing against automated spam, we use Cloudflare Turnstile. It checks in the background whether a request comes from a person, without advertising cookies. For this, your browser connects to Cloudflare, which processes your IP address and technical browser data. Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework. More information: https://www.cloudflare.com/privacypolicy/

10. Contact

If you contact us by email, we use your details (name, email address, message) only to answer your request and delete them afterwards, unless we are legally required to keep them.

11. Data Retention

Server log files are deleted after a short time. Error reports are deleted once the error has been dealt with, at the latest after two years. Shared tours stay online until you ask us to delete them or we remove them because they break our terms of use.

12. Your Rights

You have the right to:

• access the data we hold about you
• have incorrect data corrected
• have your data deleted
• restrict the processing of your data
• receive your data in a portable format
• object to processing based on legitimate interest
• withdraw your consent at any time

Just send an email to office@soticek.com. You can also lodge a complaint with a supervisory authority, in Austria the Datenschutzbehörde (Barichgasse 40–42, 1030 Vienna).

13. Changes

We update this privacy policy when our services or legal requirements change. The current version is always available on this page.