Legal
How we process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and § 25 TDDDG. Last updated: 13 August 2026.
The controller responsible for processing your personal data on this website is:
Concrete Dynamics UG (haftungsbeschränkt) — operating the “Avermond” service
Westendstraße 15, 87439 Kempten (Allgäu), Germany
Managing Directors: David Fischer, Philipp Geirhos
Email: support@avermond.com · Phone: +49 1573 4796582
Our contact for data-protection matters is David Fischer, reachable at support@avermond.com (or by post at the address above).
We only process personal data that is necessary to provide and secure our service. The table below summarises each purpose, the categories of data, and the legal basis under Art. 6(1) GDPR.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the website (delivering pages, security, preventing abuse) | IP address, browser/device data, server log data | Art. 6(1)(f) — our legitimate interest in a secure, functioning site |
| Account & sign-in | Email, first name, password (stored hashed by our auth provider), sign-in session; if you choose Google sign-in, the basic profile data Google supplies for authentication | Art. 6(1)(b) — performance of the contract with you |
| Delivering the practice service (mock tests, saving progress and results) | Your answers, scores, latest mock summary, progress data | Art. 6(1)(b) — performance of the contract |
| Discord community practice (optional quizzes, points, streaks and leaderboard) | Your Discord user ID, question ID, whether your answer was correct, points, streak and activity dates. We do not store your Discord messages, profile or email for this feature. | Art. 6(1)(b) — providing the community feature you request |
| AI-assisted feedback on writing and speaking (see §3) | Your written responses; the text transcript of your spoken answers | Art. 6(1)(b) — performance of the contract you purchased |
| Payments | Checkout and purchase record, amount, currency, subscription status, applied price variant and a coarse regional group used to validate a regional offer (card details handled solely by Stripe — we never see them) | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal (tax/accounting) obligations |
| Service emails (sign-in confirmation, password reset, score report you request, notice that a Pass you bought is about to expire) | Email and related result data. If you ask us to email a score report, we use that address only to send the requested report. Promotional content is included only if you have separately opted into marketing. | Art. 6(1)(b) — performance of the contract |
| Referral programme (crediting Pass days when someone you referred buys) | Your referral link identifier, and a record linking the referring account to the referred purchase (including the related Stripe identifiers). Your account identifier is passed through the referral link and stored with the payment. | Art. 6(1)(b) — performance of the referral terms you take part in; Art. 6(1)(f) — our legitimate interest in preventing abuse of the programme |
| Send-time targeting (sending emails at a sensible local hour) | Your time zone, read automatically from your browser’s settings and stored on your profile | Art. 6(1)(f) — our legitimate interest in not emailing you in the middle of the night; for marketing emails it forms part of the consent-based processing below |
| Newsletter / marketing emails | Email, first name, newsletter preference | Art. 6(1)(a) — your consent (opt-in), withdrawable any time |
| Review invitations (a one-off invitation to review Avermond on Trustpilot) | Your email address and first name, passed to Trustpilot so that it can send you the invitation. We select who is invited on the basis of practice you have completed — never on how you have rated us or on anything you have said to us — and we invite each person only once. We are not told what you write, and your review is not linked to your account. | Art. 6(1)(a) — your consent (we invite only people who opted in to our emails), withdrawable any time |
| Analytics and conversion measurement (aggregate usage and practice funnel) | Vercel's anonymous page, referrer, country and device summaries; our daily aggregate counts by page, link destination category, mock number, section, experiment variant and event type (no account, visitor or session identifier); and Google Ads conversion measurement. Before permission, Google Consent Mode receives restricted cookieless signals with storage denied; these can include consent state, timestamp, user agent, referrer and coarse ad-click information. After permission, signup/purchase conversions may include browser, device and cookie identifiers. We do not send Google your email or profile data for these conversions, and advertising personalisation remains disabled. | Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent via the analytics banner for optional storage and full measurement |
Providing an account and payment data is required to enter into and perform the contract; without it we cannot give you access to the paid service. Consent-based processing (marketing, analytics) is entirely voluntary.
Paid users can receive automated, AI-assisted feedback and an estimated band for the Writing and Speaking sections. Because this involves your own words, we explain it in detail:
We do not sell your data. We share the minimum necessary with service providers who process data on our behalf under data-processing agreements (Art. 28 GDPR):
Several of the providers above are located in, or process data in, countries outside the European Economic Area, including the United States — in particular Supabase, Vercel, Stripe, Resend, Anthropic, OpenAI, Google, Discord and jsDelivr, and, where your browser’s built-in speech recognition is used (see §3), your browser vendor. Where that is the case, transfers are safeguarded by the European Commission’s Standard Contractual Clauses and/or the provider’s certification under the EU–US Data Privacy Framework, together with additional technical and organisational measures. You may request a copy of the relevant safeguards from support@avermond.com.
We keep account and practice data for as long as your account exists. If you delete your account or ask us to erase your data, we delete it, except where we must keep certain records (for example invoices and payment records) to comply with statutory retention periods under German tax and commercial law (generally up to 10 years). Discord community-practice progress is deleted immediately when you use /delete-progress, or automatically after 12 months without activity. Newsletter data is kept until you unsubscribe. Our own daily aggregate analytics counters are automatically deleted after 25 months; Vercel analytics is retained under the reporting and retention terms of our configured Vercel plan. Locally stored speaking recordings remain on your own device until you clear them. Audio you submit for Speaking transcription is processed by our speech-to-text provider (OpenAI) and retained by it only transiently for operational and abuse-prevention purposes before deletion; we do not store the audio on our own servers.
Essential sign-in and progress storage is always separate from optional analytics. Advertising or analytics storage is enabled only after you choose “Allow analytics”.
You have the right to: access your data (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future (this does not affect the lawfulness of processing before withdrawal). To exercise any right, email support@avermond.com; we respond within the statutory time limits.
You also have the right to lodge a complaint with a supervisory authority (Art. 77). Our competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany.
The AI-assisted band estimates and feedback described in §3 are study aids. They do not produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR; no admissions, eligibility or similar decisions are made by us on the basis of them.
We may update this policy as the service evolves or the law changes. The “last updated” date above always reflects the current version.
See also our Legal Notice / Impressum, Terms of Service and Cancellation & Refund Policy.
