Legal

Privacy Policy

How we process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and § 25 TDDDG. Last updated: 28 July 2026.

1. Controller (Art. 13(1)(a) GDPR)

The controller responsible for processing your personal data on this website is:

Concrete Dynamics UG (haftungsbeschränkt) — operating the “Avermond” service
Westendstraße 15, 87439 Kempten (Allgäu), Germany
Managing Directors: David Fischer, Philipp Geirhos
Email: support@avermond.com · Phone: +49 1573 4796582

Our contact for data-protection matters is David Fischer, reachable at support@avermond.com (or by post at the address above).

2. What we process, why, and on what legal basis (Art. 13 GDPR)

We only process personal data that is necessary to provide and secure our service. The table below summarises each purpose, the categories of data, and the legal basis under Art. 6(1) GDPR.

Purpose	Data	Legal basis
Providing the website (delivering pages, security, preventing abuse)	IP address, browser/device data, server log data	Art. 6(1)(f) — our legitimate interest in a secure, functioning site
Account & sign-in	Email, first name, password (stored hashed by our auth provider), sign-in session; if you choose Google sign-in, the basic profile data Google supplies for authentication	Art. 6(1)(b) — performance of the contract with you
Delivering the practice service (mock tests, saving progress and results)	Your answers, scores, latest mock summary, progress data	Art. 6(1)(b) — performance of the contract
AI-assisted feedback on writing and speaking (see §3)	Your written responses; the text transcript of your spoken answers	Art. 6(1)(b) — performance of the contract you purchased
Payments	Purchase record, subscription status (card details handled solely by Stripe — we never see them)	Art. 6(1)(b) — contract; Art. 6(1)(c) — legal (tax/accounting) obligations
Service emails (sign-in confirmation, password reset, score report you request)	Email, related result data	Art. 6(1)(b) — performance of the contract
Newsletter / marketing emails	Email, first name, newsletter preference	Art. 6(1)(a) — your consent (opt-in), withdrawable any time
Analytics and conversion measurement (aggregate usage and practice funnel)	Vercel's anonymous page, referrer, country and device summaries; our daily aggregate counts by page, link destination category, mock number, section and event type (no account, visitor or session identifier); and Google Ads conversion measurement. Before permission, Google Consent Mode receives restricted cookieless signals with storage denied; these can include consent state, timestamp, user agent, referrer and coarse ad-click information. After permission, signup/purchase conversions may include browser, device and cookie identifiers. We do not send Google your email or profile data for these conversions, and advertising personalisation remains disabled.	Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent via the analytics banner for optional storage and full measurement

Providing an account and payment data is required to enter into and perform the contract; without it we cannot give you access to the paid service. Consent-based processing (marketing, analytics) is entirely voluntary.

3. How recordings and written responses are processed for AI-assisted feedback

Paid users can receive automated, AI-assisted feedback and an estimated band for the Writing and Speaking sections. Because this involves your own words, we explain it in detail:

Writing. The text you type into a writing task (for example the Email and Academic Discussion tasks) is transmitted to our AI provider, which returns an estimated band and written feedback. The feedback is then saved with your result in your account.
Speaking. Your spoken answers are recorded in your browser and stored locally on your device (in the browser’s IndexedDB). When you submit the Speaking section for scoring, each recording is uploaded and sent to our speech-to-text provider, OpenAI (USA), acting as our processor, to produce a text transcript and basic timing measurements (such as speaking rate and pauses). Only that transcript and those measurements are then sent to our AI-feedback provider; the audio is used solely for transcription and is not used to train any model. Your local copy of the recordings stays on your device until you clear the site’s data in your browser. (Where server-side transcription is unavailable, your browser’s built-in speech recognition is used as a fallback and only the on-device transcript is sent.)
What the AI can and cannot judge. The AI evaluates the content and language of your transcript and, from the measured pacing (speaking rate and pauses), your fluency. It does not assess pronunciation or accent, and its bands are estimates for study only — not official TOEFL® test scores.
AI provider & training. The AI processing is carried out by Anthropic PBC (USA) via its API, acting as our processor. Under Anthropic’s commercial API terms, the inputs and outputs of API requests are not used to train its models. Anthropic retains API data only for a limited period for trust-and-safety and operational purposes and then deletes it.
Legal basis. Art. 6(1)(b) GDPR — this processing is necessary to deliver the AI-assisted feedback you purchased. If you do not want AI processing, simply do not submit a writing/speaking response for scoring; you can still use the rest of the service.

4. Recipients & processors (Art. 13(1)(e) GDPR)

We do not sell your data. We share the minimum necessary with service providers who process data on our behalf under data-processing agreements (Art. 28 GDPR):

Supabase — account authentication & database.
Google — optional Google account sign-in and, only with analytics consent, Google Ads conversion measurement.
Vercel — website hosting and cookie-free, aggregate analytics.
Stripe — payment processing (Stripe is the independent controller of your card data).
Resend — delivery of service and (opted-in) marketing emails.
Anthropic — AI-assisted feedback on your writing/speaking transcripts (see §3).
OpenAI — speech-to-text transcription of your Speaking recordings (see §3).

5. International transfers (Art. 13(1)(f) GDPR)

Some of the providers above are located in, or process data in, countries outside the European Economic Area, including the United States. Where that is the case, transfers are safeguarded by the European Commission’s Standard Contractual Clauses and/or the provider’s certification under the EU–US Data Privacy Framework, together with additional technical and organisational measures. You may request a copy of the relevant safeguards from support@avermond.com.

6. Retention (Art. 13(2)(a) GDPR)

We keep account and practice data for as long as your account exists. If you delete your account or ask us to erase your data, we delete it, except where we must keep certain records (for example invoices and payment records) to comply with statutory retention periods under German tax and commercial law (generally up to 10 years). Newsletter data is kept until you unsubscribe. Our own daily aggregate analytics counters are automatically deleted after 25 months; Vercel analytics is retained under the reporting and retention terms of our configured Vercel plan. Locally stored speaking recordings remain on your own device until you clear them. Audio you submit for Speaking transcription is processed by our speech-to-text provider (OpenAI) and retained by it only transiently for operational and abuse-prevention purposes before deletion; we do not store the audio on our own servers.

7. Cookies & local storage

Essential sign-in and progress storage is always separate from optional analytics. Advertising or analytics storage is enabled only after you choose “Allow analytics”.

Essential storage (always on). To keep you signed in, remember your analytics choice, and save mock progress on your device, we use the browser’s localStorage and IndexedDB (for example your login session, consent choice, practice results and any local speaking recordings). These operations are necessary for the choices or service you request. If you tick “Stay signed in,” your session persists across restarts; otherwise it clears when you close the browser.
Analytics and conversion measurement. Vercel Web Analytics is cookie-free and does not track you across sites. In parallel, our first-party endpoint increments daily aggregate counters for page views, internal-link destination paths, account/checkout milestones, mock-section starts and completions, and full-mock completions. The aggregate counter stores no event-level history, account ID, email, visitor or session ID, IP address, user agent, fingerprint, answer, score, free text, or URL query string. These services run only after you choose “Allow analytics.” The Google Ads base tag uses Consent Mode with advertising and analytics storage denied by default. Before permission (and after “Essential only”), it may send restricted cookieless consent and measurement signals but cannot use optional cookies; after permission it can measure signup and purchase conversions. Enhanced conversions and advertising personalisation are disabled, so we do not send Google your email or profile data for matching. The “Analytics settings” control in every page footer lets you withdraw or change your choice at any time.

8. Your rights (Art. 13(2)(b)–(d) GDPR)

You have the right to: access your data (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future (this does not affect the lawfulness of processing before withdrawal). To exercise any right, email support@avermond.com; we respond within the statutory time limits.

You also have the right to lodge a complaint with a supervisory authority (Art. 77). Our competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany.

9. Automated decision-making

The AI-assisted band estimates and feedback described in §3 are study aids. They do not produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR; no admissions, eligibility or similar decisions are made by us on the basis of them.

10. Changes

We may update this policy as the service evolves or the law changes. The “last updated” date above always reflects the current version.

← Back to Avermond