Privacy Policy

This Privacy Policy describes how Cao Hung Nguyen, as the operator of SkillDiscs, processes personal data when you use our website, app, API, Disk features, AI features, payment features, cookie and consent interfaces, or any other services.

SkillDiscs is an AI-assisted learning platform that turns text, PDFs, URLs, images, Office files and YouTube videos into structured learning surfaces called Disks. Users can work with Disks through guided learning, a source view, flashcards, knowledge graphs, AI chat, read-aloud audio, comparison tools and optional voice features.

German and European data protection law comes first for us. The GDPR, the German Federal Data Protection Act (BDSG) and — for cookies, local storage and similar technologies — § 25 TDDDG are the governing rules.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Cao Hung Nguyen

Am Kaisersbusch 6, 42781 Haan, Deutschland

Email: hung@theaiwhisperer.de

As the controller is established in Germany, no separate representative under Art. 27 GDPR is required.

• Account data: email address, username, password and authentication data, Google login data, language, theme, reading preferences, account status and contact preferences.
• Usage data: Disk impressions, clicks, learning progress, quiz answers, chat/note usage, API key usage, credit and reservation events, search and feature events, and technical security events.
• Automatically collected technical data: IP address, browser and device characteristics, operating system, language settings, referring URLs, approximate location derived from IP/network data, timestamps, log data, error reports and similar diagnostic information.
• Imported content: text, URLs, YouTube links, PDFs, images and Office files that you turn into Disks, together with the summaries, questions, graphs, flashcards, audio, images, widgets, embeddings, transcripts and source anchors generated from them.
• Communication data: messages to support, legal complaints, DMCA/UrhDaG notices and optional counter-notifications.
• Payment data: plan, invoice, reservation and Stripe payment events; we do not process full card details ourselves.

We do not deliberately request special categories of personal data under Art. 9 GDPR. Such data may, however, be contained in content you upload. Please upload such data only if you are entitled to do so.

• Performance of a contract, Art. 6(1)(b) GDPR: account, login, Disk creation, learning features, API, voice, storage, credits, payments and support.
• Legitimate interests, Art. 6(1)(f) GDPR: security, abuse prevention, error analysis, product improvement, protection of rights, fraud and copyright review.
• Legal obligations, Art. 6(1)(c) GDPR: tax retention, proof of payment, statutory information, reporting and dispute resolution duties.
• Consent, Art. 6(1)(a) GDPR: optional processing where we ask you separately in advance, such as browser microphone access, Google OAuth, Google Analytics, non-essential cookies, marketing technologies or optional AI/voice features.
• Vital interests, Art. 6(1)(d) GDPR: exceptionally, where processing is necessary to protect a person from harm.

SkillDiscs primarily uses Google Gemini for text generation, embeddings, image/figure description, transcription, TTS and voice features; individual image, voice or fallback features may use OpenAI or legacy AI providers depending on configuration.

Imported content, inputs, outputs and context data may be transmitted to AI providers in order to generate Disks, summaries, explanations, quiz questions, graphs, chats, audio, images, widgets, transcripts and flashcards.

You must not upload personal data of third parties without a legal basis or consent. For content you contribute as a controller in your own right, you remain responsible for the lawfulness of its source and use.

AI output can be inaccurate. Public and API surfaces label AI-generated content as such.

• Supabase: authentication, Postgres database, row-level security and storage.
• Vercel: hosting, serverless functions, delivery and technical logs.
• Google: Google login, Google APIs, Google Gemini, embeddings, TTS, image/figure analysis, voice-related processing and Google Analytics where enabled.
• OpenAI: optional image or voice-related AI features where configured.
• Stripe: payment processing, billing, top-ups, invoice and webhook events.
• Termly: cookie banner, consent management, consent preferences and the DSAR/privacy request form.
• Daily / Pipecat: voice session transport and bot orchestration where voice features are used.
• Crawl4AI and Docling: URL, PDF, image and Office file extraction via the connected parser services.
• YouTube/web services: retrieval of metadata, transcripts or public sources when you import corresponding URLs.

Stripe processes payment data under its own privacy policy: stripe.com/en-de/privacy.

Our use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Some providers may process data outside the EU/EEA. Where necessary, we base such transfers on adequacy decisions, EU standard contractual clauses under Art. 46 GDPR, or another permissible basis under the GDPR.

We provide details of the transfer mechanisms and data processing agreements used in each case on request, insofar as they are not already documented in the providers' own information.

You can sign in via Google where this option is shown. In that case we receive from Google the profile data required for login and account creation, typically email address, name, profile picture and technical authentication data.

We use this data only for authentication, account management, security and the purposes described in this Privacy Policy. Any further processing by Google is governed by Google's own privacy information.

Disks are private by default. Private Disks are visible only to the respective user and are protected by Supabase RLS and server-side access checks.

If you publish a Disk, its title, description, AI summary, key questions, tags, cover, public answers and similar derived content may become publicly accessible and indexable by search engines.

Original text from PDFs, pasted text and private sources is not output on public Disk pages. Public URL/YouTube Disks show only derived AI content and limited source excerpts.

We use cookies and local browser storage where necessary for login, security, language, theme, settings, sessions and credits. The legal basis for accessing necessary information on your device is § 25(2) TDDDG.

We deploy non-essential analytics, marketing or tracking technologies only on the basis of valid consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. That consent can be managed and withdrawn via Termly Consent Preferences.

We may use Google Analytics to measure and improve use of the services. You can additionally disable Google Analytics via Google's browser add-on: tools.google.com/dlpage/gaoptout. Google's own information is available at policies.google.com/privacy.

If your browser or operating system sends Do-Not-Track signals, please note that there is currently no uniform technical standard for implementing such signals. We will honour binding standards as soon as they become applicable to us.

We generally store account, Disk, learning, chat, note, voice, widget and API data for as long as your account exists or the respective Disk/feature is needed.

If you delete a Disk, we remove the Disk and the derived content associated with it, unless statutory retention obligations or the defence of legal claims require otherwise.

We retain payment and tax-relevant records for the statutory retention periods. Security, abuse and law-enforcement logs are retained only for as long as necessary for that purpose.

Where there is no longer any ongoing contractual, legal or legitimate need, we delete or anonymise personal data. Backups may persist for a limited period for security reasons and are not used productively until they are deleted.

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent you have given with effect for the future.

You can exercise your rights by email to hung@theaiwhisperer.de or via the Termly privacy request form: Data Subject Access Request.

We may require proof of identity in order to process a request where this is necessary to protect your account. We handle requests in accordance with applicable data protection laws.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is in particular: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf. An EU-wide overview is available at ec.europa.eu/justice/data-protection/bodies/authorities.

If you are resident in Switzerland, you can also contact the Federal Data Protection and Information Commissioner: edoeb.admin.ch.

SkillDiscs is not directed at children. Under our Terms of Use, users must be at least 16 years old or, if a higher minimum age applies where they live, must have reached that higher age.

If we learn that we have processed a child's personal data without the required consent, we will deactivate the account and delete the data, unless statutory obligations require otherwise.

If you live in a US state with its own privacy rights, you may have additional rights, such as access, correction, deletion, a copy of your data, objection to certain advertising, opt-out of the sale or sharing of personal data, and non-discrimination for exercising your rights.

We do not sell personal data and do not knowingly share it for cross-context behavioural advertising to the extent that this constitutes a sale or sharing under applicable US law. Where Google Analytics or similar technologies are used, you can control this via Termly Consent Preferences and the opt-out options named above.

You can submit requests by email to hung@theaiwhisperer.de or via the Termly DSAR form. We review and verify requests in accordance with applicable law.

No Data Protection Officer has been appointed.

We update this Privacy Policy when the service, the providers used or the legal situation change. The current version is permanently available at /privacy.

This Privacy Policy was revised using content from the Termly Privacy Policy Generator and adapted for SkillDiscs, Germany, the GDPR, the BDSG and the TDDDG.