Privacy Notice

This notice explains how farangDrive collects, uses, retains, and shares personal data in connection with the farangDrive website and learning product. It is written for an English-speaking audience and follows the disclosure expectations of the EU General Data Protection Regulation (GDPR).

Controller

farangDrive is operated by Marcel Christophel, trading as farangDrive, Am Wandrahm 27, 28195 Bremen, Germany.

For privacy questions, write to support@farangdrive.com.

We have not appointed a Data Protection Officer. The controller can be contacted directly at the address above.

Categories of personal data we process

• Account identifier: a deterministic SHA-256 hash of your email address. The plaintext address is used transiently for magic-link delivery, payment-related messages, and refund correspondence.
• Authentication metadata: anonymous-session identifiers, signed user-session identifiers, magic-link tokens, CSRF secrets, IP-address hash, user-agent hash, and sign-in timestamps.
• Practice and study data: answer attempts, mistake-queue entries, mock-test results, readiness snapshots, topic progress, and practice-session state.
• Billing data: Stripe Checkout session ID, payment-intent ID, entitlement records, payment status, refund status, and related finance ledger records. farangDrive does not receive or store card numbers.
• Refund data: the refund request, slip date, user notes, proof image such as a DLT result slip, proof hash, file metadata, and an admin decision audit trail.
• Operational telemetry: event names, timestamps, and a small metadata payload for offer/checkout-intent measurement and failure health, such as `upgrade_offer_view`, `checkout_intent`, `stripe_webhook_failure`, or `scheduled_job_failure`.
• Product feedback: pseudonymous prompt eligibility, display, dismissal, and one-tap answer records linked to an anonymous session and, after sign-in, optionally to the account. Prompts are versioned and contain no free-text field. They may reflect completion of the diagnostic, repeated sign-in visits, a sign-in email that expired, or leaving the upgrade page after a minimum viewing time.
• Help and feedback messages: if you choose to send a question, problem, or feedback through Help, we store your message, where in the app you opened the form, submission time, and a server-derived snapshot of whether your account had paid access at that time. Older submissions may also contain an optional preparation category. Messages can be linked to your current anonymous session and, if you are signed in, your pseudonymous account identifier. An optional email address is stored separately only if you explicitly agree to a reply; sending a message does not add an email address to your account profile. Admin reviewers may add a status, category tags, and a private note. Please avoid including sensitive personal information in your message.
• Optional product analytics: after consent, an immutable first-touch record processes the landing path, external referrer hostname, allowed UTM source, medium, campaign, term, and content values, and a random acquisition visitor ID. A pseudonymous internal link uses the Stripe Checkout session ID, alongside the anonymous-session link, to measure consented cohorts through the diagnostic, checkout, and captured-purchase journey. This acquisition record does not contain a full URL or referrer, unknown query parameters, advertising click IDs, email address, IP address, user agent, consent ID, Stripe payload, payment-intent ID, charge ID, card data, or other payment details.
• Optional Google Analytics 4 within product analytics: after the same separate product-analytics consent, Google receives page views on approved public information pages. The page context contains a canonical public path without a query or fragment, the public page title, and a safe referrer where available. Google's tag also processes pseudonymous client and session IDs, ordinary request and browser/device information, and approximate location derived from the request. No account ID, email, practice answer, checkout or payment identifier, refund detail, advertising click ID, or full URL query is sent as page context. GA4 may automatically generate basic `first_visit`, `session_start`, and `user_engagement` events; enhanced interaction measurement is disabled.
• Optional Google Ads purchase measurement: after separate consent, request and device information available to Google, sanitised context for an eligible paid-search destination or the generic checkout-return page, a safe referrer when available, advertising-click information available to Google, purchase value, currency, and an opaque transaction ID derived from the internal finance-payment row. We do not send Google an email address, FarangDrive user ID, Stripe Checkout session ID, payment-intent ID, charge ID, practice state, or refund data.
• Consent evidence: unlinked consent receipts containing random browser and decision IDs, policy version and content hash, category choices, action/source, server decision time, and expiry. Consent receipts do not contain account, finance, acquisition, URL, IP-address, user-agent, or advertising-click identifiers.
• Admin data: admin sign-in/session data, admin actions, refund decisions, curation uploads, and audit logs.
• Device storage and cookies: see the Cookies and device storage section below.

We do not sell personal data. We do not use remarketing, personalised advertising, enhanced conversions, advertising audiences, or session replay. We do not intentionally collect special-category data under Art. 9 GDPR.

Purposes and legal bases

• Account creation and magic-link sign-in: performance of contract (Art. 6 (1) (b) GDPR).
• Operating the practice, timed-test, road-reference, and paid-access surfaces: performance of contract.
• Processing payments and granting entitlements: performance of contract and legal obligations for accounting and tax records.
• Reviewing and resolving refund requests: performance of contract, legal obligation for transactional records, and legitimate interest in fraud prevention and chargeback defence.
• Security, CSRF protection, abuse prevention, and rate limiting: legitimate interest (Art. 6 (1) (f) GDPR).
• Required operational observability and aggregate product records: legitimate interest in service reliability, security, support, and business health. These records are distinct from optional first-touch acquisition analytics and remain necessary when optional processing is refused.
• Short, contextual product-feedback questions: legitimate interest (Art. 6 (1) (f) GDPR) in identifying avoidable barriers in the learning, sign-in, and purchase journey. Prompts are frequency-limited, can be dismissed, use fixed one-tap answers only, and are not required to use the product.
• Help and feedback messages: legitimate interest (Art. 6 (1) (f) GDPR) in reviewing questions and problems, providing help, understanding usability problems, and improving the app. Submission is optional and messages are reviewed manually. If you separately opt in to a reply, we use your supplied email address for that purpose based on your consent (Art. 6 (1) (a) GDPR); you may withdraw it through the privacy contact.
• Optional product analytics: consent (Art. 6 (1) (a) GDPR and, where applicable, §25 (1) TDDDG), to understand which first entry brought a consented visitor, how consented entry cohorts progress through the product, and how visitors use approved public information pages through Google Analytics 4. Refusal does not limit the product.
• Optional Google Ads purchase measurement: consent (Art. 6 (1) (a) GDPR and, where applicable, §25 (1) TDDDG). This measures whether a Google ad led to a verified purchase. It is not required to buy or use FarangDrive.
• Consent evidence: legal obligation and legitimate interest in demonstrating and administering privacy choices (Art. 6 (1) (c) and (f) GDPR).
• Audit logging of administrative actions: legal obligation where records must be retained and legitimate interest in security and accountability.
• Error monitoring: legitimate interest in detecting and fixing technical failures.

Where a browser-storage access requires consent under the Telecommunications Digital Services Data Protection Act (TDDDG), farangDrive handles that consent separately from the GDPR legal basis.

Recipients and service providers

We use the following service providers under written data-processing agreements where required:

• Stripe Payments Europe, Ltd. - payment processing, checkout, tax calculation where enabled, receipts, disputes, and refunds.
• Resend, Inc. - transactional email delivery for magic links and account, payment, or refund messages.
• Neon, Inc. - managed Postgres database hosting for account, study, billing, refund, observability, and admin records.
• Fly.io, Inc. - application hosting and production runtime infrastructure.
• Tigris Data, Inc. - S3-compatible object storage for generated/media uploads and encrypted database backups where configured.
• Upstash, Inc. - Redis-compatible infrastructure for rate limiting and operational state where configured.
• Functional Software, Inc. d/b/a Sentry - error monitoring and diagnostics where enabled.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland - Google Analytics 4 for consented public-page measurement under Google's applicable data-processing terms. Google Analytics account-level optional sharing is disabled, the property is not linked to Google Ads, Google Signals and advertising personalisation are disabled, and automatic collection of user-provided data is disabled.

We keep this list current. Material changes will be reflected in the document version above.

For optional Google Ads purchase measurement, Google Ireland Limited separately receives the Ads data listed above. Under Google's Controller-Controller Data Protection Terms, FarangDrive and Google act as separate controllers for this Google Ads controller service; this role differs from Google's Analytics service processing described above. Google may combine or use Ads data under its own terms and privacy policy, including data from Google services and partner sites, subject to the user's Google settings and applicable consent. Google Ads purchase measurement is loaded only after the separate `adsMeasurement` choice. Personalised-ad signals, remarketing, audiences, and enhanced conversions remain disabled.

Links to our social media profiles

Our pages link to FarangDrive's own profiles on YouTube, Instagram, and Facebook. These are plain links: we do not embed social media content or load social media scripts, and the links do not send data to these platforms until you open one. The platform then processes your data under its own privacy policy and may recognise you if you are signed in there.

International data transfers

Some providers are based outside the European Economic Area or may process data outside the EEA. Where this happens, transfers are protected through the EU Standard Contractual Clauses, the EU-US Data Privacy Framework where applicable, and supplementary technical and organisational measures such as TLS in transit, access controls, and restricted operator access. Google's published transfer information covers its advertising and analytics products. Google affiliates may process Analytics data in other countries under the applicable data-processing terms and transfer safeguards. For European Google Ads controller data, Google Ireland Limited is the European end controller; Google affiliates may process Ads data in other countries under Google's controller terms and transfer safeguards.

Cookies and device storage

farangDrive uses cookies and device storage for sign-in, security, paid-access state, admin operation, remembering privacy choices, and the optional purposes selected below. Essential storage is not disabled because the site, checkout, security, and consent evidence depend on it.

• fd_anon - signed anonymous-session identifier; HttpOnly; used for anonymous practice state, CSRF binding, and account-progress import.
• fd_user - signed authenticated-user identifier; HttpOnly; used to keep you signed in.
• fd_csrf - CSRF double-submit token for the public/user surface; readable by the client so write requests can attach the token.
• fd_progress_saved - short-lived practice-only flag used once after sign-in to show that progress was saved.
• fd_admin - signed admin-session identifier; HttpOnly; admin surface only.
• fd_admin_csrf - CSRF double-submit token for the admin surface; readable by the client so admin write requests can attach the token.
• fd_admin_nav - admin sidebar preference; admin surface only.
• fd_maintenance_operator - signed HttpOnly, SameSite=Strict operator cookie used only to keep the Maintenance control reachable while public and database-backed traffic is held. It expires after two hours, is accepted only on the Admin settings page and its dedicated control endpoint, and is not issued to learners.
• fd_maintenance_csrf - readable SameSite=Strict double-submit token paired with the Maintenance operator cookie so changing the Maintenance state or banner requires the same browser. It expires with the operator cookie and is not issued to learners.
• fd_consent_preferences - essential localStorage record containing the current policy version, random browser consent ID, random decision ID, category choices, and decision time. It is valid for no more than 365 days. Unknown, malformed, expired, or old-policy records are ignored and optional processing stays off.
• fd_product_cleanup_pending - essential localStorage retry marker written when product analytics is withdrawn. It contains the random browser consent ID and a random nonce, but no consent grant or browsing history. It keeps optional measurement off while FarangDrive retries deletion of the acquisition visitor and its linked records after a failed request or page reload. It is removed after successful cleanup or a newly accepted decision that records product analytics as refused; that refusal also triggers cleanup retries. You can also clear this site's browser storage.
• fd_landing_visitor - optional HttpOnly first-party acquisition visitor identifier, retained for up to 90 days and never refreshed beyond the structured first-touch record's original expiry. It is set only after product-analytics consent and is not sent to Google. Withdrawing `productAnalytics` stops further measurement immediately. FarangDrive deletes the current acquisition visitor record and its pseudonymous session and checkout links before clearing this cookie; a temporary failure may delay this cleanup until a later retry. Linked historical purchases then appear internally as unattributed.
• **Google Analytics `_ga` and `_ga_*` cookies** - optional first-party client and session identifiers created only after `productAnalytics` consent when an approved public content page is measured. The Google tag and site configuration limit them to two months from the first visit, without extending that expiry on later activity. FarangDrive removes controllable first-party Analytics cookies on withdrawal; data already received by Google is not automatically erased.
• **Google Ads `_gcl_*` cookies, including `_gcl_aw` and `_gcl_gs`, and localStorage key `_gcl_ls`** - optional first-party advertising-click markers created by Google's conversion linker after `adsMeasurement` consent. They can retain click information for up to 90 days, subject to browser and Google configuration. FarangDrive removes controllable `_gcl_*` and `_gac_*` markers on withdrawal; browser or Google-side records already transmitted cannot be recalled.
• fd_last_sign_in_email - localStorage marker on your device that helps recognise a returning sign-in surface. It may store the last email address used on that device and whether the user explicitly signed out.
• Practice resume state - FarangDrive does not use localStorage or sessionStorage as a practice-draft owner. Active diagnostic and full-mock progress resumes from server-side mock sessions and accepted attempts; topic practice and mistake drills start fresh after leaving or reloading the flow.
• farangDrive product-feedback trigger storage - a short localStorage queue records that a frequency-limited question may be considered on the next safe in-app surface. It contains a random visit ID and trigger type, not an email address or answer, and is removed after the server processes it or the related action succeeds.

Before `productAnalytics` consent, the first browser-entry candidate exists only in the current page's memory: it is not sent, logged, or written to cookies, browser storage, observability, or the database. After consent, FarangDrive stores at most one immutable structured first touch per acquisition visitor and uses pseudonymous session and checkout links for the consented first-touch section of the single internal Admin Dashboard. Separately, Google Analytics 4 measures approved public information pages through the same product-analytics choice. FarangDrive does not start Analytics measurement on practice, upgrade, account, authentication, checkout, admin, refund, legal, maintenance, unknown, or preview pages, and disables an already-loaded Analytics tag when moving there. It receives no page URL query or fragment. Page views are sent deliberately; enhanced measurement for history changes, scrolling, outbound links, forms, video, and downloads is disabled. Google may still collect basic session and engagement events during consented public-page measurement. Google Analytics does not provide a complete diagnostic-to-purchase funnel or confirm a Google Ads conversion.

FarangDrive uses Google Basic Consent Mode for both Google purposes: before either optional Google purpose is granted, no Google script, iframe, image, fetch, beacon, cookie, local-storage marker, or consent ping is sent. Google Analytics storage is granted only with verified `productAnalytics` consent on an approved public page; Ads storage and user-data consent are granted only with verified `adsMeasurement` consent in its separately approved context. Ads-only consent does not enable Analytics. After Ads consent, the Ads tag may load only on the explicitly approved public paid-search destinations listed in FarangDrive's campaign configuration. It does not load on authentication, practice, upgrade, admin, refund, legal, or maintenance pages. Unknown routes, unexpected URL parameters, fragments, credentials, or unsafe referrers fail closed. On a verified purchase, FarangDrive removes the Stripe Checkout session parameter and fragment from the browser URL before loading or emitting Ads measurement and supplies only the generic `/checkout/return` page context. `ad_personalization` stays denied. The Google Ads conversion action uses a 30-day click-through conversion window. You can review or withdraw either optional purpose through Manage privacy choices in the public footer or on this Privacy page whenever the public site is available. During brief maintenance, optional processing is suspended and these controls are temporarily unavailable; you can send a withdrawal request to support@farangdrive.com. Withdrawal affects future processing and does not make earlier lawful processing or data already sent to Google disappear.

Retention

• Account record: kept while the account is active. On a verified deletion request, local study data is removed and the account link is removed from retained billing or refund records where full deletion is not legally possible. Billing or refund records are retained only where legal, tax, accounting, dispute, or fraud-prevention obligations require it. German bookkeeping records are commonly retained for up to 10 years under §147 AO.
• Magic-link tokens: expire automatically after the configured validity window and are discarded or marked consumed once used.
• Anonymous sessions: the browser cookie expires 30 days after it is issued. Unlinked server-side session, practice, and mock rows are removed after 90 days without activity so the rolling 90-day product report remains complete; signing in links the study history to the account instead.
• Email outbox: the plaintext recipient is used for delivery and bounded retry, then cleared after a successful send or the third failed attempt. Once a row is older than 30 days, the next daily expiry sweep deletes the remaining recipient hash and message payload, plus any row whose final status write failed; during normal daily operation this occurs before the row reaches 31 days.
• Practice and mock data: removed or anonymised on account deletion unless a legal retention reason applies.
• Refund proof images: retained for refund review, dispute handling, and chargeback defence, then deleted when no longer needed under the configured refund-proof deletion workflow.
• Operational telemetry: retained in the active database for operational dashboards and reliability analysis. The daily observability-retention job deletes events once they are older than 365 days.
• Product feedback: once a prompt-eligibility, impression, dismissal, or fixed-answer record is older than 180 days from creation, the next daily sweep deletes it; during normal daily operation this occurs before the record reaches 181 days. Later interactions do not reset the creation-based threshold. When a stale anonymous session is removed, its identifier is detached from any retained feedback record. Account deletion removes feedback still linked to that account.
• Help and feedback messages: the optional contact-address record is deleted in the daily sweep after 90 days. The message, submission context, consent timestamp, and internal review fields are deleted after 180 days from submission. A later status or note change does not extend either period. Account deletion immediately removes messages linked to the account or a currently linked anonymous session. Guest messages are not adopted by an account on later sign-in. Sign-in session rotation or anonymous-session expiry can detach its session link; a detached row remains only until its 180-day limit. Internal/test submissions are excluded from the normal operational inbox.
• Optional product analytics: the landing visitor cookie is retained for up to 90 days. The immutable structured first-touch record and its pseudonymous session and checkout links expire no later than 120 days after the first touch and are removed by the daily acquisition-retention job. The cookie is never refreshed beyond the record's original expiry. This retention is separate from the 365-day operational-observability limit above.
• Google Analytics 4: first-party `_ga` and `_ga_*` cookies expire after two months from the first visit. The Analytics property keeps user-level and event-level data for two months without resetting that period on new activity. Google states that this setting does not shorten all aggregated standard reports; a withdrawal stops future collection and clears controllable browser cookies but does not automatically delete data Google already received. Contact support@farangdrive.com for an access or erasure request concerning Analytics data.
• Google Ads data: FarangDrive does not keep a separate Google-delivery log. Google's retention applies to data it receives; the configured click-through conversion window is 30 days, while controllable click markers may remain for up to 90 days unless withdrawn sooner.
• Consent evidence: the current decision remains reconstructable through its validity. Expired, superseded, and withdrawn consent receipts are retained for three years after expiry or supersession, then removed by the daily retention job. Immutable policy snapshots are deleted only when no retained receipt references them.
• Admin audit logs: retained while needed for security, accountability, legal defence, and operational review.

Deletion from the active database does not immediately remove the same row from isolated disaster-recovery copies. Neon point-in-time recovery may retain an earlier database state for up to 14 days, and encrypted off-site monthly backups may be retained for up to 12 months. These copies are not used for product analytics or normal application access. Before a restored copy can serve customer traffic, the restore procedure runs the active retention sweep again. Incident snapshots are removed after the incident and any documented legal-defence need have ended.

Account deletion

Signed-in users can request account deletion from the Privacy page. The in-app deletion flow removes local study data, removes acquisition first touches and pseudonymous session or checkout links connected to the account, and will, where full deletion is not legally possible, remove the account link from retained billing or refund records. Required finance records remain but become internally unattributed when their acquisition link is removed.

Some payment, refund, accounting, and dispute records may remain where legal, tax, fraud-prevention, chargeback, or legal-defence obligations require retention.

Deletion is not available while an active refund request still needs to be resolved, because farangDrive must keep enough information to complete the refund review.

Your rights

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). You may withdraw either optional consent through Manage privacy choices whenever the public site is available, without affecting the lawfulness of processing before withdrawal. During brief maintenance, optional processing is suspended and you may send the request to the privacy contact below.

For rights requests, write to support@farangdrive.com.

You also have the right to lodge a complaint with a supervisory authority. For the operator's registered location, the competent authority is the Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen. You may also contact the supervisory authority for your habitual residence, workplace, or the place of the alleged infringement.

Automated decision-making

farangDrive does not make decisions that produce legal effects on the user solely by automated means. Refund decisions are reviewed manually.

Changes to this notice

We will update the version and lastVerifiedAt fields above whenever this notice changes. Material changes will be flagged in-app where appropriate.

Contact

Privacy contact: support@farangdrive.com.