Privacy Policy
What data we collect, why, and your rights under the GDPR.
Last updated:
This policy explains what personal data we process when you use univerdev.com and the Docora app, and the rights you have under the GDPR and German data protection law (BDSG).
1. Who is responsible
The controller under Art. 4(7) GDPR is:
Universus Developers – Ibrahim Ali Germany [email protected]
2. Data minimisation
Docora supports local document work. Account services, online AI requests, downloads, payments and any optional online features involve server processing. When an online AI feature is requested, the content needed for that request is sent to the provider used by the feature.
We do not sell account data. The website does not add advertising analytics to ordinary browsing. Optional reward services are separate external services and have their own privacy information.
When you use desktop/mobile sync, library, course, progress and annotation data is encrypted on the device before it is sent to the sync service. Lesson text may be stored encrypted for retrieval on demand. Requested files pass through an encrypted transfer service between devices. This is separate from sending readable content to an AI provider for a task you request.
3. What we process
We process these categories of data, each on the legal basis shown (Art. 6(1) GDPR):
| Purpose | Data | Legal basis |
|---|---|---|
| Account & login | Name, email, declared country, hashed password and verification status | Art. 6(1)(b) — contract |
| Passkey sign-in (optional) | Credential identifier, public key, usage counter, label and registration/last-use dates. We do not receive the fingerprint, face scan or device PIN used to unlock your passkey. | Art. 6(1)(b) — providing your chosen sign-in method |
| Session security | Random device identifier, device label, user-agent, IP and country from a trusted proxy, screen resolution, time zone and session cookies | Art. 6(1)(f) — legitimate interest (preventing account sharing and abuse) |
| Payments | Plan, transaction history, Stripe customer ID. Card details go straight to Stripe and never reach us. | Art. 6(1)(b) — contract; Art. 6(1)(c) — tax retention |
| Online AI features | The content needed for an online AI request, sent to its provider; provider retention and training settings depend on the service and agreement | Art. 6(1)(b) — contract |
| Emails (verification, password reset) | Email address, language | Art. 6(1)(b) — contract |
| Contract declarations and support | Name, confirmation email, contract/order identification, requested date, declaration type and any reason supplied | Art. 6(1)(b) — contract; (c) — statutory duties; (f) — legal claims |
| Fraud prevention after account closure | Canonical mailbox identifier, prior bonus claims and relevant account/audit records | Art. 6(1)(f) — preventing repeated grants and abuse; subject to necessity and your right to object |
| Sync and file transfer between your devices | Encrypted library, course, progress, reading-position, quote, bookmark and note data, and lesson text saved for sync. Encrypted files transfer on request. Account, device and object identifiers, revisions and update times are processed to operate the service. | Art. 6(1)(b) — providing requested sync |
5. Who processes your data
Account data is hosted on our server at Hetzner in Germany. The services below support hosting, security, payments, email and online AI. Their legal roles depend on the service: providers may act as processors under Art. 28 GDPR or as independent controllers for their own legally specified purposes.
Contract declarations submitted through the website are sent to support and a confirmation copy is requested through Resend. If you follow an optional rewards link, processing by that external service is described in its own privacy notice.
| Purpose | Provider | Location and transfer safeguards |
|---|---|---|
| Account server & database | Our own server (Hetzner, Germany) | Germany (EU) |
| Website hosting | Vercel | Depends on the contracted entity and service settings; see international transfers. |
| Payments | Stripe | Depends on the contracted entity and service settings; see international transfers. |
| Bot protection | Cloudflare Turnstile | Depends on the contracted entity and service settings; see international transfers. |
| Rate limiting | Upstash when shared storage is configured; otherwise server memory | Depends on the contracted entity and service settings; see international transfers. |
| Emails | Resend | Depends on the contracted entity and service settings; see international transfers. |
| Online AI (on request) | The provider you pick (e.g. Google, Mistral, Anthropic, OpenAI) | Depends on the contracted entity and service settings; see international transfers. |
6. Transfers outside the EU
Providers may process data outside the EU/EEA. The applicable transfer mechanism depends on the receiving legal entity and service and may include an adequacy decision under Art. 45 GDPR or Standard Contractual Clauses under Art. 46. Contact support for details about a particular transfer and available safeguards.
7. How long we keep it
Account closure permanently disables sign-in and access to its balance. It revokes credentials and sessions and replaces the sign-in address; it is not immediate physical erasure of every database record. Wallet, ledger and audit records are retained, and may contain previous account details and the original email. A canonical mailbox identifier is retained to prevent repeated welcome bonuses and abuse. You can request erasure of information for which there is no applicable lawful retention basis.
Accounting records follow the applicable category and statutory period: generally ten years for books and annual accounts, eight for accounting vouchers and six for business correspondence under § 147 AO and § 257 HGB, subject to extensions and exceptions. Not every billing-related item has the same period.
Website rate-limit entries expire with their configured window (normally one minute; contact and contract-request limits use one hour). Security incident and contract-request records are assessed according to the investigation, handling of the declaration and any applicable legal retention or claim period; there is no promise that every server log is automatically deleted after a short fixed period. Expired in-memory rate entries are removed by periodic cleanup, within an additional minute while the process is active.
Retention of online AI content by a provider depends on that provider, the selected service and contractual settings. This website cannot promise that all providers retain nothing after a response or never use data for training.
8. Your rights
To exercise your rights, email [email protected]:
- Access your personal data (Art. 15)
- Correct inaccurate data (Art. 16)
- Request erasure where the conditions apply (Art. 17)
- Restrict processing (Art. 18)
- Receive portable data where applicable (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent for future processing (Art. 7(3))
You can also complain to a supervisory authority (Art. 77 GDPR) — in Germany, the data protection authority of your federal state.
Closing an account in the dashboard disables access. It is distinct from a request to erase all personal data under Art. 17; some records can remain where a lawful exception applies. Contact support to request an assessment of retained data.
We normally respond within one month. Where the GDPR permits an extension, we will explain it within that month. We may request proportionate information to verify your identity. Requests are generally free; the exceptions in Art. 12(5) GDPR remain applicable.
9. Security
We use TLS for data in transit, password hashing, access restrictions and session checks. Passkeys use public-key verification; biometric data or device PINs used by your authenticator are not sent to us. These measures reduce risk but do not guarantee absolute security.
10. Changes
If we update this policy, the current version is always here with the date above.
Contacting us
When you use the contact form, we process your name, reply email, topic, related product, message, optional app version, request reference and language. The message is sent through Resend to support with your email as the reply-to address. The form does not create a message store in the website database, and application security logs do not include message text.
The legal basis is Art. 6(1)(b) GDPR for enquiries about a contract or steps before entering one, Art. 6(1)(f) for general correspondence, suggestions and collaboration, and Art. 6(1)(c) where handling a rights request is a legal duty. Turnstile, rate limits and a hidden field help prevent misuse; see also cookies and providers.
We retain correspondence as needed to reply and follow up, subject to applicable legal retention or claim periods. We do not promise one fixed deletion period for every message. Avoid sending passwords, sign-in codes or sensitive payment information. You can email [email protected] without using the form.