Privacy Policy

Sachin Bhati, Egmontstraße 3 A, 10317 Berlin, Germany, hello@thedeasy.de. This address is also the contact for every privacy request below.

• Account and profile (name, email, password or Google sign-in, city, university, home country, stage, languages, interests, profile photo and bio you choose to add): to create and run your account. Basis: contract, Art. 6(1)(b) GDPR.
• Community content (posts, replies, likes, saves, groups, events, listings, attachments): to show it to other members and keep the community safe. Basis: contract and our legitimate interest in moderation, Art. 6(1)(b) and (f).
• Ask DEasy and document check (the questions you type, and files or pasted text you upload): to answer you. Basis: contract, Art. 6(1)(b). Your question and any document text are sent to our AI providers (section 3). We do not keep a transcript of Ask DEasy chats in our database.
• Uploaded documents: the original file is deleted right after it has been read. The extracted text and the explanation stay in your account if you are signed in. Guests' results are deleted after 7 days unless they sign up and keep them. Letters can contain sensitive details, so please upload only what you need.
• Voice input: when you press the microphone, the recording is sent to our transcription provider to turn it into text. Basis: your consent by pressing the button, Art. 6(1)(a). You can stop at any time.
• Location: only if you allow it for "near me" searches, and only to find places. Basis: consent, Art. 6(1)(a).
• Guest session (a random identifier in a cookie and a count of free questions): to give guests a limited free try and to keep their results. Basis: legitimate interest, Art. 6(1)(f).
• Emails (confirmation, password reset, welcome after sign-up): to run your account. Basis: contract.
• Technical logs (IP address, time, requested page, errors) kept by our hosting provider: security and fixing faults. Basis: legitimate interest, Art. 6(1)(f).

We use service providers who process data on our behalf under data-processing agreements:

• Vercel — hosting of the website and API.
• Supabase — sign-in, database and file storage.
• OpenRouter and the language-model provider it routes your request to — to write answers and explain documents. Depending on the model, the provider may log prompts under its own terms.
• Deepgram — speech-to-text for voice input.
• Our email provider — to send account emails.
• Google — only if you choose “Continue with Google”.

To find places and facts we also send search words (not your name or account details) to public data services: OpenStreetMap-based geocoding and map data (Photon, Overpass), Wikipedia and Wikidata, and Reddit search. We do not sell personal data or use it for advertising.

Some providers are based in, or process data in, the United States. Where that happens we rely on an EU adequacy decision (for example the EU–US Data Privacy Framework for certified companies) or the EU standard contractual clauses.

• Account and community data: while your account exists, then deleted on request or when you delete the account, except where the law requires us to keep something.
• Login session: 30 days. Guest cookie: up to 1 year. Guest document results: 7 days.
• Reports and moderation records: as long as needed to handle a legal claim or appeal.

You can ask for access, correction, deletion, restriction, a copy of your data, or object to processing based on our legitimate interest. Where processing relies on consent you can withdraw it at any time. Email hello@thedeasy.de. You may also complain to a data-protection authority, for example the one for your place of residence or for our location.

DEasy is for people aged 16 and over. If you believe a younger person has created an account, tell us and we will delete it.

Connections are encrypted and passwords are stored hashed. No system is perfectly secure, so keep your password private. We will update this page when our practices change and show the date at the top.