Privacy policy

Who is responsible

The controller responsible for processing your personal data is Kristina Čulić Gajić, sole proprietor trading as MANIFESTA WW:

MANIFESTA WW, Kristina Čulić Gajić s.p.
Sime Miljuša 72
78000 Banja Luka
Bosnia and Herzegovina
JIB: 4512102040002
Email: support@wondergerman.co

WonderGerman is a brand of her sole proprietorship (samostalni preduzetnik), registered in Banja Luka. In this policy, “we” and “us” refer to her and her business.

Kristina runs WonderGerman from Bosnia and Herzegovina, which is outside the European Union. Because the app is offered to people in the EU, she applies the EU General Data Protection Regulation (GDPR) to all users.

Representative in the EU. Because Kristina’s business is based outside the EU, she has appointed a representative in the EU under Art. 27 GDPR. You and data protection authorities can also contact the representative about anything concerning the processing of your personal data:

Dragana Nenadic
Christel-Küpper-Platz 17
81379 München
Germany
Email: eu-representative@wondergerman.co

What data we process and why

Your account

To create your account we process your email address and password. Sign-in is handled by Firebase Authentication; the app itself never stores your password. When you sign in, Firebase Authentication also processes technical data such as your IP address and device information to protect accounts against misuse.

You choose a display name, which other course participants can see in chats, and your preferred language (German, Serbian or English), which you pick on the sign-in screens.

Kristina can also create an account for you, for example if you sign up with her directly; she then sets up your login with your email address. Either way, you confirm yourself that you are 16 or older: when you register, or the first time you sign in to an account Kristina created. We store when and how you confirmed it.

You accept our Terms of Use when you register or, if your account was created earlier or on your behalf, before your first post or voice message. We store the time of acceptance.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); for storing when and how you confirmed your age and when you accepted the Terms of Use, our legitimate interest in being able to demonstrate compliance (Art. 6(1)(f) GDPR).

Course access

Your account stores your subscription tier or program and which courses you can access. When your payment for a program has been received, access is unlocked automatically; a refund or a chargeback ends it again (after an early withdrawal from the one-to-one lessons, the course continues as Self-Study). Kristina can also set access manually. The Android app contains no purchases and processes no payment data.

Legal basis: Art. 6(1)(b) GDPR.

Purchases and payments

From 1 January 2027, programs can be bought in the web app. The seller is MANIFESTA WW, Kristina Čulić Gajić s.p. You pay with PayPal or by bank transfer.

• PayPal processes your payment as an independent controller under its own privacy statement. We receive your name, email address, the amount and the country of your PayPal account.
• For a bank transfer, we receive the sender’s name and account details from our bank statement.

For each purchase we store the program, amount, currency, status (pending, paid, refunded or charged back), date, the PayPal transaction ID or your payment reference, your confirmation that you are 18 or older, your consent to immediate access (see the withdrawal information) with its time, and which version of our terms we sent you. EU VAT rules also require us to keep evidence of your country, such as the country of your PayPal account or of your bank.

Order confirmations and invoices, with our terms and withdrawal information attached as a PDF, are sent by email through Google Workspace.

Other services arranged directly with Kristina, such as the ebook or lessons outside the app, can also be paid in cash.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR); keeping invoices, tax records and the evidence of your country to meet our legal obligations under EU VAT rules (the OSS scheme) and tax and commercial law (Art. 6(1)(c) GDPR); and our legitimate interest in being able to show that purchases are made by adults and that the required consents were given (Art. 6(1)(f) GDPR).

Your learning data

We store your lesson progress, completed days, your daily streak, your exercise answers, notes and vocabulary entries, so that your progress is saved and shown back to you.

Legal basis: Art. 6(1)(b) GDPR.

Notes and feedback

Kristina can store a private name for you, visible only to her, so that she recognises you if you change your display name. If you give weekly feedback (ratings and comments), Kristina sees it together with your name and uses it to improve the course.

Legal basis: our legitimate interest in running and improving the course (Art. 6(1)(f) GDPR).

Group chat

Each course has a group chat. Text, photos, videos, voice recordings and files that you post there, including your answers to lesson tasks (“chat assignments”), are visible to everyone who has access to that course, together with your display name. Please keep this in mind before sharing anything personal.

You can edit or delete your own messages. A deleted message is replaced by a “Nachricht gelöscht” (message deleted) placeholder. Kristina can delete group-chat messages to moderate the chat.

Legal basis: Art. 6(1)(b) GDPR.

Direct messages

You can exchange direct messages with another user, containing the same types of content. They are visible only to the two participants. You can turn off direct messages from other students; Kristina can always message you. You can also mute a conversation or remove it from your own list: the other person keeps the history, and the conversation reappears if either of you writes again. Your public profile shows only your display name and whether you accept direct messages; your email address is never shown to other students.

Legal basis: Art. 6(1)(b) GDPR.

Reports and blocking

You can report a group-chat message, a direct message or a person. A report stores your account ID, the reported person’s account ID and display name, the reason you chose, the time, and whether it concerns a group-chat message, a direct message or a person. For a reported message, it also stores a copy of that one message’s text (up to 2,000 characters), or only its type if it was a photo, voice message or other file.

Only Kristina can read reports. She receives a notification with the reason and the reported person’s display name. If a direct message is reported, she sees only that single message, copied into the report, never the rest of the conversation. She either deletes the reported message, which then shows as “Nachricht gelöscht” for everyone and has any attached file deleted, or dismisses the report. The report is deleted as soon as she has dealt with it.

You can block another student. We store who blocked whom and when, until the block is lifted. The blocked person’s group-chat messages are then hidden from you and you are no longer notified about them; they are not deleted, and everyone else still sees them. Direct messages between you are blocked in both directions; the blocked person only sees a neutral notice that they cannot message you. Kristina cannot be blocked or reported, because she runs and moderates the course.

Legal basis: performance of our contract with you, including our Terms of Use (Art. 6(1)(b) GDPR), and our legitimate interest in a safe learning environment (Art. 6(1)(f) GDPR).

1:1 sessions (Premium)

When you book a session, we store your name, email address, the session time and its status. Your account also records how many sessions you have; Kristina manages this number.

Each session takes place on Zoom. A Zoom meeting is created on Kristina’s Zoom account for every booking; the meeting title does not contain your name. You join in the Zoom app. When you do, Zoom processes data such as the name you join with and your device and connection data under its own privacy statement, and that name appears in Kristina’s Zoom meeting reports.

Legal basis: Art. 6(1)(b) GDPR.

Notifications

The Android app sends push notifications through Firebase Cloud Messaging: new chat messages, direct messages, booking confirmations and cancellations, reminders 24 hours and 1 hour before a session, and an optional daily learning reminder, sent at a time you choose and only on days you haven’t studied yet. To deliver them, we store your device’s push token on your user record, and remove it when you sign out or delete your account.

Notifications may show a preview of the message text and the sender’s name, which can be visible on your lock screen depending on your device settings. You can switch off each type of notification individually in the app, or all of them in your device settings.

Legal basis: Art. 6(1)(b) GDPR; for the optional daily reminder, which stays off until you switch it on, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching it off again.

Security checks

The Android app uses Firebase App Check with Google Play Integrity. When the app contacts our servers, this verifies that the request comes from a genuine copy of the app on a genuine device. For this, Google processes information about your device and your app installation.

Legal basis: our legitimate interest in protecting the service and your data from misuse (Art. 6(1)(f) GDPR).

Lesson videos and external content

Lesson videos are streamed from Bunny.net. To play a video, your device connects to Bunny.net’s servers, which process your IP address and technical request data.

Some lessons embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com). When such a lesson opens, your device connects to YouTube’s servers, which receive your IP address and device information. YouTube only stores information about you once you start the video. Google processes this data under its own privacy policy.

Some exercises link to the website of the publisher Hueber, which opens in an in-app browser. Hueber’s own privacy policy applies there.

Legal basis: Art. 6(1)(b) GDPR, to deliver your lessons.

The web app (app.wondergerman.co)

The web app offers the same courses in your browser. It loads Firebase’s program files from Google’s servers (www.gstatic.com); its fonts and all other files come from our own hosting. PayPal is only contacted when you select PayPal as your payment method in the shop. YouTube videos load only after you click to play them. Zoom sessions and Hueber exercises open in a new tab.

To keep you signed in, Firebase stores your sign-in session in your browser’s IndexedDB; signing out removes it. WonderGerman itself sets no cookies; PayPal may use its own cookies in its payment window. The web app has no push notifications, no App Check or reCAPTCHA, no service worker and no analytics.

Legal basis: Art. 6(1)(b) GDPR; storing the sign-in session is strictly necessary for the service you request.

Email

If you write to us, we process your email address and your message in order to reply.

Legal basis: Art. 6(1)(b) GDPR where your message concerns your account or a course, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

This website

This website uses no cookies, no analytics and no tracking, and loads nothing from third parties: its fonts are hosted on the site itself. When you visit, our hosting provider, Firebase Hosting (Google), processes technical data such as your IP address, browser type and the page requested, in order to deliver the page and protect it against attacks.

Legal basis: Art. 6(1)(f) GDPR.

Who can see your data

Other students see your display name, whether you accept direct messages, and what you post in your course’s group chat. They never see your email address.

Kristina, as administrator, sees each account’s email address, display name, subscription tier, course access and 1:1 session usage, so that she can manage access. She can delete group-chat messages and remove a student’s access to a course, and she is the only person who can read reports. In the app she has no access to direct messages between other users; if one is reported, she sees only that single message.

Technical access. As the people who run the underlying Firebase project, Kristina and the developer who maintains the app for her can technically reach stored data through Google’s administration console. This access is used only to operate and maintain the service and to help you when you ask for support.

Beyond that, the following providers process data:

• Our EU representative (see section 1): receives messages sent to her and keeps a copy of our records of processing.
• Google Workspace: our business email (Gmail) for all @wondergerman.co addresses, including order confirmations and invoices. Google acts as our processor.
• Google (Firebase): Authentication, Firestore database, Cloud Storage, Cloud Functions, Cloud Messaging, App Check, and hosting of this website. Google acts as our processor.
• Google Play Integrity: verification of the app and device.
• Zoom Video Communications: video sessions for 1:1 lessons.
• Bunny.net (BunnyWay d.o.o., Slovenia): hosting and streaming of lesson videos. Acts as our processor.
• PayPal: if you pay with PayPal. PayPal acts as an independent controller.
• Tax authorities: where the law requires it, for example for VAT returns under the EU OSS scheme.
• Banks: if you pay by bank transfer.
• YouTube (Google): when a lesson with an embedded YouTube video opens (privacy-enhanced mode).
• Hueber Verlag: only when you open one of their pages from an exercise.

We do not use advertising, advertising identifiers or ad-tracking tools, and we do not sell or rent your data to anyone.

Where your data is stored

• Firestore database (account, progress, notes, chat text, bookings): eur3: European Union (Belgium and the Netherlands)
• Cloud Storage (photos, videos, voice recordings and files you upload): us-central1: United States (Iowa)
• Cloud Functions: europe-west1 (Belgium)

Files you upload are therefore stored in the United States. Other Firebase services, such as Authentication and Cloud Messaging, are operated by Google globally, and Zoom may also process data in the United States. These transfers are based on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses.

Kristina accesses the data from Bosnia and Herzegovina in order to run the service.

How long we keep data

• Account, profile, learning data and uploads are kept for as long as your account exists; nothing is deleted automatically after a set time. When you delete your account, they are deleted as described on our account deletion page.
• Group-chat messages: when you delete your account, their content is erased and only a “message deleted” placeholder remains.
• Past 1:1 bookings are anonymised when you delete your account; Kristina keeps the anonymised session history.
• Emails are kept as long as needed to handle your request, unless the law requires longer retention.
• Reports are kept until Kristina has dealt with them, and blocks until they are lifted. When you delete your account, every block involving you (in either direction), every report you filed and every report about you are deleted too.
• Invoices and tax records, including the evidence of your country, are kept for 10 years, as EU VAT (OSS) rules and tax and commercial law require, also after you delete your account. They are then no longer linked to your account and are used only to meet these obligations.
• Backups: the database has no scheduled backups, and Cloud Storage keeps no copies of deleted files. Once data is deleted, we keep no copy of it.

Zoom keeps its own records of past meetings, such as the name you joined with, under its own retention rules.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have incorrect data corrected (Art. 16);
• have your data erased (Art. 17): see Delete account;
• restrict processing (Art. 18);
• receive your data in a portable format (data portability, Art. 20);
• object to processing based on our legitimate interests (Art. 21);
• withdraw your consent at any time, with effect for the future (Art. 7(3)).

To exercise any of these rights, email support@wondergerman.co. We reply within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. You can also contact the Personal Data Protection Agency of Bosnia and Herzegovina, where Kristina is based.

Minimum age

The app is intended for users aged 16 and older. If you are under 18, please make sure a parent or guardian agrees to your use of the app. Purchases are only possible from the age of 18.

You confirm your age yourself: when you register, or, if Kristina created your account for you, the first time you sign in. You can’t use the app until you have confirmed it.

We do not knowingly process data of anyone younger than 16. If you believe someone below this age has created an account, please contact us and we will delete it.

No advertising, no profiling

The app contains no analytics or crash-reporting tools. We do not use your data for advertising, we do not build advertising profiles, and we make no automated decisions that have legal or similarly significant effects on you.

Security

All connections to the app and this website are encrypted (HTTPS/TLS). Access to data in the database is restricted by security rules, and App Check blocks requests that do not come from the genuine app. No system is completely secure, but we take reasonable measures to protect your data.

Changes to this policy

We update this policy when the app or the law changes. The date at the top shows the latest version. If a change is significant, we will also let you know in the app.

Contact

Questions about privacy? Email support@wondergerman.co.