Privacy Policy

This is an English translation for convenience; only the German version (Datenschutzerklärung) is legally binding.

Last updated: 2026-09-28

This policy explains which personal data we process when you visit our website https://zielor.com, join the waitlist, or use the Zielor app on iPhone, iPad or the web. We have kept it as short and clear as we can.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Kevin Gabeci, Kejvi Xhelilaj
Zielor
Rruga Jordan Misja
1001 Tirana
Albania
Email: contact@zielor.de
Phone: [missing: phone]

We are established outside the European Union. The GDPR still applies to us because we offer our services to people in the EU (Art. 3(2) GDPR).

3. Data Protection Officer

We are not required to appoint a data protection officer. For any privacy question, write to contact@zielor.de.

4. Visiting the Website

4.1 Hosting and Server Logs

Our website is hosted by [missing: hostingProviderName], [missing: hostingProviderAddress]. The servers are located [missing: hostingLocationEn]. The provider processes data on our behalf (Art. 28 GDPR).

When you open the website, your browser automatically sends data to our server. We store:

• IP address
• date and time of the request
• the page or file requested
• referrer (the page you came from)
• browser and operating system (user agent)
• HTTP status code and amount of data transferred

We use this data to deliver the website, keep it secure and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure and stable website. Log files are deleted after [missing: serverLogRetentionDays] days, unless a specific security incident needs further investigation.

4.2 Abuse Protection

To stop automated requests from flooding the waitlist, we briefly count how often forms are sent from one IP address. This counter lives only in the server's memory and expires after 30 minutes at most. The legal basis is Art. 6(1)(f) GDPR (preventing abuse).

4.3 Fonts

The fonts on this website are hosted on our own server. No connection to Google or any other font provider is made when you load a page.

4.4 Audio Sample

On the home page you can listen to a sample exam question. The audio file is stored on our own server and only loads when your browser requests it. This creates only the log data listed in section 4.1. No data goes to third parties, and your answer to the sample question is not stored.

4.5 Explainer Films in Articles

Many articles include a short explainer film. The films are hosted on YouTube.

Film from YouTube (two-click solution): The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the page you only see a preview image that comes from our own server, and no connection to YouTube is made. Only when you click the preview image does your browser load the player in privacy-enhanced mode from youtube-nocookie.com. From that moment Google receives, among other things, your IP address, the address of the page and technical details about your browser, and Google may use cookies or similar technologies on your device, at the latest once the film plays. Google may also transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (section 10).

The legal basis is your consent, which you give by clicking the preview image (Art. 6(1)(a) GDPR, § 25(1) TDDDG). It covers only that film on that page view. You can withdraw it for the future by closing or reloading the page. You can delete cookies Google has already set in your browser. More in Google's privacy policy: https://policies.google.com/privacy

4.6 Cookies and Storage on Your Device

We do not use cookies for statistics, tracking or advertising on the website. We only store or read information on your device where this is strictly necessary to provide a service you have explicitly asked for, such as signing in to the web app or remembering your language. Under § 25(2) No. 2 TDDDG this needs no consent, which is why we do not show a cookie banner. The only exception is the YouTube player, which you load yourself with a click (section 4.5).

4.7 Audience Measurement with Umami

To see which pages and articles are read and whether the waitlist works, we use Umami, open-source software for audience measurement. Umami runs on a server we operate ourselves (analytics.apatero.com), with the same hosting provider as this website (section 4.1). The data goes to no other service and is not combined with other data about you.

No cookies: Umami sets no cookies and stores no identifier on your device. The script only checks whether a switch has been set in your browser that turns measurement off for this website.

What data: on each page view a small script sends the page address (including campaign parameters such as utm_source, but without the personal links from our emails, which we mask first), the page title, the page you came from (referrer), your screen size and your browser language to our server. From the IP address and the browser identifier (user agent) the server derives country, region and city as well as browser, operating system and device type. The IP address itself is not stored.

Counting visits: so that several page views count as one visit, Umami computes a hash from the IP address, the browser identifier, the website and a secret value that changes monthly. The IP address cannot be recovered from it, and once the secret value changes a new visit cannot be linked to earlier ones. There is no recognition across different websites.

Events: we also count a few actions without storing any content or input: a successful waitlist signup (with the chosen exam, the language and which form was used, without the email address), starting to fill in a waitlist form or a failed submission (only the kind of error), playing a film or scrolling to one, playing the audio sample, switching the language, clicks on navigation links, on buttons that lead to the waitlist and on pricing plans, which page sections were seen and how far down a page you scrolled (25, 50, 75 or 100 percent), opening an FAQ answer, copying text from an article (not the text itself), visits to pages that do not exist (the address without parameters), clicks on links to authorities and exam providers, and use of the score calculators (without the values entered).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the website and our articles and knowing which content helps. Because nothing is stored on your device, we do not ask for consent.

Retention: we delete the statistics data after 24 months.

Objection: you can object to the measurement at any time (Art. 21 GDPR). The simplest way is to turn on "Do Not Track" in your browser; the script then sends nothing. You can also write to us at contact@zielor.de.

5. Waitlist

Before launch you can join our waitlist. We will then email you once, when Zielor launches.

What data: your email address. Optionally, the exam you are preparing for. We also store the language of the page you signed up on, so the email arrives in that language.

Double opt-in: after signing up you receive an email with a confirmation link. You are only added to the list once you click it. This makes sure nobody can sign you up with your address.

Record of consent: we log the time of sign-up and confirmation and the IP address used, so we can prove that you consented (Art. 7(1) GDPR). The legal basis for this log is Art. 6(1)(c) and (f) GDPR.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 7(2) No. 2 UWG.

Withdrawing consent: you can unsubscribe at any time, through the link in every email or by writing to contact@zielor.de. This does not affect the lawfulness of processing before you withdrew.

Service provider: we use Resend, [missing: emailProviderAddress], as a processor (Art. 28 GDPR) to manage the list and send emails. [missing: emailProviderTransferBasisEn]

Retention: your address stays on the list until we have sent the launch email or you unsubscribe. We then delete it, unless you open an account. We keep the consent record for up to three years after the end of the year in which you unsubscribed, to defend against claims. After you unsubscribe, we put your address on a suppression list so you receive no further emails.

6. Contacting Us by Email

When you write to us, we process your email address, your name (if given) and the content of your message to answer you. The legal basis is Art. 6(1)(b) GDPR where your message concerns a contract or steps before one, otherwise Art. 6(1)(f) GDPR (answering enquiries). We delete the correspondence once it is settled, at the latest after three years, unless statutory retention duties require longer.

7. The Zielor App

This section covers the app on iPhone and iPad and the web app.

7.1 Account

You need an account to use the app. You can sign up with your email address, with Sign in with Apple, or with Google. We process your email address, an internal user ID, the identifier sent by Apple or Google if you sign in with them (with Apple, an anonymous relay address if you choose), and your settings: exam, exam date, native language and interface language.

The legal basis is Art. 6(1)(b) GDPR (contract). Without this data we cannot run an account.

7.2 Learning and Practice Data

To show you a study plan, your progress and an estimate of your exam readiness, we store your answers, written texts, transcripts of your recordings, scores, feedback, the placement test and your practice history. We also count how many gradings you use each month (fair use).

The legal basis is Art. 6(1)(b) GDPR. We keep this data for as long as your account exists.

When you practise offline, your answers first stay on your device only. Written and spoken answers are sent to us and graded once you are back online.

7.3 Voice Recordings

When we record: the app only uses your microphone if you have allowed it in your device settings and you tap record yourself in a speaking task.

What for: only to transcribe your spoken answer, assess pronunciation and fluency, and grade the answer against the exam criteria. Afterwards you can play the recording back next to the feedback.

What not for: we do not use your voice to identify or recognise you. We do not create voiceprints. We do not infer emotions, health information or origin from your voice. We do not use recordings to train AI models, and our service providers may not do so either.

Where: recordings are stored with Cloudflare, Inc. (Cloudflare R2) in storage located in the EU. For transcription and pronunciation assessment they are sent to the speech services listed in section 9.

How long: raw recordings are deleted automatically 30 days after recording. The transcript, scores and feedback stay in your account until you delete them or your account.

Your settings:

• You can delete any single recording immediately.
• You can choose to have recordings deleted right after grading. Playback is then no longer possible.
• You can choose to keep recordings for longer than 30 days. This is optional and based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.

Legal basis: Art. 6(1)(b) GDPR. Grading your spoken answers is part of the service you signed up for. Without a recording we cannot grade the speaking part. Every other part of the app works without the microphone.

Before your first recording, the app explains which services your recordings and answers are sent to and asks for your explicit confirmation.

7.4 AI Examiner and Grading

Notice under Art. 50 of the AI Act (Regulation (EU) 2024/1689): the examiner in Zielor is an AI. When you talk to a partner in speaking tasks, that partner is also an AI, and its voice is synthetic. All scores, corrections and feedback are produced automatically by an AI system and are labelled in the app as an AI estimate.

How a grade is produced: your text, or the transcript of your recording, is sent together with the official assessment criteria of the exam and rated sample answers to a language model from Anthropic PBC (Claude). The model awards points per criterion, only in the steps the exam allows, marks mistakes and explains them in the language you chose (12 languages). For spoken answers, fluency and pronunciation measures are added. We check every result automatically for completeness and allowed point values.

What a grade is and is not: results are estimates to help you learn. They are not official exam results and have no legal effect. They are therefore not an automated decision within the meaning of Art. 22 GDPR.

If you think a grade is wrong: write to contact@zielor.de. A person on our team will look at it.

7.5 Deleting Your Account and Exporting Data

You can delete your account at any time in the app and in the web app. We then delete your account, answers, transcripts, grades and all recordings within 30 days. The data disappears from backups no later than 30 days after that. We keep invoice and accounting records where the law requires it (section 8).

An active Apple subscription does not end automatically when you delete your account. Please cancel it in the settings of your Apple device.

We delete accounts that have not been used for 24 months and have no active subscription. We email you 30 days beforehand.

You can request a copy of your data in a common, machine-readable format (Art. 15 and Art. 20 GDPR), in the app or by email to contact@zielor.de.

8. Payments

App Store purchases: when you subscribe in the iPhone or iPad app, you buy from Apple (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). Apple processes your payment data as an independent controller under Apple's privacy policy. We receive no payment data from Apple, only which subscription is active, when it renews or ends, and a transaction ID, so we can unlock your account.

Web purchases: on the web, payment is handled by [missing: whopEntityName], [missing: whopEntityAddress]. Whop acts as the merchant of record towards you, collects the payment, remits VAT and processes your payment data as an independent controller under Whop's privacy policy. We receive your email address, the plan you chose, the payment status and transaction IDs. We do not receive card details.

On our own order page, before handing you over to Whop, we record that and when you agreed to the contract starting early (see the withdrawal instructions), together with your user ID.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligations).

Retention: we keep invoices and accounting records for up to ten years and business letters for up to six years where tax and commercial law require it (for example § 147 AO, § 257 HGB, and the corresponding rules where we are established).

9. Recipients and Processors

We only share your data where this is needed for the purposes above. All processors are bound by contract under Art. 28 GDPR and may only use the data on our instructions.

Anthropic and Google do not use the data we send through their paid interfaces to train their models.

Beyond this, we only share data where the law requires it, for example with public authorities.

10. Transfers Outside the EU

To us: we are established in Albania. There is no EU Commission adequacy decision for Albania. When you send us data, we collect it directly from you as a controller who is itself subject to the GDPR (Art. 3(2) GDPR). Under Guidelines 05/2021 of the European Data Protection Board, this is not a transfer to a third country within the meaning of Chapter V GDPR. We still apply the GDPR in full to all data, wherever it is stored, and we have appointed a representative in the EU (section 2).

To service providers in the USA: some service providers are based in the USA or may access data from there (see the table in section 9). We only transfer data there

• to companies certified under the EU-US Data Privacy Framework, on the basis of the EU Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR), and
• additionally or alternatively on the basis of the EU Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Art. 46(2)(c) GDPR), which are part of our contracts with these providers.

You can get a copy of the standard contractual clauses by writing to contact@zielor.de.

11. Retention at a Glance

12. Whether You Have to Provide Data

You are not required by law or contract to give us any data. Without an email address, however, we cannot add you to the waitlist, and without an account you cannot use the app. Without a recording we cannot grade the speaking part.

13. Your Rights

You have the right

• to access your data (Art. 15 GDPR),
• to have inaccurate data corrected (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR),
• to receive your data in a common, machine-readable format or have it transmitted (Art. 20 GDPR),
• to withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

For any request, an email to contact@zielor.de is enough. We answer within one month.

14. Complaints to a Supervisory Authority

You can complain to any data protection supervisory authority in the EU, in particular in the member state where you live or work or where the alleged infringement took place (Art. 77 GDPR). As we have no establishment in the EU, there is no lead authority. One possible point of contact is:

[missing: supervisoryAuthorityName]
[missing: supervisoryAuthorityAddress]
[missing: supervisoryAuthorityUrl]

15. Minimum Age

Zielor is meant for people aged 18 and over. The app is not intended for younger people, and we do not knowingly process their data. If we learn that an account belongs to a younger person, we delete it.

16. Security

We encrypt all data in transit (TLS), store recordings encrypted, play recordings back only through short-lived signed links, grant access on a least-privilege basis, and never write audio data to log files.

17. Changes

We update this policy when our services or the law change. The version published here applies. We will tell you about material changes that affect your account in the app or by email.