Privacy Policy for www.teachpie.de and app.teachpie.de

Version: 2.7
As of: 12.10.2026

This Privacy Policy describes the processing of personal data when using the TeachPie website and TeachPie web app. It reflects the technical status of the platform as of 12.10.2026. TeachPie is a digital education platform with features for lesson planning, learning support, class and school organization, AI-assisted content generation, analysis, assessment and communication.

Processing is carried out in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable requirements under education and contract law. For certain AI-supported processes, TeachPie also aligns its transparency, documentation and oversight measures with the requirements of the EU AI Act that are already in force and those that are being phased in.

1. Controller and contact

Astep Ahead UG (haftungsbeschränkt) is the controller responsible for processing under the GDPR. Full provider details are available in the legal notice at www.teachpie.de/rechtlich/impressum.

Contact for data protection inquiries: datenschutz@teachpie.de
General contact: kontakt@teachpie.de

2. Role model and data protection classification

TeachPie processes data in different contexts:

Individual accounts: For accounts created directly by users, TeachPie is generally the controller responsible for account management, provision and billing.
Schools and school authorities: For institutional use, the school or school authority may be the controller. In these cases, TeachPie processes the affected data under a data processing agreement and solely within the documented scope of use.
AI-assisted processes: When AI features are used, TeachPie remains responsible for operating the platform; schools and other controllers remain responsible for their own data protection assessments, instructions, information obligations and, where applicable, a data protection impact assessment.

3. What data we process

3.1 Account and profile data

First name, last name, email address, role and profile information, school or organisational affiliation, language settings, onboarding status and, if provided, the optional “About me” self-description (Section 3.9).

3.2 Authentication data

Login and session information, hashed password data, identifiers from optional single sign-on via Google or Microsoft, and security-related login and rate-limiting metadata.

3.3 Contract and billing data

Subscription status, billing and booking information, Stripe customer references only when processed through Stripe, payment status and plan-related usage limits. For new personal subscriptions, we store the agreed offer, the original term, the subsequent price and your express request to begin providing the service before the withdrawal period expires, including the wording, language and time. The complete contract confirmation with the applicable version of the T&Cs is retained as an unalterable original; limited dispatch records distinguish between accepted dispatch, unresolved attempts and confirmed delivery. TeachPie does not itself store complete credit card or bank account details.

We store cancellations and withdrawals submitted publicly with the contact details provided, the original text of the notice, the time received, and limited verification and delivery records. The email address alone does not link the notice to an account. An account is linked only after documented identity or contract verification. The confirmation of receipt confirms receipt, not that an account has already been deleted, a subscription cancelled or a refund issued.

3.4 Content and lesson data

Lesson plans, materials, whiteboard content, curricula, tasks, simulations, class content, learning progress, learning paths, exam materials, uploaded documents, images, audio content, and other files.

3.5 Communication and AI usage data

Chat histories, prompts, model responses, feedback, reports of problematic content, technical context data relating to AI use, token consumption, and error and quality reports.

3.6 Usage and security data

IP addresses, browser and device information, timestamps, request metadata, system and error messages, security and abuse indicators.

3.7 Learning in a group (“Learn with your class”) and instant learning

Round: A teacher with TeachPie Pro can open a round for their own lesson, unit, material, or a worksheet from the marketplace. The round gets a code and a QR code, stays open for 90 minutes by default and for no more than twelve hours, and can be extended or ended early by the teacher. The following details are stored for the round: code, teacher, source and, where applicable, version, title, subject, and opening, end, and deletion times. Anyone who opens the code sees the title, subject, source type, teacher’s name, and the end time before joining.

Join without an account: Students without an account enter only a first name (up to 40 characters); if it has already been used in the round, a number is added. Teacher approval is not required. To participate in the round, TeachPie creates a placeholder account assigned to the teacher, with no real email address, name, password, or login account; the first name is used only for participation in the round. The session runs via the technically necessary cookie tp_room; it contains a random identifier, of which TeachPie stores only a hash value. The session ends when the round ends, when the teacher removes the person from the round, or when the person selects “Leave round”; in the latter two cases, it is revoked immediately. The person’s last name, email address and IP address are not stored for the round. The IP address is processed briefly when the round is opened and joined to limit the number of attempts (15-minute time window).

Join with an account: Anyone who is signed in learns in the session using their own account. Their first name from their account is used as their name in the session; if none is saved, they enter a name. The learning path from the session stays in their account.

What emerges from the discussion: One learning path per person, linked exclusively to this source and containing the data listed in sections 3.4 and 3.5, in particular the learning workspace, pen and keyboard input, chat history with the learning assistant, voice input, uploaded files and work in progress. To participate, we store the person's name, join time, last activity and assigned learning path.

What the teacher sees: In the round overview, the teacher can see each participant’s name, whether they’re taking part with or without an account, when they joined, their latest activity, and their progress—that is, their current phase and whether they’re finished.

AI processing and costs: The learning companion, voice input and speech output process learners' inputs and work in progress using the AI services listed in Section 5.4 and in the Vendor and Subprocessor List; logging and storage are covered by Section 6. All AI calls and all worksheets in a round are attributed to the teacher who opened the round and count only against their allowance. If it runs out, learners receive only a neutral notice, with no information about the teacher's plan or usage.

Deletion: 14 days after a round ends, an hourly automated process fully deletes the round, its participation records and sessions, and every placeholder account, including its files, learning paths, workspaces, chats, AI logs in the database and usage data. The only exception is the oversight logs under the AI Act (Articles 12, 19 and 26(6) of Regulation (EU) 2024/1689), held in a separate compliance store. They contain the placeholder account identifier and inputs, but no name, and are automatically deleted after six months (184 days); once the placeholder account has been deleted, the identifier can no longer be associated with any person. Learners with an account keep their learning path; only their participation in the round ends.

Start learning right away with your own account: Students with their own accounts can learn from a marketplace worksheet directly, for example by scanning the QR code on the worksheet. Teachers can try out their own materials and worksheets from the marketplace. This creates a personal learning path in the account. When a QR code is opened, TeachPie only counts the number of times each worksheet is viewed per day, without linking views to individuals.

Previous guest access via courses: Access without an account using a course code, with a request and teacher approval, is no longer available. No new guest accesses can be created, and existing guest sessions are no longer active. Course codes now only let users with an account join a course. Any remaining data from the former guest access will be deleted automatically: sessions, including display names and learning progress, 90 days after the last activity; approved requests 90 days after approval; rejected or expired requests after 30 days; and usage records 90 days after booking.

3.8 Photos of worksheets and images in the learning space

Photograph worksheet: Pupils and teachers with their own account can photograph a worksheet in the learning space or select photos from their gallery (up to twelve pages) and use them to start their own learning path. This is not possible without an account, for example in a group session. The browser reduces the size of each page before uploading. The server aligns the pages and removes all embedded metadata before saving, in particular the location (GPS), date and time of capture, and device details. The pages are stored as the person’s private material in TeachPie’s storage in Germany (section 5.1). They do not appear in the material library and cannot be published in the Marketplace; TeachPie also prevents this technically in the database.

AI processing: To help the learning companion recognize the tasks in the photo and learn with the person based on them, page images are processed using the AI services listed in Section 5.4. This creates an outline of the tasks and excerpts from the photo, which are stored with the materials. The learning companion is instructed not to record names or faces in photos. We still recommend that you don't upload photos containing names, faces or other personal information.

Images in the learning space chat: Images and pages of a PDF that someone in the learning room shares in the chat are sent to the learning assistant as part of the message (Section 5.4). TeachPie only stores the number of these in the chat history, not the images themselves; Section 6 applies to monitoring logs. If someone with their own account wants to study using such an image, it becomes private material with its own learning path, just as when taking a photo.

Deletion: A photo belongs to the learning path it started. If the person deletes this learning path, the stored pages, the page images generated from them, the outline and excerpts, as well as the material itself, are deleted; the same applies when the account is deleted (Section 8). Photos that have not resulted in a learning path, for example after an abandoned start, are deleted by an automatic hourly process within one hour at the latest.

3.9 About me, learning group and suggestions to save information

About me: Teachers and learners may voluntarily enter a short text about themselves, for example their teaching style and experience or how they like to learn (up to 750 characters), during onboarding or at any time in settings. The text is visible only to that person; neither teachers, schools nor other users can see it. TeachPie includes it in that person's AI requests, namely in chat and when creating materials, lessons, units and course plans, and for learners in the learning assistant, to better tailor responses (Section 5.4). Names, contact details and health information must not be included. TeachPie provides a notice to this effect and asks for confirmation before saving if the text appears to contain names or contact details; learners cannot save health information or other special categories of personal data. If the person deletes the text, it ceases to be used immediately.

About me for learners: The feature is available to learners only if TeachPie has enabled it. In school use, the school also decides whether its learners may use it. For accounts without a school, the person confirms before first saving that they are at least 16 years old or have their parents' consent.

Learning group: Teachers can enter a short description of the learning group for each course, for example its size, prior knowledge, working methods and the group's overall support needs. Individual people should neither be named nor described; TeachPie provides a notice to this effect and checks the text technically. On request, TeachPie uses an AI service (Section 5.4) to shorten a longer description into key points, omitting names; only the version confirmed by the teacher is stored (up to 750 characters), not the long version. Only teachers with access to that course can see the description, never learners. It is sent to AI services when planning the course, creating units, lessons and materials in that course, and chatting about that course; it is not included when content is shared or copied.

Suggestions to save information: If a teacher explicitly says something about themselves or their learning group in the chat, TeachPie may suggest below the response that they add this information to “About me” or to the learning group description. Only information confirmed by the teacher is added. Memory suggestions can be turned off in the settings. Learners do not receive memory suggestions.

3.10 Origin of a registration

If you register yourself as a teacher, we store with your account how you came to TeachPie: the identifier of the short link you came through (section 3.11), the place on our website or in the marketplace where you started registering and, where applicable, the published worksheet from the marketplace you came from. This information is carried only in the address of the pages you visit and in the registration request; we set no cookie for this and use no local or session storage. When you register via Google or Microsoft, our server keeps it for at most ten minutes during sign-in. We evaluate the origin only as totals, to see which of our posts and pages bring teachers to TeachPie who then actually use it. Accounts of pupils and accounts that a school or school authority creates or manages receive no origin; we never use data that we process on behalf of a school for our own marketing purposes (Art. 28(10) GDPR).

Legal basis, objection and storage period: Art. 6(1)(f) GDPR; our legitimate interest is to manage our advertising economically. You can object to this at any time under Art. 21 GDPR without giving reasons, informally to datenschutz@teachpie.de; we then delete the origin stored with your account. Otherwise we store it for 24 months after registration, at most until the account is deleted.

School requests: If a school request comes via a short link or a specific place on our website, we store the short link identifier and this place with the request, on the same legal basis and with the same right to object; both are deleted together with the request (section 8).

3.11 Short links

In our publications we use our own short links of the form www.teachpie.de/l/…. The identifier in the short link only designates a post or a campaign, never a person. Our server redirects to the target page and appends the identifier to the address as the parameter src . We count the calls without a cookie and without access to your device. To filter out automated calls, we store for each call, for at most seven days, the time, a rough classification of the browser and, instead of the IP address, a hash value that we calculate from the IP address and the calendar day in the Europe/Berlin time zone using a purpose-specific key; after that, only daily totals without personal reference remain. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to measure the reach of our publications.

4. Purposes and legal bases

Service provision, account management and contract performance: Article 6(1)(b) GDPR.
Providing school use as part of the educational mission: At the school level, in particular Art. 6(1)(e) GDPR in conjunction with the applicable school law; TeachPie processes data in this respect only on instructions.
Information security, abuse prevention, traceability, product stability: Art. 6(1)(f) GDPR.
Compliance with statutory retention, accounting, and accountability obligations: Art. 6(1)(c) GDPR. Contract confirmations and the processing of cancellations or withdrawals also serve the performance of the contract (Art. 6(1)(b) GDPR). Limited technical records of effect and completion serve secure processing, the avoidance of conflicting payments or deletions, and proof of completion (Art. 6(1)(f) GDPR).
Learning in a “Learn with Class” round without an account: for school use at the school level, Article 6(1)(e) GDPR in conjunction with the applicable school law; otherwise, Article 6(1)(f) GDPR. The legitimate interest is to conduct a teacher-guided learning session without creating an account. For this purpose, processing is limited to first names, learning activity, and technically necessary session data, and is strictly limited in time (Section 8).
About me, learning group and suggestions to save information: for teachers, Article 6(1)(b) GDPR as an optional service feature; in school use, at school level, Article 6(1)(e) GDPR in conjunction with the applicable education law; for learners, Article 6(1)(a) GDPR (consent; for accounts without a school, parental consent under Article 8 GDPR for those under 16), and in school use, according to the school's decision and legal basis. Consent can be withdrawn at any time by deleting the text. Special categories of personal data under Article 9 GDPR are not intended for this feature (Section 3.9).
Optional third-party sign-ins and other voluntary additional features: Art. 6(1)(a) GDPR, where consent is required.

5. Services and infrastructure used

5.1 Core Infrastructure in Germany

TeachPie operates its core platform on its own or dedicated infrastructure in Hetzner Online GmbH data centers in Germany. This includes identity and access management, operational data storage, file processing, and central security and platform functions.

These core systems process, in particular, account data, content data, learning and teaching data, technical usage data, and stored files.

5.2 Current vendor and subprocessor list

The current subprocessors and key technical service providers are maintained in a separate vendor and subprocessor list. The current version is available at www.teachpie.de/rechtlich/vendorliste available on request or provided as an attachment during the institutional contracting process.

New or replacement service providers are added only after a review of data protection, technical and contractual requirements. Statutory or contractual rights to information, notification and, where applicable, objection remain unaffected.

5.3 Authentication and account access

TeachPie uses a central authentication and account access system. Users can optionally sign in with Google or Microsoft. TeachPie receives only the information required for authentication, account assignment and profile linking, such as email address, first and last name, and the relevant provider identifier.

5.4 AI and model providers

TeachPie uses Microsoft Azure AI Foundry for all generative text, teaching, learning support, analysis and correction features, with processing in Germany. Image generation for materials is also handled via Microsoft Azure AI Foundry; speech recognition and speech synthesis are provided via Microsoft Azure Speech or Azure OpenAI, respectively, in each case within the EU. For semantic searches across materials, documents and curricula, TeachPie creates embeddings (vector representations) using Google Gemini Embedding in the EU. Text recognition (OCR) in uploaded documents runs on TeachPie's own infrastructure.

Transactional emails sent via Amazon SES are processed in Germany.

Depending on the feature used, the following data in particular may be transferred to AI services:

Prompts and instructions,
text excerpts, document contents and structured context data provided by the user,
uploaded images or OCR content extracted from them,
for searches, the text and page images of uploaded documents, as well as the text of materials and curricula,
for voice input, the audio recording used for recognition; for speech output, the text to be read aloud.

TeachPie follows the principle of data minimization and advises users not to enter unnecessary personal data or special categories of personal data in free-text prompts. Nevertheless, depending on how the service is used, personal content may be processed if users themselves enter or upload such content.

According to the provider information published for enterprise-oriented services and the contract/product configurations used in each case, customer data is not used to train general-purpose foundation models. However, temporary storage or automated security checks may take place to detect misuse and provide the service.

5.5 Email delivery

Transactional emails, such as those for registration, password resets or billing-related notifications, are sent via Amazon Simple Email Service (SES).

5.6 Payment processing

Payments for self-service subscriptions are processed through Stripe. TeachPie receives status and reference data from Stripe in particular, but not complete payment card details.

6. AI-specific processing, logging, and transparency

TeachPie is designed as an AI-powered assistant system. Final pedagogical, organizational, and assessment-related decisions remain with teachers, schools, and other responsible parties.

To ensure traceability, quality, security monitoring and compliance with documentation requirements, TeachPie stores AI-related data in several places:

Chat history: User and model messages are stored in internal application systems so that conversation histories can be displayed and continued in the application.
Supervision logs (compliance logs): Structured logs of AI operations are stored in separate internal storage. In the learning space, they contain timestamps, session and role references, learners' inputs, model responses, model and token metadata, and teacher supervision events; they serve as evidence under the AI Act (Articles 12, 19 and 26(6) of Regulation (EU) 2024/1689). For lesson planning, they contain only operational metadata such as timestamps, role references, the model and token usage, but no inputs or responses.
Voice input: The audio recording is transmitted to the speech service used at the time, as described in section 5.4, for recognition and is not stored by TeachPie. The recognized text is processed like other inputs and may be included in the chat history and the logs described.

TeachPie does not use “About me”, a learning group description or suggestions to save information to assess or classify individuals; the information serves only to tailor suggestions and explanations. No automated decisions within the meaning of Article 22 GDPR are made in this process.

The previous statement that prompts and outputs are never stored does not apply to the current platform. Instead, the storage described in this version for product functionality, history, security and traceability applies.

7. Recipients and third-country transfers

The platform’s primary processing takes place on infrastructure in Germany. AI services are used exclusively in Germany or the EU; Amazon SES is used in Germany. Certain features may involve transfers to external providers. This applies in particular to:

Microsoft Azure AI Foundry for generative AI features in Germany and for image generation in the EU,
Microsoft Azure Speech and Azure OpenAI for speech recognition and speech synthesis in the EU,
Google Gemini Embedding for search embeddings in the EU,
Google or Microsoft for optional third-party sign-in,
Stripe for payment processing for self-service subscriptions or where the specific contract is billed through Stripe,
Amazon SES for sending emails in Germany.

Where data is processed outside the EEA in connection with optional services, provider support or future configuration changes, or such access cannot be ruled out, TeachPie bases processing on appropriate safeguards such as adequacy decisions, the EU-US Data Privacy Framework or Standard Contractual Clauses, where applicable. Schools and other controllers must still check whether additional organizational requirements apply to their specific use.

8. Retention period and deletion

Account data and user-related content: for as long as the account is used. You can request erasure in your account settings; for school-managed accounts and pupil accounts at a school, the school initiates it in the school administration system. When you submit the request, access to the account is blocked and active sessions lose their authorisation. An active personal subscription is cancelled at the end of its term. During the 30-day revocation period, you can revoke the request using the link in the confirmation email or via datenschutz@teachpie.de withdraw it; school requests must be withdrawn by the authorised school. Withdrawing a deletion request does not automatically reverse a subscription cancellation. After that, the automated process removes the data that the deletion concept says must be deleted, including the sign-in account and files, and confirms completion; any ongoing personal subscriptions are ended in the process. Statutory claims, for example those arising from a withdrawal, remain unaffected. Unresolved payments, conflicting provider associations or missing completion evidence are investigated rather than incorrectly reporting the deletion as complete.
Shared content and school records: Content shared with the school or created with contributions from others may remain with the school or those contributors without your name. Marketplace publications are withdrawn; copies already taken remain without the author’s name. Personal notes are also removed there. For assessment data, the school, as controller, determines retention under its school law; deleting an account does not remove it across the board.
Original contracts and business correspondence: Contract documents, original confirmations and the related limited delivery records are retained for six full calendar years after the end of the calendar year in which the contract actually ended, once that end has been confirmed. This period does not begin while a contract is ongoing or its termination is unresolved. Cancellation and withdrawal declarations, together with their original review and delivery records, are retained as business letters for six full calendar years from the end of the year in which they were received. The relevant business records under § 257 HGB and § 147 AO are decisive. The verified link to the account is retained against an internal identifier for the deleted account; this does not restore the active profile. Unverified email details are not proof of an account.
Billing- and tax-related data: Invoices and accounting records that are actually subject to a retention obligation are generally retained for eight years, and commercial books and financial statements for ten years, in each case from the statutory starting points and subject to any longer retention period that may be required (§ 147 AO, § 257 HGB, § 14b UStG). These periods do not impose a blanket retention obligation for every Stripe customer object.
Payment providers and technical completion evidence: When an account is deleted, stored payment methods are removed and your verified customer data held by the payment provider are pseudonymised; invoices that must be retained unchanged remain. A limited private record preserves the original provider and customer link against the cleaned account anchor, so that the later cleanup applies specifically to this link. Cleanup falls due after eight full calendar years from the end of the year of archiving; outstanding financial links or unresolved effects at providers must be clarified first. The related local link may be removed only once actual proof of deletion and completion is available. This data-minimised technical record serves to ensure secure completion, not advertising or renewed use of the deleted account.
Consent and deletion records: Limited records are generally retained for three full calendar years from the end of the year in which the event occurred, in accordance with the deletion policy; where a specific other original purpose still requires a record of completion, only that necessary record is retained until the matter is resolved. This does not mean that deleted profile or content data is generally stored.
Data copy (access request): The package from Section 12 is available for download for seven days and is then automatically removed.
About me and learning group: until the person changes or deletes the text; “About me” is retained no later than account deletion, and the learning group description no later than course deletion. A long version submitted for shortening is not stored; Section 6 applies to supervision logs (Section 3.9).
“Learn with the class” rounds: A session is open for 90 minutes by default and for no more than twelve hours. The session cookie remains valid for no more than twelve hours after the session ends and is deleted immediately when you leave. 14 days after the session ends, the session, its participants and sessions, as well as every placeholder account and its learning work, files, AI logs in the database and usage data, are automatically deleted. The AI Act supervision logs without names remain for six months (184 days, Section 3.7). Learners with an account keep their learning path.
Photos of worksheets: for as long as the learning path started by the photo exists; when the learning path or account is deleted, pages, page images, outline, excerpts, and material are deleted. Photos without a learning path are automatically deleted after no more than one hour (Section 3.8).
Security logs: Sign-in and security events: 90 days; technical application logs: seven days.
Contact requests without an account: one year after the last contact; if this results in a contract, six years as a business letter.
Supervision logs (AI compliance logs): six months (184 days), after which they are automatically deleted.
Backups: The database is backed up daily. Backups from the last 14 days are retained, together with one per week for eight weeks and one per month for three months; older backups are automatically deleted. Deleted data disappears from backups as they expire, generally within three months at the latest. Backups are held within the core infrastructure in Germany.

9. Cookies, sessions, and technically necessary storage

TeachPie does not currently use analytics, marketing or advertising trackers. Technically necessary cookies and similar storage technologies are used for specific functions such as authentication, session management, security, “Learn with Class” rounds, and local work and display states. External sign-in providers and the payment page hosted by Stripe are only accessed after an explicit user action. A complete overview of names, purposes and storage periods is provided in the Overview of cookies and browser storage.

For the free teaching tools on teachpie.de, the content entered (such as class lists) generally remains exclusively in the browser on the device being used. The exception is the live tools (live poll, feedback target): anonymous session data and responses are processed on servers in Germany for the duration of the session and automatically deleted after no more than 24 hours; they are not linked to individuals. To improve its services, TeachPie also counts anonymously how often a tool is accessed and used; no cookies are set, and no IP addresses, identifiers or other personal data are stored.

We count views, downloads and QR scans of free worksheets, as well as clicks on the TeachPie Pro notice. Page views, QR scans, Pro clicks and new registrations are counted as totals without storing account, session or browser identifiers. Downloads from a logged-in account may be linked to the account, like other account usage.

For a new registration, we additionally count per website area and worksheet how many registrations started there; for self-registered teachers we also store the origin with the account (section 3.10). The origin is carried only in the address and in the registration request: no marketing cookie, no local or session storage and no browser identifier. Later entries or entries that cannot be clearly assigned remain without a source.

10. Data security

TeachPie implements appropriate technical and organisational measures, in particular role-based and tenant-based access restrictions, encrypted transmission, central authentication, object-level access control through signed URLs, safeguards against abuse and technical logging. Further details are set out in the technical and organisational measures (TOMs), which schools and school operators receive as an annex to the data processing agreement.

11. Data relating to minors

TeachPie is also used with minors in school settings. Therefore, a higher level of protection applies. Schools and school authorities remain responsible for reviewing and implementing the specific legal basis, information obligations, approval processes, usage rules and, where applicable, a data protection impact assessment for their particular use.

In a “Learn with class” session, learners without an account only need to provide a first name; no last name, email address, or password is collected. Before joining, they see a notice about the deletion period and this statement. We recommend that teachers ask children to enter only their first name or a nickname.

For learners, “About me” is available only if TeachPie and, in school use, the school have enabled the feature; for accounts without a school, users must confirm before first saving that they are at least 16 years old or have parental consent. The question is deliberately narrow (how someone likes to learn), the text is visible only to that person, and suggestions to save information are not offered to learners (Section 3.9).

12. Data Subject Rights

Subject to the statutory requirements, data subjects have, in particular, the right to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, that consent may be withdrawn with effect for the future.

For self-managed accounts, you can request a data copy under Settings, Account and download it once it has been prepared. A new package can be requested no more than once within 24 hours; a package made available can be accessed for seven days. It contains the web app data and files linked to the verified account, as well as the specified provider information. Secrets and other people’s data are not included. The Customer Support area in the internal TeachPie OS is handled separately and supplemented within the statutory period, generally one month. Therefore, not all data is contained solely in the automatically generated package.

For school-administered accounts and pupil accounts belonging to a school, the school is the controller. Authorized school admins request a copy of the data and its deletion through school administration; the account, continuing school affiliation and authorization are checked again when the data is retrieved. TeachPie provides support within the scope of its contractual and legal obligations. An email address provided freely or an unverified public declaration is not sufficient to obtain information about or delete someone else’s account. Send any other requests to datenschutz@teachpie.de.

13. Changes to this statement

This statement is updated when there are significant changes to the product scope, data flows, security measures, subprocessors or legal requirements. The version published at the time, including its date, is authoritative.