Privacy Policy

1. General Information About Data Processing

Data Controller

General Information

We generally only collect and use personal data of our users to the extent necessary to provide a functional website, our content and services.

We only collect and use personal data with your consent or as permitted by law.

2. Data Collection on Our Website

Server Log Files

When you visit our website, our system automatically collects the following information:

• Browser type and version
• Operating system used
• Internet Service Provider
• IP address
• Date and time of access
• Referrer URL

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in the operation and security of the website).

3. Cookies and Local Storage

Our website uses only technically necessary cookies to provide functionality, no analytics or advertising cookies. Details and your settings options are available on our cookie page.

Technically Necessary Cookies

These cookies are required for:

• Language preferences
• Session management
• Provision of website functions

Session cookies are automatically deleted when you close your browser.

Display Mode (Light/Dark)

Your display mode preference is stored, as technically necessary, locally in your browser so the page loads in your chosen mode on your next visit. This information does not leave your device and is not transmitted to us.

4. Contact Forms, Consultation Requests, PDF Brochure and Application Guide

When you submit a consultation request via a contact form (email or WhatsApp), we process the data you provide (name, email address, subject and message) exclusively to process your request.

PDF brochure

When you request a PDF brochure via the form, we process your name, your email address, the chosen language and your selection (study types and fields of study). We use them to compile the brochure, put your name on the cover and send it to you as a PDF attachment by email.

Application guide

We send you the application guide with the fill-in help for a provider's enrollment form by email. For this we process your name, your email address, the provider, the language and the page on which you requested it. The email contains a personal download link that is valid for 30 days. If you open it, we count the download for that provider.

5. Technical Infrastructure and AI-Assisted Content

The program and provider data on this website is managed in a self-hosted database (Baserow) and in a vector database (Qdrant) that serves as the knowledge base of our AI advisor Anne. Both run on our own servers.

The texts about providers and programs are written, translated and classified by an internally operated pipeline. It reads only publicly available information from the providers (websites, brochures, price lists) as well as public information and logos of accreditation bodies. For writing, translating and classifying, we use Google's Gemini language model via the EU endpoint of the service provider Eden AI SAS, 10 rue de Penthièvre, 75008 Paris, France. This endpoint rejects requests to models outside the EU. If the service fails, a language model on our own servers (Ollama) takes over. No personal data of visitors to this website is passed to the pipeline, in particular no information from contact forms.

If you use the text chat with Anne, we process your messages on our own server (voice.made-with.ai) and search the knowledge base there. To formulate the answer, we send your message together with the program and provider information found to Gemini, via the same EU endpoint of Eden AI. Please do not enter sensitive information in the chat, such as health details or ID numbers.

If you write to us via the email form or directly to advice@studyonline.now, Anne answers your question by email. Mailjet receives emails sent to this address on our behalf and passes them on to our website. For the answer we send the subject and text of your message and, where applicable, the page you are writing from, together with matching program and provider information from our data, to Gemini, via the EU endpoint of Eden AI. We do not send your name or email address. The answer goes to the email address given in the form or to your sender address, and our team receives a copy of your request. We send the emails via Mailjet.

For voice consultation via the website, we transmit your voice input in real time to Google's Gemini Live service, which generates the spoken answer. Processing by Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework. The legal basis for the chat and voice consultation is the handling of your request (Art. 6(1)(b) GDPR) and our legitimate interest in fast advice (Art. 6(1)(f) GDPR).

Saving details with Anne: on request, Anne shows an input field in the chat or voice window. If you agree, we store your first and last name, postcode and date of birth in order to recognise you in a later conversation, as well as the history of your conversations with Anne (your questions and Anne's answers) so that Anne can pick up on your previous request. If you would like documents by email, we also store your email address and send you a provider's application guide or the link to its brochure via Mailjet (see above). These details go directly from the input field to our self-hosted database (Baserow) and stay in the EU: it runs on our server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in the Falkenstein data centre (Germany). They are not passed to Gemini. Anne only learns your first name and a short summary of your previous requests. Your browser remembers until you close the tab that you have been recognised (session storage). If you also tick 'Remember me on this device', we store a signed identifier in your browser storage (localStorage) that lets Anne recognise you on later visits without entering your details again. It contains no plain-text details, is valid for at most 24 months and can be deleted at any time via 'Forget me' in the chat or voice window. The legal basis is Section 25(2) no. 2 of the German TDDDG (a service you expressly requested) and your consent. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the contact form. We delete the details at the latest 24 months after your last contact.

One contact across all channels: we store requests sent via our forms (contact, WhatsApp, partnership, brochure) and requests for documents by email in order to answer them, and we link them to your existing contact via your email address if one already exists. If you also tick the optional box 'save or link', we keep a shared history across all channels: conversations with Anne, requested brochures, downloaded application guides and clicks on providers' course and brochure pages. We match records via your email address or via name, postcode and date of birth. We merge duplicate entries of the same person if the details do not contradict each other. Your device then recognises you on your next visit via the identifier described above. We evaluate the history internally to see which providers you are interested in. Disclosure to education providers: only if you tick the separate box for this when making a request about a specific provider do we pass your name, email address and the topic of your request to that provider. The provider can then advise you directly and confirm to us whether you have enrolled. This is the basis for our remuneration by the provider. Without this box, the provider learns nothing about you. The legal basis for answering your request is Art. 6(1)(b) GDPR; for the history, recognition and disclosure it is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the contact form. We delete the details at the latest 24 months after your last contact.

Anonymous usage statistics: independently of this, we count without cookies and without IP addresses how often the forms, brochures, application guides, providers' course and brochure links and Anne are used. We only store the type, time, channel, provider, course, language and page. For questions in the chat with Anne we only check whether a provider is mentioned; the text itself is not stored for the statistics. No person can be identified from these figures. The legal basis is our legitimate interest in evaluating our service and our cooperation with the providers (Art. 6(1)(f) GDPR).

Protection against misuse of the advisory service: so that Anne is only used for advice about our programmes, our server automatically checks every message and every spoken input for attempts to obtain internal data, inject program code or reprogram Anne. For this we process your IP address as well as the start and duration of your conversations. Each connection can have at most five conversations in 24 hours, each lasting at most ten minutes. After the first detected attempt you receive a notice. After the second we end the connection and block the advisory service for your connection for 24 hours. We are informed about every incident by email (sent via Mailjet, see above) with the time, IP address, an excerpt of your input and, only if you previously entered them yourself in an input field, your name and email address. A person reviews every incident and can lift or extend the block. This data is stored on our server at Hetzner Online GmbH in Germany. We delete conversation times and IP addresses after 7 days, incident details after 90 days and blocks when they expire. The legal basis is our legitimate interest in the security of our systems and in protecting the data of our users and partners (Art. 6(1)(f) GDPR).

6. Data Deletion and Storage Duration

Personal data is deleted as soon as the purpose for storage no longer applies and no statutory retention obligations prevent it.

• Server log files: short-term, for security purposes
• Consultation requests: until processing is complete, thereafter per statutory retention periods
• Requests via forms and the shared history across all channels: until withdrawal, at the latest 24 months after the last contact
• Contacts saved with Anne (name, postcode, date of birth, email address, conversation history): until withdrawal, at the latest 24 months after the last contact
• Protection of the advisory service: conversation times with IP address 7 days, incidents 90 days, blocks until they expire
• Session cookies: automatically deleted after the visit

7. Your Rights

Under the GDPR, you have the following rights:

• Right of Access (Art. 15 GDPR)
• Right to Rectification (Art. 16 GDPR)
• Right to Erasure (Art. 17 GDPR)
• Right to Restriction (Art. 18 GDPR)
• Right to Data Portability (Art. 20 GDPR)
• Right to Object (Art. 21 GDPR)

To exercise these rights against the data controller (MADE-WITH.AI LTD), please contact us at:

Show email

For questions about our education programs, our advisory team can be reached at ....

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, at your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

8. SSL/TLS Encryption

This website uses SSL/TLS encryption to protect your data. You can recognize an encrypted connection by the change from 'http://' to 'https://' in the address bar and the lock symbol.

9. Partner Links, No Analytics Tracking

Our website does not use:

• Google Analytics or similar tracking tools
• Advertising banners or ad servers
• Third-party marketing plugins
• Data brokers or data sellers

Some links to education providers are partner links, for example "Program Details" on a course page or "Request for free" on a provider's brochure. Only when you click such a link does it lead via the server of a partner network to the provider's page: AWIN AG, Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany, or Firstlead GmbH (ADCELL), Rosenfelder Str. 15-16, 10315 Berlin, Germany. The network records the click (including time, IP address and the referring page) and may set a cookie on the provider's page so that a later enrollment or brochure request is attributed to us. We receive a commission for this. From the network we only receive aggregated figures, no information about you. The networks set no cookies on our own website. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in financing our free service). Cookies on the provider's page are governed by that provider's consent request.

Links to providers without a partner program lead unchanged to the provider's course page, with no addition at all. We receive no confirmation of whether or when you enroll.

10. Changes to This Privacy Policy

We reserve the right to update this privacy policy to keep it current and compliant with the law, for example if our technical infrastructure or the service providers we use change.