Updated: 28 September 2026.
Our trainers support your English learning. AI supports selected exercises and the creation of learning materials. Theo is an AI conversation partner; you are speaking with an AI system.
Human responsibility
Editorial responsibility: James Simmonds
AI can make mistakes. Editorial review does not guarantee that every AI response is correct. Please tell us about inaccurate content.
How we label AI content
Our labels are “AI-generated text”, “AI-generated image” or “AI-generated illustrative image”, and “synthetic voice”. The label remains after human review.
These notices explain interaction with AI and the origin of content in the context of the EU AI Act transparency requirements.
Website systems and service providers
| System / provider | Purpose | Data | Storage | Processing location | Legal basis |
|---|---|---|---|---|---|
| Theo — Google Gemini API Provider privacy policy | English speaking practice with an AI conversation partner. | Live microphone audio, conversation context and technical connection data. | We store neither audio nor a transcript of this practice. A daily counter with a hashed IP address and cookie identifier is held in Convex and deleted automatically after seven days. The sp_id cookie expires after one year. Google processes the audio under the Gemini API terms. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Lernziel- und Übungshilfe / Learning-goal and exercise tools Cerebras Provider privacy policy | Act as the first provider for learning-goal analysis and instant exercise generation. | A free-text learning goal or exercise topic, selected language level and exercise type, and, where applicable, the title and topic of a selected lesson. | The provider retains data under its contractual and privacy terms (see link). | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Sofort-Übung (Ersatzanbieter) / Instant exercise (fallback) OpenAI Provider privacy policy | Generate an instant exercise when the first provider is unavailable. | A free-text exercise topic, selected language level and exercise type, and, where applicable, the title and topic of a selected lesson. | The provider retains data under its contractual and privacy terms (see link). | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Newsletter und Kontakt-E-Mails / Newsletter and contact emails Resend Provider privacy policy | Email confirmation and delivery; newsletters only after double opt-in. | Email address, message content and delivery data; contact details supplied with enquiries. | Subscription and consent evidence in Convex while you receive the newsletter. Unconfirmed, unsubscribed and undeliverable addresses are deleted automatically after 30 days. Resend retains delivery data under its terms. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(a) GDPR (consent) for the newsletter; Art. 6(1)(b) GDPR for contact enquiries. |
| Datenbank / Database Convex Provider privacy policy | Manage site content, enquiries, newsletters, exercise and session data. | Form data, consent evidence, pseudonymous counters and session data depending on the exercise. | Storage in our database. Theo counters and sign-up counters are deleted after seven days, unconfirmed, unsubscribed and undeliverable newsletter addresses after 30 days; enquiries and exercise data once they are no longer needed for their purpose. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Anmeldung und Sitzung / Sign-in and session Clerk Provider privacy policy | Manage sign-in and sessions; the Clerk provider is included on every page. | Session and device identifiers and, when a visitor signs in, the account and contact details they submit. | The provider retains data under its contractual and privacy terms (see link). | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for sign-in; Art. 6(1)(f) GDPR for session operation and abuse prevention. |
| Hosting, Web Analytics & Speed Insights Vercel Provider privacy policy | Serve the website and measure visits and technical performance. | HTTP requests, IP address for hosting, page URL, browser and performance data. Newsletter tokens are removed from analytics URLs. | The provider retains data under its contractual and privacy terms (see link). | Servers in Frankfurt am Main (region fra1) and the global delivery network of Vercel Inc. (USA). Transfers rely on the EU-US Data Privacy Framework adequacy decision or on Vercel's EU standard contractual clauses. | Art. 6(1)(f) GDPR: secure delivery of the website and aggregated, cookie-free audience and performance measurement. |
| R2 — Medienauslieferung / Media delivery Cloudflare Provider privacy policy | Deliver images, audio and video. | Media files and technical request data including IP address. | Editorial media remain stored until we remove them. Cloudflare processes technical request data under its terms. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Claude — Anfragebearbeitung / Enquiry support Anthropic Provider privacy policy | Support for enquiry replies and company research when AI processing is enabled. | Enquiry content and any contact details it contains, or company information. | The provider retains data under its contractual and privacy terms (see link). | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Modellvermittlung / Model routing OpenRouter Provider privacy policy | Fallback AI processing for learning-goal analysis, instant exercises, enquiry replies and company research, depending on configuration. | A free-text learning goal or exercise topic with level and exercise type, and prompts containing enquiry or company information; forwarded to the selected model provider. | The provider retains data under its contractual and privacy terms (see link). | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Webrecherche / Web research Tavily Provider privacy policy | Retrieve sources for blog conversations and company research. | Search queries, such as the blog topic or a company name entered by the visitor. | Some research results are cached in Convex. Tavily processes search queries under its terms. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| LiveKit — Avatar-Verbindung / Avatar connection LiveKit Provider privacy policy | Transmit audio, avatar video and session data for interactive exercises. | Live audio, generated video, room identifier and technical connection data. | Transmission happens live through our server; the application stores session data only where the exercise provides for it. | LiveKit server hosted at Hetzner; speech is sent to Google Gemini for the AI response. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| bitHuman — KI-Avatar / AI avatar bitHuman Provider privacy policy | Display a synthetic avatar in sync with the generated voice. | Generated speech, avatar configuration and session data. | Rendering during the session on our server. | Our own server at Hetzner. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
| Avatar-Server / Avatar server Hetzner Provider privacy policy | Host LiveKit and avatar processing. | Connection data, live audio and avatar output during a session. | Processing during the session; technical server logs serve operation. | Hetzner Online GmbH data centre in Nuremberg, Germany. | Art. 6(1)(b) GDPR for the requested service; Art. 6(1)(f) GDPR for operation and abuse prevention. |
Content production
| System / provider | Purpose | Data | Storage | Processing location | Legal basis |
|---|---|---|---|---|---|
| Hume TTS Hume Provider privacy policy | Generate pre-recorded vocabulary and exercise audio. | Editorial text; no live voice from website visitors. | Generated audio is stored as learning material; Hume processes the editorial text under its terms. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(f) GDPR for the editorial production of learning material; visitor input is not used for it. |
| Übungsredaktion / Exercise authoring Cerebras Provider privacy policy | Create exercise texts in the access-controlled studio and administration. | Editorial prompts, selected lessons and uploaded source material. | Created exercises are stored in Convex; Cerebras processes the prompts under its terms. | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(f) GDPR for the editorial production of learning material; visitor input is not used for it. |
| Übungserstellung (Ersatzanbieter) / Exercise generation (fallback) OpenAI Provider privacy policy | Alternative generation of exercises in administration, if configured. | Editorial exercise prompts and learning content. | The provider retains data under its contractual and privacy terms (see link). | The provider's data centres, including in the USA. Transfers rely on the EU-US Data Privacy Framework adequacy decision or on the EU standard contractual clauses in the provider's terms. | Art. 6(1)(f) GDPR for the editorial production of learning material; visitor input is not used for it. |
English conversation practice with Theo (AI)
Our trainers support your English learning. Theo complements this service as an AI conversation partner with a synthetic voice. When you start the practice and allow microphone access, your voice is sent live to the Google Gemini API and processed there so that Theo can answer. We store neither audio nor a transcript of the conversation practice. Google's processing is governed by the Gemini API terms and Google's privacy notice.
To prevent abuse, at most three conversations per day are possible. For this we store a daily counter in our database (Convex) with a hashed value of your IP address and a random identifier from the sp_id cookie. These identifiers are pseudonymous. We delete the counters automatically after seven days. The sp_id cookie contains only this random identifier, expires after one year and is technically necessary for the practice you requested (§ 25 Abs. 2 Nr. 2 TDDDG).
The legal bases are Art. 6(1)(b) GDPR for the practice you started and Art. 6(1)(f) GDPR for abuse prevention; our legitimate interest is to protect the practice from excessive use. Google and Convex also process data in the USA. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on the EU standard contractual clauses in each provider's terms.
Newsletter
Our newsletter is activated only after you confirm by email (double opt-in). Resend delivers the emails and receives your email address and the content of the emails for this purpose. Resend also processes data in the USA; transfers rely on the EU standard contractual clauses in Resend's terms.
In our database (Convex) we store your email address, language, optionally your language level, the page on which you signed up, the text and version of your consent, the times of sign-up and confirmation, and a hashed value of your IP address. The legal basis is your consent (Art. 6(1)(a) GDPR). We keep the evidence of your consent while you receive the newsletter (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
You can withdraw your consent at any time through the unsubscribe link in every email. We delete unconfirmed sign-ups automatically after 30 days. We delete unsubscribed addresses and addresses to which emails could not be delivered after 30 days, counted from the unsubscription or the failed delivery. Counters that protect against mass sign-ups are deleted after seven days. You can request immediate deletion at any time by emailing james@englisch-lehrer.com.
Contact
For questions about AI use, corrections or deletion requests, contact james@englisch-lehrer.com.