Privacy Policy

Last updated: August 2026

1. Controller

BITS Blackrock IT Solutions LLC (operator of the Kabutschi learning platform), Alexandria / Giza, Arab Republic of Egypt · Contact for all inquiries: support@kabutschi.de

2. What data we collect

• Parent account: first and last name and email address (for Firebase Authentication and to match payments).
• Child profile: the child's first name, grade level, school and curriculum (Thuringia or Saxony); a freely chosen username and an encrypted password/PIN for the child login; learning progress (correct/incorrect statistics per subject, topic and day, study time).
• Parent settings: class-test dates entered by parents and an optional monthly budget for the pocket-money reward system, including the chosen display currency (EUR, EGP or USD).
• Payment data: card payments are processed entirely by the payment provider Kashier; card details are handled by Kashier only and never reach our servers. We store the subscription status, amount, time and a transaction reference.
• Technical data: Firebase stores an anonymous device token at login for device pairing.

3. Purpose of processing

• Providing the learning platform and syncing learning progress across devices.
• Handling the subscription (automatic activation after card payment).
• Parent dashboard: showing the child's learning progress to the legal guardian.

4. Legal basis

Processing is based on Egypt's Personal Data Protection Law (Law No. 151 of 2020). The legal bases are performance of the contract (providing the service) and consent. For minor children, parents/legal guardians give consent by registering and creating the child profile.

5. Third parties and data transfer

• Google Firebase (servers in the USA/EU among others): Authentication, Firestore database. Firebase Privacy.
• Vercel (USA): hosting. Vercel Privacy.
• Kashier (Egypt): payment processing (credit card). Kashier.
• Telegram (Telegram Messenger Inc.): an internal operational notification to the operator when a new account or child profile is created. This transfers no names and no email address — only pseudonymous account identifiers (technical IDs) and the grade level.
• Exchange-rate services (open.er-api.com, frankfurter.app): retrieval of the daily EUR→EGP rate to convert the subscription amount. No personal data is transferred, only the rate is fetched.
• MyMemory (translation service, api.mymemory.translated.net): if the optional "Translate" feature is used, only the exercise text in question is sent for translation — no personal data.
• Google Fonts (Google Ireland/LLC): the "Nunito" font is loaded from Google servers for consistent typography. This technically transmits the browser's IP address to Google (USA). No tracking and no profiling takes place; the font is used solely for display. Google Privacy.
• Meta Pixel (Meta Platforms Ireland Ltd.): on the marketing pages (home page, sign-up) we use the Meta Pixel for anonymous reach and campaign measurement. This transmits usage data (including IP address, page viewed, interactions) to Meta (also to the USA). The pixel is never used in the learning area (child app), and no advertising profiling of children takes place. You can object to this measurement by limiting tracking in your browser or using a tracking/ad blocker. Legal basis: our legitimate interest in reach and campaign measurement (Egypt's Personal Data Protection Law No. 151/2020). Meta Privacy.

Cross-border transfer occurs only where necessary to operate the service and where the providers offer appropriate safeguards. Beyond the services listed above, we do not share personal data with third parties. Within the learning area we run no advertising; on the marketing pages we use the Meta Pixel described above for reach measurement.

6. Data storage and deletion

Learning progress data is stored while the account is active. After the account expires or is deleted, data is kept for 90 days and then deleted automatically. On request, we delete data immediately.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing and the right to withdraw consent. Contact: support@kabutschi.de. You may also file a complaint with the competent Egyptian data protection authority.

8. Cookies and local storage

Kabutschi uses browser localStorage for learning progress. On the marketing pages, the Meta Pixel sets cookies for reach measurement (see §5); the learning area (child app) has no tracking and no advertising cookies. You can prevent this measurement via your browser settings or a tracking/ad blocker. In addition, a technical third-party request loads the display font (Google Fonts, §5).

9. No access to camera or microphone

Kabutschi does not request and does not access the camera or microphone. No photos, video or audio recordings are made. The read-aloud feature ("Vorlesen") uses only your device's speech output (speaker) — it does not listen and does not record anything. Likewise, location, contacts and other device sensors are not accessed.

10. Protection of children's data

Kabutschi is intended for children from grade 1 (about 6 years old). The account is created exclusively by parents/legal guardians; they give consent to the processing of their child's data and can withdraw it at any time. From children we collect only what the learning service requires: the first name, grade level, school and curriculum, a username with a PIN, and learning-progress statistics. We do not collect a child's last name, address, photos or location data. Children have no access to payment data or the parent's email address. No profiling for advertising purposes takes place.