Last updated: 12 August 2026
This English text is a translation. The German version is legally authoritative.
The controller responsible for processing personal data in connection with Path to Words is:
Path to Words is a digital vocabulary trainer that can be used as a web app and as an installable Progressive Web App. This privacy notice explains which personal data is processed when you use the website, the app, learning features, imports, payment functions and contact channels.
| Processing and data | Purpose | Legal basis, retention and recipients |
|---|---|---|
| Access to the website and app: IP address, time, requested resource, technical error data, user agent and comparable server log data | Delivery, stability, error analysis and IT security | Article 6(1)(f) GDPR. Legitimate interest in a secure and functional service. Retention and recipients: Usually no more than 30 days. Recipient: hosting and delivery in the USA |
| Cookieless audience measurement: visited page, referrer, country and region, browser and device type, and a short-lived identifier derived from the request. No cookies, no storage on the device, no tracking across sites or devices | Measure reach and page usage in aggregated form and improve the service | Article 6(1)(f) GDPR. Legitimate interest in aggregated audience measurement without identifying individuals. Retention and recipients: The identifier is discarded after 24 hours; only aggregated statistics remain. Recipient: hosting and delivery in the USA |
| Account creation and sign-in: email address, password hash, account status and session data | Create the account, enable sign-in, protect the account and perform the contract | Article 6(1)(b) GDPR. Article 6(1)(f) GDPR additionally applies to security measures. Retention and recipients: Until final account deletion, unless statutory obligations require continued storage. Recipients: database and authentication in the EU, hosting and delivery in the USA |
| Learning use: learning progress, courses, levels, review data, custom words, lists, notes, settings and time zone | Provide learning functions, schedule reviews and synchronise settings | Article 6(1)(b) GDPR. Retention and recipients: Until final account deletion. Recipients: database and authentication in the EU, hosting and delivery in the USA |
| Internal per-account feature counters, for example the number of example sentences opened or audio plays | Calculate Free allowances, prevent allowance abuse and improve features on an aggregated basis | Article 6(1)(b) GDPR for allowances. Article 6(1)(f) GDPR for aggregated product improvement. Retention and recipients: Until account deletion or until account-level attribution is no longer needed. Recipients: database and authentication in the EU, hosting and delivery in the USA |
| Bot and abuse prevention: technical signals, IP address, browser and interaction signals | Prevent automated attacks, abusive registrations and security incidents | Article 6(1)(f) GDPR. Retention and recipients: Only for as long as required for protection, analysis and defence. To limit abuse (e.g. password guessing), we briefly store technical identifiers ourselves (IP address, email address); these entries are deleted automatically after three days at the latest. Recipient: bot and abuse prevention in the USA |
| System and transactional emails: email address, account status, contract data and process data | Confirm registration, handle security processes, send contractual information, payment status, cancellation, withdrawal and deletion messages | Article 6(1)(b) and (c) GDPR. Article 6(1)(f) GDPR additionally applies to security messages. Retention and recipients: After the purpose ends, subject to statutory evidence and retention duties. Recipients: system and transactional email delivery in the EU, email mailbox in Switzerland |
| Purchase and payment: email address, plan, amount, payment method, payment status and purchase history. Full payment data is processed through Stripe | Process payment, activate Premium, administer the contract, comply with tax obligations and handle refunds | Article 6(1)(b) and (c) GDPR. Retention and recipients: Contract data until the contractual relationship ends, billing data for statutory retention periods. Recipients: Stripe in the USA and Ireland, hosting and database where required |
| Withdrawal declarations: name, designation of the contract, email address, an optionally provided reason and the time of receipt; additionally the time of the confirmation email. Withdrawal is also possible without a user account; the data is then stored independently of any account | Proof that and when a withdrawal declaration was received (Section 356a of the German Civil Code) | Article 6(1)(c) GDPR and Article 6(1)(f) GDPR (interest in proof). Retention and recipients: Three years from the end of the year in which the withdrawal was received (Sections 195, 199 of the German Civil Code), then deletion. Recipients: hosting and database as processors, the confirmation email is sent via the transactional email provider in the EU, a copy is received in the email mailbox in Switzerland |
| AI-generated audio | Generate and provide read-aloud audio for learning content | Article 6(1)(b) GDPR. Retention and recipients: Submitted text and generated audio only as required for technical processing; under its own commitment, the provider does not use inputs or outputs to train its models, and short-term storage takes place only for abuse monitoring. Recipient: AI audio service in the USA |
| AI-generated example sentences | Generate and provide example sentences for selected learning content | Article 6(1)(b) GDPR. Retention and recipients: Submitted learning content and results only as required for technical processing; under their own commitments, the providers do not use inputs or outputs to train their models. Recipient: AI example sentence service in the USA |
| Import of custom vocabulary lists: file content, file name, detected columns and imported learning content | Read a user-requested list and convert it into custom words or lists | Article 6(1)(b) GDPR. Retention and recipients: Imported learning content until deleted by the user or the account is deleted; the uploaded file itself is processed only to perform the import and is not stored permanently. Recipients: hosting and database. If the format is unclear, an AI import classification service in the USA is also used |
| AI classification of an unclear import format: a small sample from the uploaded file and technical format information | Identify columns and format so that the requested import can be completed | Article 6(1)(b) GDPR. Retention and recipients: Only for the duration of classification; under its own commitment, the provider does not use inputs or outputs to train its models. Recipient: AI import classification service in the USA |
| Contact enquiries: contact details and message content | Answer enquiries and handle pre-contractual or contractual matters where applicable | Article 6(1)(b) GDPR where a contract is concerned. Otherwise Article 6(1)(f) GDPR. Retention and recipients: Until the enquiry is fully handled, then according to statutory evidence and retention duties. Recipient: email mailbox in Switzerland |
| Language waiting list: email address and requested language | Send one notification when the requested language becomes available | Article 6(1)(a) GDPR. Retention and recipients: Until the notification is sent or consent is withdrawn, then deleted. No newsletter. Recipients: system email delivery in the EU, email mailbox in Switzerland |
| Change of email address: previous and new email address, time and technical log data | Apply the change, detect misuse and evidence the security process | Article 6(1)(b) and (f) GDPR. Retention and recipients: Until the account is deleted. Recipient: database and authentication in the EU |
| Account deletion: deletion request, deletion date, cancellation status and contract status | Carry out the deletion request, provide a 30-day grace period, end an active subscription before deletion and comply with statutory duties | Article 6(1)(b) and (c) GDPR. Article 6(1)(f) GDPR additionally applies to the grace period as protection against accidental or abusive deletion. Retention and recipients: Deletion request during the grace period. After final deletion, only data subject to statutory retention remains |
| Inactivity management for Free accounts: last use, warning status and email address | Delete Free accounts after three years of inactivity and two warning emails | Article 6(1)(f) GDPR. Legitimate interest in data minimisation and limiting permanently unused accounts. Retention and recipients: Until reactivation or final deletion. Lifetime accounts are not deleted for inactivity |
Path to Words does not use advertising tools or analytics services that set cookies or recognise individual users. Audience measurement relies solely on the cookieless service described in section 3; it stores nothing on the device and reads nothing from it. Beyond that, only strictly necessary cookies or comparable local storage technologies are used. These include information used for sign-in and sessions, language and display settings.
This storage is necessary to provide the digital service expressly requested by the user. Consent under section 25(1) TDDDG is therefore not required. For this reason, no cookie banner is used.
AI services located in the USA are used for read-aloud audio, example sentences, the classification of a small file sample where an import format is unclear, and, when you add your own words, for determining word type and article and for generating answer options (distractors). Only content required for the relevant function is sent to these services (for your own words, only the entered word pair, for the duration of the request).
AI-generated output may contain errors. It is provided as a learning aid and should be checked against reliable language sources where there is doubt.
Read-aloud audio, example sentences and import classification are provided by the same AI provider (USA); a second AI provider (USA) serves as a fallback for example sentences in case of disruptions. Under their own commitments, both do not use inputs or outputs to train their models. The main provider is certified under the EU-US Data Privacy Framework.
Payments are processed through Stripe's hosted checkout. Stripe processes information including the email address, payment method, payment data, payment status and purchase history. Path to Words only receives information required to allocate the purchase, activate the plan, administer the contract and comply with statutory obligations.
Stripe creates and sends invoices and payment receipts separately.
The contracting entity for payment processing in the European Economic Area is generally Stripe Payments Europe, Ltd. (Ireland); data may be transferred to Stripe, Inc. (USA) in this context. Stripe is certified under the EU-US Data Privacy Framework. Details are set out in Stripe's privacy notices.
Personal data is only disclosed to the following categories of recipients where required for the relevant purpose:
For recipients in the USA, transfers rely on the EU-US Data Privacy Framework where applicable. Where a recipient is not certified, or its certification does not cover the relevant processing, the European Commission's Standard Contractual Clauses and any necessary supplementary safeguards are used.
Switzerland benefits from an adequacy decision. Personal data may therefore generally be transferred to Switzerland without additional safeguards.
Users can schedule deletion of their account in the settings. A 30-day grace period then applies. The deletion can be cancelled during this period. An active subscription is ended before final deletion. After the grace period, the account, learning progress, custom words, lists and notes are permanently deleted unless a statutory retention duty applies.
Invoice and billing data remains stored for the statutory retention periods and is deleted after those periods expire.
Free accounts may be deleted after three years of inactivity. Two warning emails are sent first. Lifetime accounts are not deleted because of inactivity.
A copy or export of personal data can be requested through the contact form. The request will be handled without undue delay and no later than one month after receipt. Depending on the request, the information is provided under the right of access or the right to data portability.
Subject to the statutory requirements, data subjects have the following rights:
To exercise these rights, email info@pathtowords.com or use pathtowords.com/kontakt.
Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Path to Words will then stop processing the relevant data unless compelling legitimate grounds override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.
Consent may be withdrawn at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal. Consent for the language waiting list can be withdrawn through the contact form or by email.
You may lodge a complaint with a data protection supervisory authority. The authority generally responsible for the controller is:
Complaints can be submitted using the complaint forms made available by the authority.
Path to Words does not use solely automated decision-making, including profiling, which produces legal effects concerning a person or similarly significantly affects that person.
Path to Words uses appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access and other security risks. Sign-in credentials are not stored in plain text. Passwords are processed as hashes.
This privacy notice may be updated when functions, service providers or legal requirements change. The current version will be published in the web app. Users will receive appropriate information if a material change affects existing accounts.