Privacy Policy

In short: we collect as little data as possible. There is no advertising, no tracking cookies, no third-party analytics services and no fonts from third-party servers. We count how many people visit the site ourselves, anonymously and without cookies (section 2a). We never need data about students. Please do not give us any.

1. Who is responsible (controller)

HEADUPHIGH GmbH
Langes Kamp 6
59427 Unna
Managing Director: Olga Charlotte Reyes-Busch
Email: hello@neurodivergentclassroom.com

We are not required to appoint a data protection officer under § 38 of the German Federal Data Protection Act (BDSG). For all questions about data protection, you can reach us at the email address above.

2. When you visit the website

The website is delivered via Cloudflare Pages (Cloudflare, Inc., San Francisco, USA). When you access it, your browser transmits, for technical reasons, your IP address, the date and time, the address accessed, the previously visited page and information about your browser and device. Cloudflare processes this data to deliver the pages, fend off attacks and keep operations stable. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). The connection data is deleted after a short time, usually after 30 days at the latest.

We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-U.S. Data Privacy Framework. In addition, the European Commission's standard contractual clauses apply. You can find more information in Cloudflare's privacy policy at cloudflare.com/privacypolicy.

2a. Anonymous visitor counting without cookies

So that we know which pages and printables are needed, our own server counts how often a page is accessed or a printable is downloaded and how many people visit the website on a given day. We do not set any cookies for this, do not store anything on your device and do not use any third-party analytics service.

This is how it works: when a page is accessed, the server creates a check value (hash) from your IP address, your browser identifier, the date and a secret key, which is different every day. It is used only to count several page views on the same day as one visit. We do not store the IP address itself. The check value is deleted the next day; after that, only the number of visits remains. We also note which website someone came from (for example Instagram or a search engine), but only the name of that website, not the full address. We cannot link the stored figures to you as a person.

The legal basis is our legitimate interest in improving our offering and seeing which content helps teachers (Art. 6(1)(f) GDPR). The processing runs on Cloudflare's servers (see section 2); the figures are stored in a database within the jurisdiction of the EU. You can object to the counting at any time (Art. 21 GDPR); a short email is enough.

2b. Our service providers at a glance

• Cloudflare (Cloudflare, Inc., USA): delivery of the website, protection against attacks and our database (Cloudflare D1, stored in the EU). Data processing agreement, Data Privacy Framework and standard contractual clauses (section 2).
• Stripe (Stripe Payments Europe, Ltd., Ireland): payment and invoicing. Stripe is itself responsible for part of the processing; transfer to the USA is possible (section 6).
• Brevo (Brevo SAS, France): sending all emails and the newsletter. Data processing agreement, processing in the EU (sections 7 and 9).

There are no other recipients. We do not sell data and do not pass it on for advertising purposes.

3. What is stored in the browser

We do not set any cookies for advertising or statistics. Our visitor counting (section 2a) also works without cookies. We set only two technically necessary cookies, and only once you enter a code:

• nd_zugang: remembers that you are logged in to the Teacher Portal. It contains the number of your access, the expiry date and a signature that our server uses to check that the cookie is genuine. For free access tied to a list of authorized addresses, it contains the number of your list entry, not your address. It is valid for 30 days and cannot be read by scripts on the page.
• nd_lerntier: remembers that a Learning Animal code was redeemed on this device. It contains the number of the code, the expiry date and a signature, is also valid for 30 days and cannot be read by scripts.

Cloudflare may set a technically necessary security cookie to detect automated attacks. You will find everything explained again in detail, at your own pace, under "Cookies and Crumbs" at the very bottom of the page.

In your browser's local storage (our "crumbs"), we store only what the website needs to function:

• zugang: whether you have unlocked the Teacher Portal,
• geraet: a random device identifier, so that annual access is valid on no more than two devices and a Learning Animal code on no more than three devices,
• ltc_geraet: a random identifier that the Learning Animal Check sends along the first time an answer is tapped,
• ltc_codes_v1: only if you press "Remember in this browser" on the evaluation page, the result codes you entered there,
• dyslexic and spacing: whether you have switched on the reading font or the larger line spacing,
• kekse_ok: that you have already seen the notice about cookies and crumbs.

Answers and results of the Learning Animal Check are not stored, not even in local storage. They exist only in the open tab. If you close it, they are gone.

This information stays on your device. Only the device identifier is sent to our server when a code is redeemed, and the server stores only a check value (hash) of it. Storage is strictly necessary for the function you have requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)). You can delete everything at any time in your browser settings. After that, you will need to enter your code again.

4. Fonts and external content

All fonts are hosted on our own server. We do not embed any content from Google, YouTube, social networks or other providers. Links to other websites, for example to regulations of the German federal states or to professional sources, open only when you click them. From then on, the privacy policy of the respective provider applies.

5. Access to the Teacher Portal

When you enter your access code, our server checks the code. In doing so, we process the code, the check value (hash) of your device identifier, the time of the first and the last login on each device and the expiry date. We store this information in our database at Cloudflare (Cloudflare D1), located in the European Union. The purpose is to check your access and to enforce the limit of two devices. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). We delete the device data 30 days after your access ends.

In addition, for each access we store only the time it was last used, accurate to no more than half an hour. We do not store which pages you access. This lets us see whether an access is being used, for example in the case of access given to teachers as a gift. The legal basis is our legitimate interest in supporting and improving our offering (Art. 6(1)(f) GDPR). The time is deleted together with the access (section 6). You can object; a short email is enough.

If we give away access, we store your name and the email address to which we send the invitation. The code is then valid only together with this address. For free access tied to a list of authorized addresses, we match your email address against this list and delete the address within 30 days after the free access ends for you. The legal basis is Art. 6(1)(b) GDPR.

6. Purchase and payment

To process payment for annual access and Learning Animal codes, we use Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). On the payment page, you enter your data directly with Stripe: name, email address, payment details and your billing address. The billing address is mandatory because Stripe uses it to create your invoice. Stripe also checks the payment for fraud and, among other things, processes your IP address for this purpose. We never see your full card or account details.

After the purchase, we store the following in our own database:

• for annual access: your name, your email address, your access code, the term, the price paid, the identifiers of your payment and of your customer account at Stripe, and the time of your consent to the immediate start (section 10.2 of the Terms),
• for the class set: your name, your email address, your school and its town, the number of Learning Animal codes, your teacher code, the identifier of your payment at Stripe and the time of your consent to the immediate start (section 10.2 of the Terms). The school is also shown on your invoice. We ask for it because the class set is aimed at teachers and we want to avoid orders by students.

We do not store your billing address in our database; it is held by Stripe and appears on your invoice.

For annual access, you can voluntarily state your school and its town and your type of school. This information is sent to us with the order via Stripe and stored with your access. We use it only to develop the Teacher Portal to suit our users. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by email; we will then delete the information.

The legal basis for everything else is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligation to issue invoices and keep accounts (Art. 6(1)(c) GDPR). We retain invoices and accounting records for as long as commercial and tax law require, usually eight to ten years. We automatically delete all other order data, that is, names, email addresses, schools, codes and the associated device check values, three years after the end of the calendar year in which your annual access expired. For the class set, we calculate from the latest possible expiry of the codes, which is three years after purchase (two years for the first redemption, followed by a term of twelve months). This period corresponds to the regular limitation period for possible claims under the contract (§§ 195, 199 German Civil Code (BGB)). We delete your voluntary information earlier if you withdraw your consent.

Stripe may also transfer data to recipients in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission's standard contractual clauses apply. Stripe is itself responsible for part of the processing, for example fraud checks and compliance with financial regulations. You can find more information at stripe.com/de/privacy.

6a. School license for schools

If a school or another institution orders the school license, we process the information from the order form: name of the school, type of school, school authority, billing address (with a different recipient where applicable), name, email address and, voluntarily, the telephone number of the contact person, the school's email domain endings, the selected tier, the number of licenses and classes, the price, voluntarily the Leitweg-ID and a purchase order reference, the time of the order and of the confirmation that the institution is ordering and that the order is authorized, the version of the Terms, the identifiers of the invoice and of the customer account at Stripe, and the times of payment, term, reminder and termination. We need this information to conclude and perform the contract. The legal basis is Art. 6(1)(b) GDPR, and for invoicing and accounting Art. 6(1)(c) GDPR.

Stripe creates the invoice (section 6). For this purpose, we pass the name of the school, the billing address and the email address of the contact person to Stripe. Stripe sends the invoice as a PDF to the contact person. The fee is paid by bank transfer to a payment agent at Stripe. We retain invoices and accounting records for as long as commercial and tax law require. We retain the other order data for as long as it is needed for possible claims under the contract (§§ 195, 199 BGB). It is deleted automatically once three calendar years have passed after the year in which the term ended (for an order that was never paid: after the year of the order).

For each teacher who redeems a school license code, we store the work email address, the code, one check value (hash) per device and the time of last use, accurate to no more than half an hour. We do not store which pages are read. The purpose is to assign the license to one person and to enforce the limit of two devices. The legal basis is Art. 6(1)(b) GDPR (contract with the school) and our legitimate interest in enforcing the license terms (Art. 6(1)(f) GDPR). Teachers can object to the processing under Art. 21 GDPR; a short email is enough. As with every access, we delete the device data 30 days after the end of the term, and the other access data after the period stated in section 6.

We send the order confirmation, codes, renewal reminder and confirmations of termination via Brevo (section 7). The Learning Animal Check under the school license works as described in section 8; we do not store any data about students.

7. Emails about your access and your codes

We send all emails via the Brevo service (Brevo SAS, Paris, France): the order confirmation with your access code or your Learning Animal codes, the two reminders about two weeks and about three days before your annual access ends with the link to renew, confirmations of termination and withdrawal, the one-time code for the Learning Animal Check and invitations to access given as a gift. After an order, termination or withdrawal, our server also sends a short notification with your name and email address to our own mailbox. For this purpose, Brevo processes your email address, your name where applicable, and the content of the email. The legal basis is the performance of the contract or of your request (Art. 6(1)(b) GDPR). We have a data processing agreement with Brevo. The data is processed in the European Union.

8. Learning Animal Check

One-time code to try it out: For this, we process your email address, the code, the school and town you provide, and the time of the request. We need the school information because the Learning Animal Check is aimed at teachers and we want to avoid orders by students. You always receive the one-time code, regardless of whether you sign up for the newsletter. We store the email address for the one-time code for twelve months so that we can answer questions and prevent anyone from requesting several one-time codes. After that, we delete it automatically. The legal basis is Art. 6(1)(b) GDPR.

Class set: What we store at the time of purchase is described in section 6.

When a Learning Animal code is redeemed, our server checks the code. For each code, we store when it was first redeemed and, for each device, a check value (hash) of the random device identifier, so that a code is valid on no more than three devices and a one-time code on one. The first time an answer is tapped, the server counts one session: for the code, the number of sessions, and for our statistics, only the day and the version. With their teacher code, the teacher only sees how many codes have been redeemed and used.

Answers and results remain exclusively in the student's browser and are not transmitted to us. The result code at the end contains no names. The read-aloud function uses only voices that run on the device itself; no text is sent to the internet.

We do not store names or other information about students. The legal basis for the device data is the contract with the teacher who bought the codes and our legitimate interest in enforcing the device limit (Art. 6(1)(b) and (f) GDPR). We delete the device data of a one-time code after 30 days, and the other code data after the period stated in section 6.

9. Newsletter

You receive the newsletter only if you expressly sign up for it: via the sign-up form, when buying annual access or when requesting the one-time code, each time with a separate, voluntary checkbox. The purchase and the one-time code do not depend on it. We use the double opt-in procedure: after signing up, you receive an email with a confirmation link. We add you only once you click it. For this, we give Brevo your email address and, if available, your first name (for a purchase, taken from the name on the payment page). We store the time of sign-up and of confirmation as proof. We delete unconfirmed sign-ups after 30 days. As a thank-you for your confirmed sign-up, we send you a one-time code for the Learning Animal Check once. So that there is only one code per address, even after unsubscribing and subscribing again, we store an irreversible check value (hash value) of your normalized email address for three years and then delete it automatically. The address cannot be recalculated from the check value. Until you confirm, we keep your address for no more than 14 days so that the code arrives after you click the confirmation link. The legal basis for the check value is our legitimate interest in not issuing the code more than once (Art. 6(1)(f) GDPR).

Advent calendar for teachers: The Advent calendar on our page /advent-calendar/ is available to newsletter readers. Anyone who signs up there thereby subscribes to the newsletter (double opt-in as described above) and receives a personal code after confirming. Anyone who already receives the newsletter gets the code without a second confirmation. Anyone who signs up for the newsletter via the regular sign-up form by December 20, 2026 receives the calendar code with the welcome email after confirming, likewise without a further sign-up. For this, we store your email address, the code, the time of sign-up, of sending and of the last login with the code, and, for no more than two devices, an irreversible check value (hash) of a random device identifier. We also store the code as an attribute of your contact in Brevo so that we can remind you of your code on December 1. A technically necessary cookie (nd_advent) remembers that your device is unlocked; it expires when the calendar closes at the end of January 2027. We do not store which doors you open. We delete the Advent calendar data by February 28, 2027 at the latest. The legal basis for the calendar is Art. 6(1)(b) GDPR, and for the newsletter your consent.

We send the newsletter via Brevo (see section 7). We do not evaluate whether you personally open the newsletter or click links. Brevo counts opens and clicks only anonymously, that is, without reference to you as a person, as a total for all recipients. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter or by email to us. We will then delete your address from the newsletter list.

10. Termination and withdrawal via the website

If you submit a declaration via "Cancel contracts here" or "Withdraw from contract here", we store all information from the form, that is, name, email address, details of your contract and, where applicable, a different address for the confirmation, as well as the time of receipt and of confirmation. We need this information to process your declaration and to confirm receipt to you. The legal basis is Art. 6(1)(b) and (c) GDPR. We retain the declaration as proof for four years after receipt and then delete it automatically.

11. Contact by email or form

When you write to us, by email, via the contact form or via the inquiry for schools, we process your name, your email address, for schools the name of the school and the approximate number of teachers, and the content of your message in order to reply to you. Our server forwards messages from the forms via Brevo (see section 7) to our mailbox and does not store them. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, and otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR). We delete the message once the matter has been dealt with, unless we are required to retain it for legal reasons.

12. No data about students

The Teacher Portal and the Learning Animal Check work without names, diagnoses or other information about students. Please do not send us such information, not even by email. If you describe a situation from your classroom, leave out anything that could identify a particular student.

13. Your rights

You have the right of access to your data (Art. 15 GDPR), the right to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)).

Where we process data on the basis of our legitimate interest, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

For all of these requests, an email to hello@neurodivergentclassroom.com is enough.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen) in Düsseldorf (ldi.nrw.de).

14. Automated decisions

We do not make automated decisions and do not create profiles within the meaning of Art. 22 GDPR.

15. Changes

We adapt this policy when our website or the legal situation changes. The version you find here applies.

As of: November 4, 2026