Skip to main content

Privacy Policy

Last updated: October 18, 2026

1. Data Controller

The data controller for your personal data is:

kirilof (eenmanszaak)

Vaartweg 17-4, 1211 JD Hilversum, Netherlands

Email: info@inburgering.org

2. What Data We Collect

2.1 Account Data

When you create an account, we receive and store:

  • Your name
  • Your email address
  • Your account ID at Google, Facebook or Apple, if you sign in with one of them
  • A hashed copy of your password, if you sign up with your email address and a password

A hashed copy is a code made from your password. It cannot be turned back into your password.

Inburgering.org, DeutschPass.org and Pamellinika.gr share one account system. If you sign in on more than one of these websites with the same email address, you have one account for all of them. We store that account's data together.

2.2 Usage Data

As you use the Service, we collect:

  • Exercise progress and scores
  • Course completion status
  • Time spent on exercises
  • Your answers to writing and speaking exercises: the text you type, your voice recordings, and the text made from your recordings
  • Your answers in the ONA (Orientation on the Dutch Labour Market) portfolio, such as your desired profession, your work and education history, and practice texts like a CV or an application letter
  • AI feedback and scores on your answers, including an analysis of your pronunciation and a review of your ONA portfolio
  • Page views and navigation patterns
  • Session duration and frequency

We do not store your voice recordings ourselves. We send them to the companies in section 5.1 to make a transcript and give feedback.

If you try exercises or the free level test without an account, we send your answers to the companies in section 5.1 for feedback in the same way. These answers are not linked to an account.

2.3 Technical Data

We automatically collect:

  • IP address
  • Browser type and version
  • Device type
  • Operating system
  • Referring website
  • Analytics and session identifiers that we create ourselves
  • Your cookie preferences
  • Advertising click identifiers, if the link you followed carries one: Google Click ID (GCLID), Microsoft Click ID (MSCLKID) or Facebook Click ID (FBCLID)

2.4 Payment and Conversion Measurement Data

When you make a purchase, we store payment and subscription records needed to provide the Service, including payment ID, amount, currency, purchased course or bundle, billing period, payment method, transaction status, and purchase date.

If you buy a course as a gift, we also store the email address of the person who receives it. We need it to send them the gift.

If you consent to advertising measurement, we may also use purchase details, advertising click identifiers, and a hashed copy of your email address to measure conversions in Google Ads and Microsoft Advertising. We send Google Ads the hashed copy only, never your email address itself.

2.5 Consent Preferences

We store your cookie and measurement consent choice in your browser, together with the date you made it, so that we can respect your choice.

2.6 Forum Data

When you use our forums, we collect:

  • Your forum nickname
  • Your posts and comments
  • The names and descriptions of groups you create
  • Moderation decisions about your posts, comments, groups and nickname

AI checks this content for us. It flags content for us to review. It removes posts and comments that contain child sexual abuse material on its own, without a person checking first.

2.7 Messages You Send Us

When you contact us or use our Telegram bot, we collect:

  • Emails you send to our support address, and our replies
  • Messages you send us on WhatsApp, and your phone number
  • Your Telegram user ID and your settings in our Telegram bot
  • Messages and voice messages you send to our Telegram bot
  • The link between your Telegram account and your account with us, if you connect them

3. How We Use Your Data

We use your personal data for the following purposes:

  • Providing and maintaining the Service, including your account and subscription
  • Processing your payments through Mollie, and through Apple when you buy in our iOS app
  • Generating AI-powered feedback on your writing and speaking exercises and on your ONA portfolio
  • Tracking your learning progress and displaying it to you
  • Checking forum posts, comments, group names and nicknames against our community rules
  • Translating forum posts and comments into other languages
  • Analyzing how people use the Service with our own analytics, to improve it
  • Finding and fixing errors in the Service
  • Measuring the effectiveness of our advertising, where you consent to advertising measurement
  • Communicating with you about your account, subscription, or service changes
  • Answering your questions when you contact us by email or WhatsApp
  • Inviting subscribers to review us on Trustpilot
  • Complying with legal obligations

4. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

  • Contract performance: Processing necessary to provide the Service you subscribed to (account management, exercise delivery, AI feedback, progress tracking, and payment handling)
  • Legitimate interest: Service security, fraud prevention, error monitoring, basic operational analytics that do not require consent, checking forum content against our community rules, translating forum posts, answering your messages, and inviting subscribers to review us
  • Legal obligation: Retaining financial records as required by Dutch tax law
  • Consent: Optional analytics cookies, advertising measurement, Google Ads enhanced conversion measurement, and optional communications where required

5. Who Receives Your Data

We share your personal data with the companies listed in this section, for the reasons given here. We also share it with public authorities, such as the tax authority or the police, when the law requires us to.

We do not sell your personal data to any third party. We share data with Google Ads and Microsoft Advertising only to measure purchases that come from our own ads.

5.1 Service Providers That Process Data for Us

These companies process your data for us, so that we can run the Service:

  • Vercel (website hosting): every request your browser or app sends to us, including your IP address and browser details. Vercel runs the code behind our website and app on servers in London (United Kingdom) and Frankfurt (Germany).
  • DigitalOcean (database and server hosting): all the data we store about you, such as your account, payments, learning progress, forum posts and support messages. DigitalOcean also runs our Telegram bot.
  • Mollie (payments): your name, email address and user ID, the amount, the course you buy, any promotion code or referral discount you use, and the advertising click identifiers from your visit, if there are any. Mollie uses this data to process your payments. Mollie collects your card or bank details itself.
  • OpenAI (AI feedback): the text you type in writing exercises, the text made from your spoken answers, your voice recordings, your ONA portfolio answers, and the answers you send to our Telegram bot. OpenAI scores your answers, analyzes your pronunciation, gives feedback, and reviews your portfolio.
  • OpenAI (forum moderation and translation): your forum posts and comments, the names and descriptions of groups you create, and your nickname. OpenAI checks this content against our community rules and translates posts and comments into other languages.
  • Google (speech-to-text): your voice recordings from speaking exercises on the website and in the app. Google's Gemini service turns your speech into text.
  • ElevenLabs (speech-to-text): your voice recordings from speaking exercises in our Telegram bot, and from speaking exercises on the website and in the app when Google does not turn them into text. ElevenLabs turns your speech into text.
  • Postmark (email delivery): your email address, your name and the content of each email we send you, such as receipts, payment reminders and password-reset links. Postmark also delivers the gift email to the person who receives a gift.
  • Google (Gmail): the emails you send to our support address and our replies, with your name and email address. We use Gmail to receive and answer support emails.
  • Sentry (error monitoring): error reports from our website and app. A report contains technical data, such as your browser type and the page you were on, and can contain your user ID or email address. We use Sentry to find and fix errors.
  • Trustpilot (reviews): if you are a subscriber, your email address and a copy of one check-in email, which includes the name on your account. Trustpilot uses them to invite you to review us. We send the check-in email once, to subscribers whose subscription is active and started at least 7 days ago, and who have completed at least 10 exercises.

We send your answers and recordings to OpenAI, Google's Gemini service and ElevenLabs without your name, email address or user ID. Before we send your ONA portfolio, we remove email addresses, phone numbers, postcodes and street addresses from it. Your answers and posts can still identify you, for example when they contain your name.

OpenAI, Google's Gemini service and ElevenLabs may keep a copy of what we send them for a limited time under their own terms, for example to check for abuse. Deleting your account does not delete these copies straight away.

5.2 Advertising Platforms

These advertising platforms receive purchase data, so that we can measure which of our ads lead to purchases:

  • Google Ads: after you buy a course or make a payment, the time, value and currency of the purchase, the order ID, a hashed copy of your email address, and the Google Click ID if you came from a Google ad.
  • Microsoft Advertising: after your first purchase, if you came from a Microsoft Bing ad, the time, value and currency of the purchase, the order ID, a hashed copy of your email address, and the Microsoft Click ID.

A hashed copy is a code made from your email address. We send the hashed copy only, never your email address itself. If you have an account with the platform, the platform can use the code to recognize you and link the purchase to the ad you saw.

5.3 Companies You Choose to Use

When you use these companies' services together with ours, they receive your data and use it under their own privacy policies:

  • Google, Facebook and Apple (sign-in): if you sign in with one of them, that company confirms who you are and sends us your account ID, name and email address. That company also learns that you use the Service.
  • Apple (App Store): if you buy a subscription in our iOS app, Apple handles the payment and sends us the transaction details.
  • Google Pay: if you pay with Google Pay, Google receives your payment request and your browser details.
  • Telegram: if you use our Telegram bot or join our Telegram groups, Telegram receives your messages, including voice messages.
  • WhatsApp: if you message us on WhatsApp, WhatsApp receives your phone number, your name and your messages.

5.4 Files Loaded From Other Servers

Some pages load files from these companies' servers:

  • Bunny.net: course images and audio
  • Google Fonts: a font, only on the page we show when the website has an error

When a page loads one of these files, your browser sends your IP address and browser details to the company that stores it.

5.5 Debt Collection

If you do not pay an amount you owe us, we may pass your case to a debt-collection agency. The agency then receives your name, your email address, the amount you owe and your payment history.

6. Data Retention

We retain your data as follows:

  • Account data: For as long as your account is active, and up to 12 months after account deletion
  • Usage and progress data: For as long as your account is active
  • Exercise submissions: For as long as your account is active (deleted upon account deletion)
  • Payment records: 7 years after the transaction, as required by Dutch tax law
  • Technical, analytics, and advertising measurement data: Up to 12 months

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you
  • Right to rectification: Request correction of inaccurate personal data
  • Right to erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to restriction: Request that we limit how we use your data
  • Right to data portability: Request your data in a structured, machine-readable format
  • Right to object: Object to processing based on legitimate interest
  • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at info@inburgering.org. We will respond within 30 days.

8. Cookies

We use essential cookies that are strictly necessary for the Service to function, including:

  • Authentication cookies to keep you logged in
  • Session cookies to maintain your browsing session

With your consent, we may also use first-party analytics and advertising measurement cookies or local storage to remember device and session identifiers, cookie preferences, campaign parameters, and advertising click identifiers such as GCLID, MSCLKID and FBCLID. These help us understand how people use the Service and measure purchases from our ads.

We do not use third-party advertising cookies for ad targeting. You can withdraw optional analytics or advertising measurement consent at any time.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encrypted data transmission (HTTPS/TLS)
  • Secure sign-in via Google, Facebook and Apple, or with a password that we store only as a hashed copy
  • Payment processing handled by Mollie, and by Apple in our iOS app — we do not store payment card details

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure.

10. International Data Transfers

Some companies in section 5 are based outside the European Economic Area (EEA), or may process your data there. The United Kingdom and the United States are outside the EEA.

These service providers may process your data outside the EEA:

  • Vercel, including on its servers in London, United Kingdom
  • DigitalOcean
  • OpenAI
  • ElevenLabs
  • Postmark
  • Google (Gemini, Gmail, Google Ads and Google Fonts)
  • Microsoft Advertising
  • Sentry

For each of these transfers, we rely on a safeguard that the GDPR accepts, such as:

  • An adequacy decision: the European Commission has decided that the country protects personal data as well as the EU does
  • The EU-U.S. Data Privacy Framework: the US company has signed up to this scheme, which the European Commission has approved
  • Standard contractual clauses: contract terms, approved by the European Commission, that oblige the company to protect your data

To find out which safeguard applies to a company, or to get a copy of it, email us at info@inburgering.org.

The companies in section 5.3 (Google, Facebook, Apple, Telegram and WhatsApp) may also process your data outside the EEA. They do this under their own privacy policies.

11. Children's Privacy

The Service is not specifically directed at children. We do not knowingly collect personal data from children under 16 without parental consent. If you believe a child under 16 has provided personal data to us without appropriate consent, please contact us at info@inburgering.org, and we will take steps to delete that data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Supervisory Authority

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Website: https://autoriteitpersoonsgegevens.nl

Phone: +31 (0)88 180 52 50

14. Contact

For any questions about this Privacy Policy or your personal data, contact us at:

Email: info@inburgering.org