Legal
Last updated: 12 October 2026
This policy explains which personal data Kollego processes, why, and what rights you have under the EU General Data Protection Regulation (GDPR). It covers this website and the Kollego app.
Kumar Vivek
Königsberger Straße 35
60487 Frankfurt am Main
Germany
Email: kumarvivek@tashiqa.com · Phone: +49 176 87414824
For any privacy question, contact us at the email address above.
When you open a page, our hosting provider processes technical data your browser sends (IP address, date and time, requested page, browser type) to deliver the page and keep it secure. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). These logs are kept only briefly by the host.
We measure page views with Vercel Web Analytics, which works without cookies and without identifying you: visitors are counted with a hash that changes every day and cannot be linked back to a person. Legal basis: legitimate interest in understanding which pages are useful (Art. 6(1)(f) GDPR).
Fonts are served from our own servers; no data is sent to Google or other font providers.
If you pick a language with the EN / DE switcher, we store that choice in a cookie (kollego-locale, valid for one year) so the website and the app greet you in that language.
To create an account we need your name, email address and a password (stored only as a cryptographic hash by our authentication provider, which also sends password-reset emails). We also store which version of our Terms you accepted and when. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
If you choose Continue with Google, Google Ireland Limited confirms your identity and shares your name and email address with us; we do not receive your Google password or any other Google data. Google acts as an independent controller under its own privacy policy. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
You can reach us through the chat or the Help & feedback form in the app. The chat is provided by Crisp and loads only when you click "Chat"; before that, nothing is sent to Crisp. When you use it, Crisp processes your messages, technical data such as your browser and IP address, and, if you are signed in to the app, the name and email address of your account so we can answer you. Messages sent with the form, and reports sent with the "Report a problem" link under a question (including which question it was), are delivered to us by email. Legal basis: our contract with you where your question relates to it (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete conversations once they are no longer needed.
To teach you and show your progress we store: the exams you prepare for (exam type, planned exam date, daily study goal, target score), your answers to practice questions and how long each answer took, lesson progress, diagnostic and mock-exam results, calculated skill levels, daily study activity (minutes, items, streak), your interface language, and your time zone so days and reminders follow your local time. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).
Your readiness estimate and study plan are calculated automatically from this data. They are practice guidance only and have no legal or similarly significant effect on you (Art. 22 GDPR does not apply).
If you switch on daily reminders in Settings, we email you when you haven't practised yet that day. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in Settings or with the unsubscribe link in every email.
We send emails that are necessary for your account, such as password-reset links. Legal basis: performance of our contract (Art. 6(1)(b) GDPR).
To understand whether our free plan and Prep+ offer work, we record in our own database when your account is shown a plan limit (for example the daily practice limit), opens the price overview, or starts, closes or completes a checkout, together with the time and the page or limit concerned. We do not use third-party analytics or advertising tools for this and do not share it. Legal basis: our legitimate interest in improving our offer (Art. 6(1)(f) GDPR). The records are deleted with your account.
Prep+ is sold by our reseller Paddle.com Market Limited (UK), which acts as Merchant of Record. Paddle processes your payment details, billing address and tax information as an independent controller under its own privacy policy. When you open the checkout, we pass your email address and an internal account ID to Paddle so the purchase is linked to your account. We never see your card details. From Paddle we receive and store the plan, term, amount, currency, a customer ID and a transaction ID so we can grant access and show your purchase history. Legal basis: performance of our contract (Art. 6(1)(b) GDPR). The Paddle checkout script is loaded only when you click a purchase button.
To protect accounts and our support inbox against abuse, we count sign-in, sign-up, Google sign-in, password-reset and support-message attempts per email address, account or IP address. We store only one-way hashes of these values, for at most 2 days. Legal basis: legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).
We use a cookie, kollego_session, which keeps you signed in (valid for 30 days, or until you sign out). If you sign in with Google, a second cookie, kollego_oauth_verifier, secures that sign-in and is deleted after it completes (at most 10 minutes). The kollego-locale cookie remembers your chosen language on the website and in the app. We also store a few preferences in your browser's local storage: your colour theme, whether the sidebar is collapsed, and your last detected time zone. If you open the chat, Crisp stores a cookie and local storage entries so your conversation continues across pages. All of these are strictly necessary for the service you asked for (§ 25(2) TDDDG), so we do not ask for consent. We use no advertising or tracking cookies.
We use these processors, bound by data processing agreements (Art. 28 GDPR):
Where data may be accessed from the USA, transfers are protected by the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 44 ff. GDPR). Paddle (see Purchases) is an independent controller, not our processor.
Deleting your account (Settings → Privacy & data) immediately and permanently removes all of your data from our database. Support messages you sent us (chat or form) are deleted separately once they are no longer needed, or on request.
Your name and email address, plus either a password or a Google account, are required to create an account; without them we cannot provide the service. Everything else (exam date, goals, reminder emails) is optional. There is no legal obligation to provide any data.
You have the right to:
You have the right to object at any time, on grounds relating to your particular situation, to processing of your data that we base on our legitimate interests (Art. 6(1)(f) GDPR), such as security logging and cookieless analytics. We will then stop unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. To object, email kumarvivek@tashiqa.com.
Kollego is intended for university applicants. You must be at least 16 years old to create an account. We do not knowingly collect data from children under 16; if you believe a child has created an account, contact us and we will delete it.
We update this policy when our processing changes. The current version is always available on this page. See also our Terms and Imprint.