Skip to content

Legal

Privacy policy

What data TeachPie processes on www.teachpie.de and app.teachpie.de, for what purposes, with which service providers, and what rights you have.

Privacy Policy for www.teachpie.de and app.teachpie.de

Version: 2.3
As of: 29.09.2026

Diese Datenschutzerklärung beschreibt die Verarbeitung personenbezogener Daten bei der Nutzung der TeachPie-Website und der TeachPie-Webapp. Sie berücksichtigt den technischen Stand der Plattform am 29.09.2026. TeachPie ist eine digitale Bildungsplattform mit Funktionen für Unterrichtsplanung, Lernbegleitung, Klassen- und Schulorganisation, KI-gestützte Inhaltsgenerierung, Analyse-, Prüfungs- und Kommunikationsfunktionen.

Processing is carried out in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable requirements under education and contract law. For certain AI-supported processes, TeachPie also aligns its transparency, documentation and oversight measures with the requirements of the EU AI Act that are already in force and those that are being phased in.

1. Controller and contact

Astep Ahead UG (haftungsbeschränkt) is the controller responsible for processing under the GDPR. Full provider details are available in the legal notice at www.teachpie.de/rechtlich/impressum.

Contact for data protection inquiries: datenschutz@teachpie.de
General contact: kontakt@teachpie.de

2. Role model and data protection classification

TeachPie processes data in different contexts:

  • Individual accounts: For accounts created directly by users, TeachPie is generally the controller responsible for account management, provision and billing.
  • Schools and school authorities: For institutional use, the school or school authority may be the controller. In these cases, TeachPie processes the affected data under a data processing agreement and solely within the documented scope of use.
  • AI-assisted processes: When AI features are used, TeachPie remains responsible for operating the platform; schools and other controllers remain responsible for their own data protection assessments, instructions, information obligations and, where applicable, a data protection impact assessment.

3. What data we process

3.1 Account and profile data

Vorname, Nachname, E-Mail-Adresse, Rollen- und Profilinformationen, Schul- oder Organisationsbezug, Spracheinstellungen, Onboarding-Status sowie, falls angegeben, die freiwillige Selbstbeschreibung „Über mich“ (Abschnitt 3.9).

3.2 Authentication data

Login and session information, hashed password data, identifiers from optional single sign-on via Google or Microsoft, and security-related login and rate-limiting metadata.

3.3 Contract and billing data

Subscription status, billing and booking information, Stripe customer references only when processed through Stripe, payment status, and plan-based usage limits. TeachPie does not store full credit card or bank account details itself.

3.4 Content and lesson data

Lesson plans, materials, whiteboard content, curricula, tasks, simulations, class content, learning progress, learning paths, exam materials, uploaded documents, images, audio content, and other files.

3.5 Communication and AI usage data

Chat histories, prompts, model responses, feedback, reports of problematic content, technical context data relating to AI use, token consumption, and error and quality reports.

3.6 Usage and security data

IP addresses, browser and device information, timestamps, request metadata, system and error messages, security and abuse indicators.

3.7 Learning in a group (“Learn with your class”) and instant learning

Round: A teacher with TeachPie Pro can open a round for their own lesson, unit, material, or a worksheet from the marketplace. The round gets a code and a QR code, stays open for 90 minutes by default and for no more than twelve hours, and can be extended or ended early by the teacher. The following details are stored for the round: code, teacher, source and, where applicable, version, title, subject, and opening, end, and deletion times. Anyone who opens the code sees the title, subject, source type, teacher’s name, and the end time before joining.

Join without an account: Students without an account enter only a first name (up to 40 characters); if it has already been used in the round, a number is added. Teacher approval is not required. To participate in the round, TeachPie creates a placeholder account assigned to the teacher, with no real email address, name, password, or login account; the first name is used only for participation in the round. The session runs via the technically necessary cookie tp_room; it contains a random identifier, of which TeachPie stores only a hash value. The session ends when the round ends, when the teacher removes the person from the round, or when the person selects “Leave round”; in the latter two cases, it is revoked immediately. The person’s last name, email address and IP address are not stored for the round. The IP address is processed briefly when the round is opened and joined to limit the number of attempts (15-minute time window).

Join with an account: Anyone who is signed in learns in the session using their own account. Their first name from their account is used as their name in the session; if none is saved, they enter a name. The learning path from the session stays in their account.

What emerges from the discussion: One learning path per person, linked exclusively to this source and containing the data listed in sections 3.4 and 3.5, in particular the learning workspace, pen and keyboard input, chat history with the learning assistant, voice input, uploaded files and work in progress. To participate, we store the person's name, join time, last activity and assigned learning path.

What the teacher sees: In the round overview, the teacher can see each participant’s name, whether they’re taking part with or without an account, when they joined, their latest activity, and their progress—that is, their current phase and whether they’re finished.

AI processing and costs: The learning companion, voice input and speech output process learners' inputs and work in progress using the AI services listed in Section 5.4 and in the Vendor and Subprocessor List; logging and storage are covered by Section 6. All AI calls and all worksheets in a round are attributed to the teacher who opened the round and count only against their allowance. If it runs out, learners receive only a neutral notice, with no information about the teacher's plan or usage.

Deletion: 14 days after a round ends, an hourly automated process permanently deletes the round, participation records and sessions, and every placeholder account, including its files, learning paths, workspaces, chats, AI logs in the database, and usage data. The only exception is the supervisory logs required under the AI Act (Articles 12, 19, and 26(6) of Regulation (EU) 2024/1689), which are kept in a separate compliance store. They contain the placeholder account ID and the inputs, but no name, and are automatically deleted after 180 days; once the placeholder account has been deleted, the ID can no longer be linked to any person. Learners with an account keep their learning path; only their participation ends with the round.

Start learning right away with your own account: Students with their own accounts can learn from a marketplace worksheet directly, for example by scanning the QR code on the worksheet. Teachers can try out their own materials and worksheets from the marketplace. This creates a personal learning path in the account. When a QR code is opened, TeachPie only counts the number of times each worksheet is viewed per day, without linking views to individuals.

Previous guest access via courses: Access without an account using a course code, with a request and teacher approval, is no longer available. No new guest accesses can be created, and existing guest sessions are no longer active. Course codes now only let users with an account join a course. Any remaining data from the former guest access will be deleted automatically: sessions, including display names and learning progress, 90 days after the last activity; approved requests 90 days after approval; rejected or expired requests after 30 days; and usage records 90 days after booking.

3.8 Photos of worksheets and images in the learning space

Photograph worksheet: Pupils and teachers with their own account can photograph a worksheet in the learning space or select photos from their gallery (up to twelve pages) and use them to start their own learning path. This is not possible without an account, for example in a group session. The browser reduces the size of each page before uploading. The server aligns the pages and removes all embedded metadata before saving, in particular the location (GPS), date and time of capture, and device details. The pages are stored as the person’s private material in TeachPie’s storage in Germany (section 5.1). They do not appear in the material library and cannot be published in the Marketplace; TeachPie also prevents this technically in the database.

AI processing: To help the learning companion recognize the tasks in the photo and learn with the person based on them, page images are processed using the AI services listed in Section 5.4. This creates an outline of the tasks and excerpts from the photo, which are stored with the materials. The learning companion is instructed not to record names or faces in photos. We still recommend that you don't upload photos containing names, faces or other personal information.

Images in the learning space chat: Images and pages of a PDF that someone in the learning room shares in the chat are sent to the learning assistant as part of the message (Section 5.4). TeachPie only stores the number of these in the chat history, not the images themselves; Section 6 applies to monitoring logs. If someone with their own account wants to study using such an image, it becomes private material with its own learning path, just as when taking a photo.

Deletion: A photo belongs to the learning path it started. If the person deletes this learning path, the stored pages, the page images generated from them, the outline and excerpts, as well as the material itself, are deleted; the same applies when the account is deleted (Section 8). Photos that have not resulted in a learning path, for example after an abandoned start, are deleted by an automatic hourly process within one hour at the latest.

3.9 Über mich, Lerngruppe und Merkvorschläge

Über mich: Lehrkräfte und Lernende können freiwillig einen kurzen Text über sich hinterlegen, etwa zu Unterrichtsstil und Erfahrung oder dazu, wie sie gern lernen (höchstens 750 Zeichen), im Onboarding oder jederzeit in den Einstellungen. Der Text ist nur für die Person selbst sichtbar; weder Lehrkräfte noch Schulen noch andere Nutzerinnen und Nutzer sehen ihn. TeachPie gibt ihn bei KI-Aufrufen dieser Person mit, also im Chat und beim Erstellen von Materialien, Stunden, Einheiten und Kursplänen, bei Lernenden an den Lernbegleiter, damit Antworten besser passen (Abschnitt 5.4). Namen, Kontaktdaten und Angaben zur Gesundheit gehören nicht hinein. TeachPie weist darauf hin und fragt vor dem Speichern nach, wenn der Text nach Namen oder Kontaktdaten aussieht; bei Lernenden lassen sich Angaben zur Gesundheit und zu anderen besonderen Kategorien personenbezogener Daten nicht speichern. Löscht die Person den Text, wird er ab sofort nicht mehr verwendet.

Über mich für Lernende: Die Funktion steht Lernenden nur zur Verfügung, wenn TeachPie sie freigeschaltet hat. Bei schulischer Nutzung entscheidet zusätzlich die Schule, ob ihre Lernenden sie nutzen können. Bei Konten ohne Schule bestätigt die Person vor dem ersten Speichern, dass sie mindestens 16 Jahre alt ist oder ihre Eltern einverstanden sind.

Lerngruppe: Lehrkräfte können je Kurs eine kurze Beschreibung der Lerngruppe hinterlegen, etwa zu Größe, Vorwissen, Arbeitsweise und Unterstützungsbedarf der Gruppe insgesamt. Einzelne Personen sollen darin weder genannt noch beschrieben werden; TeachPie weist darauf hin und prüft den Text technisch. Auf Wunsch kürzt TeachPie eine längere Beschreibung mit einem KI-Dienst (Abschnitt 5.4) auf Stichworte und lässt dabei Namen weg; gespeichert wird nur die von der Lehrkraft bestätigte Fassung (höchstens 750 Zeichen), die Langfassung nicht. Die Beschreibung sehen nur Lehrkräfte mit Zugriff auf diesen Kurs, nie Lernende. Sie geht bei der Kursplanung, beim Erstellen von Einheiten, Stunden und Materialien in diesem Kurs und im Chat zu diesem Kurs an die KI-Dienste und wird beim Teilen oder Kopieren von Inhalten nicht mitgegeben.

Merkvorschläge: Sagt eine Lehrkraft im Chat ausdrücklich etwas über sich oder ihre Lerngruppe, kann TeachPie unter der Antwort vorschlagen, diese Aussage in „Über mich“ oder in die Beschreibung der Lerngruppe zu übernehmen. Übernommen wird nur, was die Lehrkraft selbst bestätigt. TeachPie wertet dafür kein Verhalten über mehrere Nachrichten aus und bewertet niemanden. Die Vorschläge lassen sich in den Einstellungen abschalten. Für Lernende gibt es keine Merkvorschläge.

4. Purposes and legal bases

  • Service provision, account management and contract performance: Article 6(1)(b) GDPR.
  • Providing school use as part of the educational mission: At the school level, in particular Art. 6(1)(e) GDPR in conjunction with the applicable school law; TeachPie processes data in this respect only on instructions.
  • Information security, abuse prevention, traceability, product stability: Art. 6(1)(f) GDPR.
  • Compliance with statutory retention, accounting, and accountability obligations: Art. 6(1)(c) GDPR.
  • Learning in a “Learn with Class” round without an account: for school use at the school level, Article 6(1)(e) GDPR in conjunction with the applicable school law; otherwise, Article 6(1)(f) GDPR. The legitimate interest is to conduct a teacher-guided learning session without creating an account. For this purpose, processing is limited to first names, learning activity, and technically necessary session data, and is strictly limited in time (Section 8).
  • Über mich, Lerngruppe und Merkvorschläge: für Lehrkräfte Art. 6 Abs. 1 lit. b DSGVO als freiwillige Funktion des Dienstes, bei schulischer Nutzung auf Ebene der Schule Art. 6 Abs. 1 lit. e DSGVO in Verbindung mit dem jeweiligen Schulrecht; für Lernende Art. 6 Abs. 1 lit. a DSGVO (Einwilligung; bei Konten ohne Schule unter 16 Jahren mit Zustimmung der Eltern nach Art. 8 DSGVO), bei schulischer Nutzung nach Entscheidung und auf der Rechtsgrundlage der Schule. Die Einwilligung lässt sich jederzeit widerrufen, indem der Text gelöscht wird. Besondere Kategorien personenbezogener Daten nach Art. 9 DSGVO sind dafür nicht vorgesehen (Abschnitt 3.9).
  • Optional third-party sign-ins and other voluntary additional features: Art. 6(1)(a) GDPR, where consent is required.

5. Services and infrastructure used

5.1 Core Infrastructure in Germany

TeachPie operates its core platform on its own or dedicated infrastructure in Hetzner Online GmbH data centers in Germany. This includes identity and access management, operational data storage, file processing, and central security and platform functions.

These core systems process, in particular, account data, content data, learning and teaching data, technical usage data, and stored files.

5.2 Current vendor and subprocessor list

The current subprocessors and key technical service providers are maintained in a separate vendor and subprocessor list. The current version is available at www.teachpie.de/rechtlich/vendorliste available on request or provided as an attachment during the institutional contracting process.

New or replacement service providers are added only after a review of data protection, technical and contractual requirements. Statutory or contractual rights to information, notification and, where applicable, objection remain unaffected.

5.3 Authentication and account access

TeachPie uses a central authentication and account access system. Users can optionally sign in with Google or Microsoft. TeachPie receives only the information required for authentication, account assignment and profile linking, such as email address, first and last name, and the relevant provider identifier.

5.4 AI and model providers

TeachPie uses Microsoft Azure AI Foundry for all generative text, teaching, learning support, analysis and correction features, with processing in Germany. Image generation for materials is also handled via Microsoft Azure AI Foundry; speech recognition and speech synthesis are provided via Microsoft Azure Speech or Azure OpenAI, respectively, in each case within the EU. For semantic searches across materials, documents and curricula, TeachPie creates embeddings (vector representations) using Google Gemini Embedding in the EU. Text recognition (OCR) in uploaded documents runs on TeachPie's own infrastructure.

Transactional emails sent via Amazon SES are processed in Germany.

Depending on the feature used, the following data in particular may be transferred to AI services:

  • Prompts and instructions,
  • text excerpts, document contents and structured context data provided by the user,
  • uploaded images or OCR content extracted from them,
  • for searches, the text and page images of uploaded documents, as well as the text of materials and curricula,
  • for speech features, the text to be synthesized and any associated context information.

TeachPie follows the principle of data minimization and advises users not to enter unnecessary personal data or special categories of personal data in free-text prompts. Nevertheless, depending on how the service is used, personal content may be processed if users themselves enter or upload such content.

According to the provider information published for enterprise-oriented services and the contract/product configurations used in each case, customer data is not used to train general-purpose foundation models. However, temporary storage or automated security checks may take place to detect misuse and provide the service.

5.5 Email delivery

Transactional emails, such as those for registration, password resets or billing-related notifications, are sent via Amazon Simple Email Service (SES).

5.6 Payment processing

Payments for self-service subscriptions are processed through Stripe. TeachPie receives status and reference data from Stripe in particular, but not complete payment card details.

6. AI-specific processing, logging, and transparency

TeachPie is designed as an AI-powered assistant system. Final pedagogical, organizational, and assessment-related decisions remain with teachers, schools, and other responsible parties.

To ensure traceability, quality, security monitoring and compliance with documentation requirements, TeachPie stores AI-related data in several places:

  • Chat history: User and model messages are stored in internal application systems so that conversation histories can be displayed and continued in the application.
  • Aufsichtsprotokolle (Compliance-Logs): Für KI-Vorgänge werden strukturierte Protokolle in einem gesonderten internen Speicher abgelegt. Im Lernraum enthalten sie Zeitstempel, Sitzungs- und Rollenbezug, die Eingaben der Lernenden, die Antworten des Modells, Modell- und Token-Metadaten sowie die Aufsichtsereignisse der Lehrkraft; sie dienen dem Nachweis nach der KI-Verordnung (Art. 12, 19 und 26 Abs. 6 der Verordnung (EU) 2024/1689). Bei der Unterrichtsplanung enthalten sie nur Betriebsmetadaten wie Zeitstempel, Rollenbezug, Modell und Tokenverbrauch, aber keine Eingaben und keine Antworten.
  • Voice data: When voice features are used, audio recordings, screenshots and related manifests may be stored in internal storage systems so the feature can be provided and the process documented.

Aus „Über mich“, der Beschreibung einer Lerngruppe und Merkvorschlägen leitet TeachPie keine Bewertung oder Einstufung von Personen ab; die Angaben dienen nur dazu, Vorschläge und Erklärungen passend zu formulieren. Automatisierte Entscheidungen im Sinne von Art. 22 DSGVO finden dabei nicht statt.

The previous statement that prompts and outputs are never stored does not apply to the current platform. Instead, the storage described in this version for product functionality, history, security and traceability applies.

7. Recipients and third-country transfers

The platform’s primary processing takes place on infrastructure in Germany. AI services are used exclusively in Germany or the EU; Amazon SES is used in Germany. Certain features may involve transfers to external providers. This applies in particular to:

  • Microsoft Azure AI Foundry for generative AI features in Germany and for image generation in the EU,
  • Microsoft Azure Speech and Azure OpenAI for speech recognition and speech synthesis in the EU,
  • Google Gemini Embedding for search embeddings in the EU,
  • Google or Microsoft for optional third-party sign-in,
  • Stripe for payment processing for self-service subscriptions or where the specific contract is billed through Stripe,
  • Amazon SES for sending emails in Germany.

Where data is processed outside the EEA in connection with optional services, provider support or future configuration changes, or such access cannot be ruled out, TeachPie bases processing on appropriate safeguards such as adequacy decisions, the EU-US Data Privacy Framework or Standard Contractual Clauses, where applicable. Schools and other controllers must still check whether additional organizational requirements apply to their specific use.

8. Retention period and deletion

  • Account data and user-related content: generally for the duration of the contractual relationship or active use, and afterwards only where statutory retention obligations or legitimate interests in providing evidence apply.
  • “Learn with the class” rounds: A round is open for 90 minutes by default and for a maximum of twelve hours. The session cookie remains valid for up to twelve hours after the round ends and is deleted immediately when you leave. 14 days after the round ends, the round, its participants and sessions, as well as every placeholder account and its learning work, files, AI logs in the database and usage data, are automatically deleted. The oversight logs required under the AI Regulation, without names, are kept for 180 days (Section 3.7). Learners with an account keep their learning path.
  • Photos of worksheets: for as long as the learning path started by the photo exists; when the learning path or account is deleted, pages, page images, outline, excerpts, and material are deleted. Photos without a learning path are automatically deleted after no more than one hour (Section 3.8).
  • Über mich und Lerngruppe: bis die Person den Text ändert oder löscht, „Über mich“ spätestens bis zur Löschung des Kontos, die Beschreibung der Lerngruppe spätestens bis zur Löschung des Kurses. Eine Langfassung vor dem Kürzen wird nicht gespeichert; für die Aufsichtsprotokolle gilt Abschnitt 6 (Abschnitt 3.9).
  • Billing- and tax-related data: in accordance with the applicable commercial and tax retention periods.
  • Aufsichtsprotokolle (KI-Compliance-Logs): 180 Tage, danach werden sie automatisch gelöscht.
  • Prüfungsdaten bei schulischer Nutzung: Prüfungen, Abgaben, Vorbewertungen und Bewertungen bleiben gespeichert, bis die Schule ihre Löschung anweist; die Frist bestimmt die Schule nach ihrem Schulrecht.
  • Datensicherungen: Die Datenbank wird täglich gesichert. Aufbewahrt werden die Sicherungen der letzten 14 Tage, je Woche eine für acht Wochen und je Monat eine für drei Monate; ältere Sicherungen werden automatisch gelöscht. Gelöschte Daten verschwinden aus den Sicherungen mit deren Ablauf, in der Regel spätestens nach drei Monaten. Die Sicherungen liegen in der Kerninfrastruktur in Deutschland.
  • Voice uploads and other temporary artifacts: Depending on the feature and purpose; details may vary according to the feature, tenant requirements, and operational process.

9. Cookies, sessions, and technically necessary storage

TeachPie does not currently use analytics, marketing or advertising trackers. Technically necessary cookies and similar storage technologies are used for specific functions such as authentication, session management, security, “Learn with Class” rounds, and local work and display states. External sign-in providers and the payment page hosted by Stripe are only accessed after an explicit user action. A complete overview of names, purposes and storage periods is provided in the Overview of cookies and browser storage.

For the free teaching tools on teachpie.de, the content entered (such as class lists) generally remains exclusively in the browser on the device being used. The exception is the live tools (live poll, feedback target): anonymous session data and responses are processed on servers in Germany for the duration of the session and automatically deleted after no more than 24 hours; they are not linked to individuals. To improve its services, TeachPie also counts anonymously how often a tool is accessed and used; no cookies are set, and no IP addresses, identifiers or other personal data are stored.

10. Data security

TeachPie setzt angemessene technische und organisatorische Maßnahmen ein, insbesondere rollen- und mandantenbezogene Zugriffsbeschränkungen, verschlüsselte Übertragung, zentrale Authentifizierung, objektbezogene Zugriffskontrolle über signierte URLs, Schutzmechanismen gegen Missbrauch und technische Protokollierung. Weitere Einzelheiten ergeben sich aus den technischen und organisatorischen Maßnahmen (TOMs), die Schulen und Schulträger als Anlage zum Auftragsverarbeitungsvertrag erhalten.

11. Data relating to minors

TeachPie is also used with minors in school settings. Therefore, a higher level of protection applies. Schools and school authorities remain responsible for reviewing and implementing the specific legal basis, information obligations, approval processes, usage rules and, where applicable, a data protection impact assessment for their particular use.

In a “Learn with class” session, learners without an account only need to provide a first name; no last name, email address, or password is collected. Before joining, they see a notice about the deletion period and this statement. We recommend that teachers ask children to enter only their first name or a nickname.

„Über mich“ ist für Lernende nur verfügbar, wenn TeachPie und bei schulischer Nutzung die Schule die Funktion freigegeben haben; bei Konten ohne Schule ist vor dem ersten Speichern die Bestätigung nötig, mindestens 16 Jahre alt zu sein oder die Zustimmung der Eltern zu haben. Die Frage ist bewusst eng gefasst (wie jemand gern lernt), der Text ist nur für die Person selbst sichtbar, und Merkvorschläge gibt es für Lernende nicht (Abschnitt 3.9).

12. Data Subject Rights

Subject to the statutory requirements, data subjects have, in particular, the right to access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, that consent may be withdrawn with effect for the future.

If a school or school authority is the controller, requests of this kind should primarily be directed to them. TeachPie provides support in handling them as part of its contractual and legal obligations.

13. Changes to this statement

This statement is updated when there are significant changes to the product scope, data flows, security measures, subprocessors or legal requirements. The version published at the time, including its date, is authoritative.