Legal
Privacy Policy
Effective 1 June 2026
wealthscan.de ("we", "us") is an independent financial education service. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).
1. Data controller
wealthscan.de
Germany
hello@wealthscan.de
2. What data we collect
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account creation / login | Account lifetime |
| Name (optional) | Google OAuth, used to personalise greetings | Account lifetime |
| Module progress | 8 boolean flags (completed Y/N per module) | Account lifetime |
| Booking details | Name + email pre-filled to Calendly if you book a call | Not stored by us |
| To-do items shared with a booking | Only if you tick “Share these with the advisor” on the booking page: the advisor topics of your open to-do items (e.g. “Company pension (bAV): which provider and contract”) are pre-filled into your Calendly booking and seen by the advisor | Not stored by us; kept by Calendly with the booking |
We do not collect salary details, bank details, investment holdings, or any other personal financial data. We do not run advertising pixels.
Analytics, only if you accept cookies.If you click “Accept” on the cookie banner, we use Google Analytics to count page views and how far learners get through a lesson. Besides page views, it receives these events, and nothing else:
| Event | When | What it carries |
|---|---|---|
| lesson_card_reached | You reach a lesson card for the first time in a visit | Module, card number and id, signed in or not |
| lesson_completed | You reach a lesson's last card | Module, signed in or not |
| commit_submitted | You submit the "what will you do this week" card | Module, how many items, whether you chose "nothing yet", signed in or not |
| todo_signup_prompt_clicked | You tap "Create free account" to save your to-do list | Module |
| pending_todos_saved | To-do items picked before signing up are saved to your new account | How many items |
No event says which to-do items you picked or how you answered a card, and none carries your name, email or any number you enter. If you decline, Google Analytics never loads and none of this is sent.
3. Legal basis
We process your data on the basis of contract performance (Art. 6(1)(b) GDPR) — providing the tutorial service you signed up for. Email is required to create an account; all other fields are optional. Analytics runs only with your consent(Art. 6(1)(a) GDPR), given on the cookie banner.
4. Sub-processors
| Processor | Purpose | Location / note |
|---|---|---|
| Supabase Inc. | Authentication, user database, vector search | EU region (Frankfurt) |
| Calendly | Optional booking of expert calls | Calendly's own privacy policy applies |
| Google Ireland Ltd. | Google Analytics, only after you accept cookies | Data may be transferred to the US (EU-US Data Privacy Framework) |
| Vercel Inc. | Frontend hosting | Edge CDN, no personal data stored |
5. Cookies
We use a session cookie issued by Supabase Auth to keep you logged in. If you answer the short welcome questions (first name, years in Germany, age) before creating an account, we keep those answers in a first-party cookie (ws_onboarding, up to one year) so the lessons can use them; when you sign up or log in they are copied to your account and the cookie is deleted. If you accept analytics on the cookie banner, Google Analytics sets its own cookies (_ga, _ga_*); your choice is remembered in this browser's storage. No advertising cookies. You can clear these by logging out or clearing browser storage.
6. Your rights (GDPR)
- AccessRequest a copy of the data we hold about you.
- CorrectionAsk us to correct inaccurate data.
- ErasureDelete your account and all associated data — use the account settings page or email us.
- PortabilityReceive your data in a machine-readable format.
- RestrictionAsk us to stop processing your data in certain circumstances.
- ObjectionObject to processing based on legitimate interests.
- Withdraw consentWhere processing is consent-based, withdraw at any time.
To exercise any right, email hello@wealthscan.de. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (in Germany: www.bfdi.bund.de).
7. Data transfers outside the EEA
Only if you accept analytics cookies: Google Analytics data may be transferred to Google in the United States under the EU-US Data Privacy Framework. Nothing else we use sends your data outside the EEA.
8. Changes to this policy
We will post material changes here and update the effective date. Continued use after a change constitutes acceptance.