Short version: We collect only the data you give us (email, progress). We never sell it. We use Google Analytics only after you accept in our cookie banner, and Google AdSense advertising only after you consent in a separate, Google-certified consent dialog. You can withdraw either consent, or request deletion of your account data, at any time.
The data controller responsible for processing your personal data is:
E-mail: hello@get-into-finance.com
As we are a small educational project without a physical office, all data inquiries are handled via e-mail. We will respond within 30 days.
We process personal data only where a legal basis applies:
| Processing activity | Legal basis |
|---|---|
| Account creation & authentication | Art. 6(1)(b) GDPR — performance of a contract (providing the service) |
| Saving learning progress, ratings, comments | Art. 6(1)(b) GDPR — performance of a contract |
| Sending password-reset e-mails | Art. 6(1)(b) GDPR — performance of a contract |
| Login persistence ("Remember me" cookie) | Art. 6(1)(b) GDPR — performance of a contract |
| Google Analytics (after consent) | Art. 6(1)(a) GDPR — your explicit consent |
| Personalised advertising (Google AdSense, EEA/UK/CH visitors, after consent) | Art. 6(1)(a) GDPR — your explicit consent, given via our Google-certified Consent Management Platform (CMP) |
| Non-personalised / contextual advertising (Google AdSense) | Art. 6(1)(f) GDPR — legitimate interest in funding a free service through advertising, limited to what does not require consent under Google’s EU user consent policy |
| Essential session cookie (PHPSESSID) | Art. 6(1)(f) GDPR — legitimate interest (site functionality) |
When you register, we store:
password_hash() — the plaintext password is never stored)To deliver the service, we store:
Our hosting provider (IONOS SE, Germany) processes standard web-server logs that may include IP addresses and request timestamps for security and error-diagnosis purposes. These are governed by IONOS’s own privacy policy and are not under our direct control. Log data is typically retained for a maximum of 7 days.
We use the following cookies:
| Cookie name | Category | Purpose | Duration |
|---|---|---|---|
PHPSESSID | Essential | Keeps you logged in during a browser session | Session (deleted when browser closes) |
remember_me | Essential | Restores your session without re-entering your password (“Keep me signed in”) | 30 days |
| (none — stored in your browser’s local storage instead, not a cookie) | Essential | Our consent-management tool (Silktide Consent Manager) remembers your cookie banner choices locally in your browser | Until you clear your browser data or change your choice |
_ga, _ga_* | Analytics (opt-in) | Google Analytics — measures aggregate usage patterns (page views, session duration) | 2 years (Google-controlled) |
e.g. __gads, __gpi, IDE, NID, test_cookie, _gcl_au (list may change — set by Google) | Advertising (opt-in in the EEA/UK/CH) | Set by Google AdSense to deliver, measure and prevent fraud on ads, and — only where you consent via the separate ad-consent dialog — to personalise ads. See section 6 below. | Up to 13 months (consent signal) to 2 years, Google-controlled |
Analytics cookies are only set after you explicitly accept in our cookie banner (provided by Silktide Consent Manager, an open-source consent tool — see silktide.com/consent-manager for how it works). You can reopen this banner and change your choice at any time via the small cookie icon shown in the corner of the screen. Advertising cookies that require consent are only set after you make a choice in the separate Google consent dialog described in section 6. Essential cookies are set regardless of consent because they are strictly necessary for the site to function.
Our cookie banner also shows a “Marketing” option, reserved for possible future advertising/remarketing integrations (e.g. Google Ads conversion tracking). As of the date at the top of this policy, no cookie, script, or tracker is attached to that option — accepting or rejecting it currently has no technical effect. We will update this policy before that changes.
If you consent to analytics, we use Google Analytics 4 (provided by Google LLC, USA). Google may transfer data to servers in the United States. This transfer is covered by Google’s adherence to the EU-US Data Privacy Framework (adequacy decision of the European Commission, July 2023).
You can withdraw your consent at any time via the cookie icon in the corner of the screen (see section 4), or by installing the Google Analytics Opt-out Browser Add-on.
Google’s privacy policy: policies.google.com/privacy
This Service is, or may be, funded in part through advertising delivered by Google AdSense (Google Ireland Limited / Google LLC). To meet Google’s EU user consent requirements for publishers in the European Economic Area, the United Kingdom and Switzerland, we use a Google-certified Consent Management Platform (CMP) that is integrated with the IAB Europe Transparency & Consent Framework (TCF).
If you are visiting from the EEA, the UK or Switzerland, this CMP shows you a separate consent dialog — distinct from, and in addition to, the general cookie banner described in section 4, which only covers analytics — before any advertising cookie that requires consent is set. In that dialog you can:
If you decline, Google may still serve non-personalised, contextual advertising that relies on a narrower legal basis (legitimate interest, limited to what does not itself require consent under Google’s policy — e.g. based on the content of the page rather than your individual profile or browsing history), and on cookies strictly necessary for basic ad delivery, frequency capping, invalid-traffic detection and billing. If you accept, Google and the vendors you approved may additionally use cookies and device identifiers to personalise the ads shown to you and to measure their performance, as described in Google’s Advertising Privacy & Terms and the current list of Google’s Ad Technology Providers.
Recipients and international transfers. Depending on your consent choices, personal data (such as a pseudonymous device/cookie identifier and your approximate, non-precise location derived from IP address) may be processed by Google LLC (USA) and, only for vendors you have individually approved in the CMP dialog, by those third-party advertising vendors, some of which are located outside the EEA/UK/CH. Where data is transferred to the United States, Google relies on its certification under the EU-US Data Privacy Framework (and, where applicable, the UK Extension and the Swiss-US DPF) or on Standard Contractual Clauses as an alternative safeguard.
Managing or withdrawing your ad-consent choices. You can reopen the advertising consent dialog at any time via the “Ad Consent Settings” link in the footer of every page (our general analytics cookie banner is reopened separately, via the cookie icon described in section 4). You can also manage how Google personalises ads across its services directly at myadcenter.google.com or adssettings.google.com, and, if you are located in the EEA/UK/CH, review or withdraw individual vendor consents given under the TCF via the CMP dialog itself. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
We do not ourselves see or store which individual ads are shown to you, and we do not control Google’s or its partners’ ad-targeting logic; our role is limited to displaying the ad units and the consent dialog on our pages.
| Data category | Retention period |
|---|---|
| Account data (email, password hash, timestamps) | Until account deletion is requested |
| Learning progress (completions, saves, ratings) | Until account deletion is requested |
| Comments | Until you delete the comment or request account deletion |
| Password-reset tokens | 1 hour after generation (then invalidated) |
| Remember-me tokens | 30 days from creation |
If you are located in the European Economic Area (EEA), you have the following rights:
To exercise any of these rights, e-mail hello@get-into-finance.com. We will respond within 30 days. We may ask you to verify your identity before processing sensitive requests.
If you believe we have processed your data unlawfully, you have the right to lodge a complaint with a supervisory data protection authority. In Germany, the lead authority is:
Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Str. 153, 53117 Bonn, Germany
www.bfdi.bund.de
We implement appropriate technical and organisational measures to protect your personal data:
HttpOnly, Secure, and SameSite=Lax flags.This service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has registered without parental consent, please contact us and we will delete the account.
We may update this policy. The “Last updated” date at the top reflects the most recent revision. Material changes will be notified via a banner on the site. Continued use after the notification period constitutes acceptance.
For any privacy-related question, contact us at hello@get-into-finance.com.