← Back to Heureka

Privacy & data

Heureka turns your notes into flashcards and quizzes you with AI-generated questions. To do that, some of your content is sent to external AI providers. This page explains, in plain language, what leaves your account and to whom. The formal data-protection declaration (Datenschutzerklärung) follows at the bottom.

What we store

  • Account: the email address and name from your Google sign-in (used only to log you in and link your data).
  • Your learning data: the cards you create, your reviews and answers, and any files you upload (PDFs, slides, images).
  • Usage & cost logs: which AI calls you made and what they cost, so we can show your spending and enforce limits.

This data is stored on servers operated by Hetzner (data centres in Germany).

Which services process your content

  • Google (Gemini) — your chat messages, card text and uploaded files (PDFs, slides, images) are sent to Google's Gemini models to generate cards, create quiz questions and evaluate your answers.
  • OpenAI — when you answer by voice, the audio recording is sent to OpenAI's Whisper model for transcription. Card text is also sent to OpenAI to create embeddings (used to detect duplicates and power search).
  • DeepSeek — in the background, a hidden fact-check note ("aiContext") is generated from your card text. This text is sent to DeepSeek.
  • Stripe — when you top up credits, your payment is handled by Stripe. We never see or store your card details.
  • Hetzner — hosting and storage of your account and learning data (Germany).

Because these AI providers process content on their own infrastructure, the content you send for AI features may be processed outside the EU/EEA. Don't put data into Heureka that you're not comfortable sending to these providers.

Data-protection declaration (GDPR)

The following is the formal data-protection information pursuant to Art. 13/14 GDPR. It complements the plain-language overview above.

Controller

Tom Skoropinski
TSK Software · Einzelunternehmen
Raiffeisenstraße 2
63633 Birstein
Deutschland
contact@getheureka.com

Legal bases for processing

We process your personal data on the following legal bases (Art. 6 GDPR):

  • Performance of the contract (Art. 6(1)(b)) — running your account and providing the core service: creating cards, generating and evaluating review questions, and the AI features you actively use.
  • Consent (Art. 6(1)(a)) — when you answer by voice, your audio recording is sent to OpenAI (Whisper) for transcription. You give this consent each time you choose to record; you can always type instead.
  • Legitimate interests (Art. 6(1)(f)) — usage and cost logs to display your spending, enforce limits, prevent abuse and keep the service secure and stable.
  • Legal obligation (Art. 6(1)(c)) — retaining payment and accounting records for top-ups as required by tax and commercial law.

Recipients and processors

To provide the service we use the external providers listed above: Google (Gemini), OpenAI (Whisper and embeddings), DeepSeek (background fact-check note), Stripe (payments) and Hetzner (hosting in Germany). Where these providers process personal data on our behalf, this is done under data-processing agreements pursuant to Art. 28 GDPR. We do not sell your data.

Transfers to third countries

Some AI providers (in particular Google, OpenAI and DeepSeek) and Stripe process content on their own infrastructure, which may be located outside the EU/EEA. Such transfers are based on the providers' safeguards, in particular the EU Standard Contractual Clauses. Please do not enter data into Heureka that you are not comfortable sending to these providers.

Storage period

We keep your account and learning data for as long as your account exists. You can request deletion at any time; on account deletion your data is removed. Payment and accounting records are retained for the statutory retention periods (up to 10 years, § 147 AO, § 257 HGB).

Your rights

Under the GDPR you have the right to:

  • access your data (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interests (Art. 21).

You can also withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To exercise these rights, contact us at contact@getheureka.com.

Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, HBDI), Wiesbaden.

Cookies and tracking

Heureka uses only one technically necessary cookie to keep you signed in (session cookie). We do not use analytics or tracking cookies, no advertising, no profiling, and no automated decision-making within the meaning of Art. 22 GDPR.

This declaration is provided to the best of our knowledge and does not constitute legal advice.