Privacy Policy

1. Controller

Bunt

Sebastian Maschinski

Pfuelstraße 1

10997 Berlin

Germany

Email: support@bunt-app.de

Phone: +49 176 433 00 342

Website: https://bunt-app.de

2. General Information on Data Processing

Using the Bunt app is generally possible offline and without registration. No personal data is transmitted to us or to third parties unless you actively choose to do so.

• No user account creation
• No advertising
• No analytics or tracking services in the app (see section 9 for the website)
• No location tracking
• We do not share your data with third parties; data is only transmitted when you yourself enable optional features such as iCloud or WebDAV (see sections 3 and 4)

3. Data Processing Within the App

All data entered (e.g. notes, checklists, assessments) is stored encrypted locally on your device.

Without your consent, no synchronization with external servers takes place. Your data remains encrypted on your device.

The data you record in Bunt (e.g. information about students, grades, attendance or notes) is processed by you as a teacher under your own responsibility. We never have access to this data and do not process it, neither as a controller nor as a processor.

Optionally, you can synchronize your data using Apple's iCloud (CloudKit). In this case as well, your data is transmitted to Apple CloudKit only in encrypted form. This is referred to as end-to-end encryption. Without your personal security key, the data cannot be read. Not even by Apple.

The provider of iCloud for users in the EU is:

Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland

4. Optional Features Involving Data Transfer

Some features only transmit data once you enable or use them yourself. In no case do we gain access to your data.

• WebDAV backups: You can upload encrypted backups to a WebDAV server of your choice (e.g. your school's server) and restore them from there. The operator of that server is responsible for it.
• External calendars: With your permission, Bunt reads events from the calendars on your device. You can also subscribe to iCal links; when they are fetched, the respective calendar provider receives your IP address. Subscribed events remain on your device and are not synchronized with iCloud.
• Emails to your course: Bunt creates emails to your course as a draft in the email app on your device. They are sent exclusively through your email provider.
• Reports and exports: PDF reports and exports are created locally on your device. Whether and with whom you share them is entirely up to you.
• Profile pictures: Bunt only uses photos of students that you select yourself. The pictures are stored encrypted on your device. The automatic face detection used for assignment runs exclusively on your device; no image data is transmitted.
• Windows and Android: The Windows and Android versions also store your data locally on your device. Backups can optionally be saved via WebDAV.

5. Managed Configuration (MDM)

Schools can configure Bunt centrally via a mobile device management (MDM) system, for example to preset a WebDAV server, grading keys or working-time defaults, or to block iCloud synchronization.

Bunt reads these settings exclusively from the managed app configuration on your device. Bunt does not send any data to the MDM system or to us. Your school is responsible for the MDM system and for the device data processed through it.

6. App Store (Apple)

To download the app, you use the Apple App Store. The provider for users in the EU is:

Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland

When downloading the app, Apple processes various data (e.g. Apple ID, device data, IP address, payment information).

We have no influence over this data processing. Further information can be found in Apple's privacy policy: Apple Privacy Policy

7. Microsoft Store (Microsoft)

To download the app, you use the Microsoft Store, operated by:

Microsoft Corporation
One Microsoft Way
Redmond, WA 98052
USA

When downloading the app, Microsoft processes various data (e.g. Microsoft account, device data, IP address, payment information).

We have no influence over this data processing. Further information can be found in Microsoft's privacy statement: Microsoft Privacy Statement

8. Google Play (Google)

To download the app, you use Google Play. The provider for users in the EU is:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

When downloading the app, Google processes various data (e.g. Google account, device data, IP address, payment information).

We have no influence over this data processing. Further information can be found in Google's privacy policy: Google Privacy Policy

9. Website Hosting (Vercel)

This website is hosted by:

Vercel Inc.
440 N Barranca Avenue #4133
Covina, CA 91723
USA

Each time you visit, Vercel processes technically necessary data: your IP address, the approximate location derived from it, the date and time of the request, the page requested, the referring page (referrer) and information about your browser and operating system.

The purpose is to deliver the website and to ensure its stability and security, for example to defend against attacks. The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).

Vercel deletes server logs after one hour.

Vercel Inc. is based in the USA. The transfer is based on Vercel's certification under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

10. Website Analytics (Vercel Web Analytics)

On our website, we use Vercel Web Analytics, an analytics service provided by Vercel Inc. (address: see section 8).

• No cookies are set and no information is stored on or read from your device
• Vercel generates a server-side hash from your IP address and browser identifier that groups page views within a single day. Your IP address is only processed transiently and is not stored; the hash is discarded after 24 hours
• The data collected includes page views, referrer, browser and device type, operating system and the approximate location derived from the IP address (country, region, city)
• No cross-site tracking takes place; the data is not combined with other websites or services

The legal basis is our legitimate interest in measuring the reach of and improving our website (Art. 6(1)(f) GDPR). Consent under Section 25 TDDDG is not required, as no information is stored on or read from your device.

The aggregated, non-personal statistics are available to us for 30 days.

Vercel is certified under the EU-U.S. Data Privacy Framework (see section 8).

Note: This analytics applies exclusively to the website. The Bunt app itself does not use any analytics or tracking services.

11. Language Notice in the Browser

If your browser language differs from the language of the page you open, our website shows a one-time notice offering to switch to the matching language version. Your browser language is only evaluated locally in your browser and is not transmitted. If you dismiss the notice or switch languages through it, your browser remembers this so the notice does not appear again.

• Only a yes/no flag (“notice dismissed”) is stored – no language code and no other information
• Storage occurs in your browser's Local Storage, separately for bunt-app.de and bunt-app.com – never on our servers. When you switch via the notice, the flag is passed once as a parameter in the address of the target page so that the other domain does not show the notice again either
• No personal data is stored or transmitted
• No tracking, no profiling, no identification takes place

Storage is based on § 25 (2) No. 2 TDDDG (technically necessary storage for delivering the service explicitly requested by the user – dismissing the notice). No consent is required.

You can delete the flag at any time by removing the browser data for this website in your browser settings. The notice may then appear again.

12. Contact

If you contact us by email, the data you voluntarily provide (e.g. name, email address, message content) will be used exclusively to process your request.

The legal basis is Art. 6(1)(b) GDPR where your request concerns the use of the app, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

We delete your request once it has been fully processed, provided no statutory retention obligations apply.

13. Retention Periods

We store personal data only for as long as necessary for the respective purpose:

• Data in the app: only on your device and in the backups you have enabled (iCloud, WebDAV). You decide when to delete it.
• Contact requests: until fully processed, then deleted unless statutory retention obligations apply.
• Website server logs: one hour.
• Website analytics: hash 24 hours, aggregated non-personal statistics 30 days.
• Language notice: until you delete this website's browser data.

14. Legal Bases

Personal data is processed exclusively on the basis of the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

• Art. 6(1)(b) GDPR – Performance of a contract (support requests concerning the use of the app)
• Art. 6(1)(f) GDPR – Legitimate interest (operation and security of the website, reach measurement, responding to other enquiries)

15. Your Rights

You have the right at any time to:

• Obtain information about the data stored by us (Art. 15 GDPR)
• Request correction of inaccurate data (Art. 16 GDPR)
• Request deletion of your data (Art. 17 GDPR)
• Request restriction of processing (Art. 18 GDPR)
• Object to processing (Art. 21 GDPR)
• Request data portability (Art. 20 GDPR)
• Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

16. Changes to This Privacy Policy

We reserve the right to update this privacy policy in the future to ensure it always complies with current legal requirements.