Privacy notice

Controller

Platon Ivanov
Johannes-R.-Becher 3
Leipzig
Deutschland
Contact: contact@plat.plus

plat.plus is an independent service. Lecturers and students create their accounts themselves. There is no contract with a university.

Account

For your account we store your name and your email address. Without these two we can't create an account. You may add your student ID number (Matrikelnummer). Only the lecturers of the courses you are a member of see it, also in their export, so they can match hand-ins and grades. We also remember your language, your appearance choice and your account settings, so that pages and emails suit you. Legal basis: Art. 6(1)(b) GDPR (terms of use).

plat.plus is open to people of any age. Anyone under 18 needs their parents' consent. For children under 7, the parents create the account. We don't ask for anyone's age.

Sign-in

You sign in with a code by email, and if you like with a password or passkey. You can also turn on a second step. For this we store what you set up: password, passkey and the data for the second step. With each sign-in we store the browser and operating system. This lets you see under Account → Sign-in and security where you are signed in and end sign-ins. We delete these details when you sign out, end the sign-in or the sign-in expires, at the latest with your account. A sign-in expires when you don't use plat.plus in that browser for 60 days. Legal basis: Art. 6(1)(b) GDPR (providing your account).

Sign-in with Google

If you choose this sign-in, we receive your name, email address, an account identifier and the address of your profile picture there, if you have one, from the provider. We also store the access credentials the provider issues for this sign-in. The provider learns that you sign in to plat.plus. These providers also process data in the USA and are certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR. We delete these details with your account.

Course content

Content you add to a course (texts, files, submissions, messages, feedback) is stored to show it to those entitled in the course. Only you and the lecturers see your submissions and feedback, and for a task handed in as a team, your team. Submissions are kept with their feedback for as long as your account, the course and the task exist, also after the semester ends. Legal basis: Art. 6(1)(b) GDPR (terms of use).

When lecturers invite someone to their course by email address, we store that address with the invitation until it is accepted or withdrawn, or expires after 14 days. We then delete it within a day. We don't send the invited person an email. The legal basis is the lecturers' legitimate interest in running their course together (Art. 6(1)(f) GDPR).

We check uploaded files for malware. If we find any, we don't accept the file. We are then told by email what was found, the file's name and size, the course and who tried to upload it. The legal basis is our legitimate interest in protecting everyone who uses plat.plus and the service itself (Art. 6(1)(f) GDPR).

Profile photo and “About me”

Both are optional. Lecturers are visible with photo and text in their courses. For students, their lecturers always see both. Whether other students see their name, photo and text, students decide under Account → Privacy. You can remove the photo at any time, and we then delete it. Legal basis: Art. 6(1)(b) GDPR (terms of use).

Emails

We send sign-in codes, messages from the courses you are a member of and the notifications you chose in your account to your email address. Legal basis: Art. 6(1)(b) GDPR (terms of use).

Device notifications

When you turn on notifications for a device, we store the details needed to deliver them, with the device name and the date. Notifications reach you through the push service of your browser's maker (for example Google, Apple, Mozilla or Microsoft). It only receives encrypted content and sees just when a notification is sent and how large it is. Some of these services are in the USA. Where a provider is certified under the EU-US Data Privacy Framework, the transfer rests on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise it rests on Art. 49(1)(b) GDPR, because you turn the notifications on yourself. You can remove a device at any time under “Notifications” in your account. Signing out removes it automatically. Legal basis: Art. 6(1)(b) GDPR (terms of use).

Meetings

In meetings (course meeting, personal meeting room), picture, sound, shared screens and chat messages go encrypted to the other participants through our own media server (at the same hosting provider as plat.plus). The media server could technically read them. We record nothing and store no picture, sound or chat. When there are two of you in a meeting, your browsers may connect directly. Each browser then sees the other's IP address. For as long as you are connected, the media server processes your IP address and the name you appear under in the meeting. In a course meeting, that is the name the course's students see for you. Guests without an account only give a name. We use it only for that meeting and don't store it. Legal basis: Art. 6(1)(b) GDPR (terms of use).

Live Rooms

In a Live Room, lecturers ask questions that anyone with the Live Room's code can answer, also without an account. We store the questions and each answer with its time. Free-text and Word Cloud answers are stored as they were typed, including any personal details someone writes into them. The results are seen by the course's lecturers, or for a personal Live Room by the person it belongs to. They can show the results to everyone in the Live Room, free texts and words as written. Questions and answers stay stored until the lecturers delete them (then 30 more days in the trash) or until the course or the account is deleted. Legal basis: Art. 6(1)(b) GDPR (terms of use).

AI assistants

You can connect your own AI assistant, such as ChatGPT, Claude or Gemini, to your account. It then reads plat.plus with your rights. What it reads goes to its provider, who processes it under their own terms, depending on the provider also outside the EU. You bring this about yourself by connecting and using the assistant. plat.plus sends it nothing of its own accord.

Other members of your courses, such as your lecturers, can connect their own assistant too. It then receives what that person may see in the course, including your contributions there and, for lecturers, your submissions. You appear in it under a code that stays the same within the course, instead of your name, email address or student ID number. What a text says can still give away who is meant. Anyone who may see you on plat.plus can look up there who is behind your code.

For each connection we store which assistant you connected and when, the access credentials we issue to it, and when and how often it read something. Your code in a course is kept for as long as your account and the course exist. Legal basis: Art. 6(1)(b) GDPR (terms of use). Under Account → Assistants you see your assistants and can disconnect each one. Its access then ends at once, and we delete its access credentials. To prevent abuse, we keep which assistant was connected when and when it read for another 30 days (Art. 6(1)(f) GDPR).

Cookies and browser storage

We store in your browser only what the service you use needs (§ 25(2) no. 2 TDDDG). That is your sign-in, your language and appearance, settings you choose on the pages and in meetings, and technical details so that pages load correctly. If you join a meeting as a guest without an account, your browser also keeps a random identifier, so a host can remove you until the meeting ends. If you open a Live Room, your browser keeps a random pass that lets it answer, a random value for the order of the answers, and your own recent answers, so you see them again after reloading. If you save a page in the demo course or answer in a custom block there, it stays in your browser only, until you reset the demo.

Usage statistics

To improve plat.plus, we count which features are used and how. For this we store the kind of action with details about it (such as file type, count or duration), the time, the device type and your role in the course. You and the course appear in it only under a pseudonym. Nothing is read from or stored on your device for this. The legal basis is our legitimate interest in a well-working service (Art. 6(1)(f) GDPR). You can object at any time: Account → Privacy → “Usage statistics”. The data is deleted after 14 months.

Error reports

When a technical error occurs on plat.plus, in the browser or on the server, an error report is created so we can find and fix it. It holds the page address, the error message with technical details, browser and operating system, and the last page changes and requests to the server before it. These addresses can contain identifiers of, for example, courses, tasks or people. The legal basis is our legitimate interest in a service that works without errors (Art. 6(1)(f) GDPR). We delete each report after 90 days.

Contact form and notices

Messages sent through the contact form are stored with your email address so we can reply (Art. 6(1)(b) GDPR). Notices about illegal content are stored with the details you give, to review them, reply to you and document our decision (Art. 6(1)(c) GDPR with Art. 16 DSA). We delete messages and notices one year after they arrive.

Server and access data

When you visit, the server processes technically necessary access data (IP address, time, requested page) to run the service securely. To prevent abuse we also count, for 30 days, certain actions of an account or an email address, such as requested sign-in codes. The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Hosting: Hetzner Online GmbH (Deutschland). Server logs are kept for: 7 days.

Administration

To run plat.plus and handle requests, only we as the operator see accounts, courses, memberships, contact form messages and notices, in a protected administration area. For each account we also see there when it was last active, which ways of signing in it uses and which actions we counted to prevent abuse. Every access there is logged with the time, the person and the record viewed. We delete each entry after one year. The legal basis is our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).

If an account breaks the terms of use or is misused, we can block it. It is then signed out on every device and can no longer sign in. We keep the time of the block until we lift it or the account is deleted. Legal basis: Art. 6(1)(b) GDPR (terms of use) and our legitimate interest in protecting everyone else (Art. 6(1)(f) GDPR).

Who receives data

We don't pass your data on, except to service providers we need to run the service and who act only on our instructions (processors, Art. 28 GDPR). plat.plus runs on servers in Germany. The encrypted backups are kept by the same provider, also in Germany. No service provider outside the EU receives your data. The only exceptions are signing in through another provider, notifications on devices, an AI assistant and loading a video from YouTube, if you choose to use them, and another member of your courses connecting an AI assistant (see there).

Emails are delivered by Hetzner Online GmbH, Deutschland.

Deleting your account, and how long we keep data

We keep the data of your account for as long as it exists, unless a shorter period is given above. You can delete your account yourself under Account → Privacy (Art. 17 GDPR). You are then signed out on every device, device notifications and calendar subscriptions end, connected assistants can no longer read anything, and you get no more course messages. After 14 days we delete your account with its sign-in data, connected assistants, profile, memberships, hand-ins with their feedback and files (a team's hand-in stays with the team, without your files), settings and queued emails. Until then you can cancel. So that grades aren't lost unnoticed, the lecturers of courses where you handed something in are told the date. Courses and modules only you edit are deleted too. Their members are told beforehand. What you put into courses that others carry on (course page, material, messages) stays there without your name, because it belongs to the course. The legal basis for these notices and for what stays in the course is the legitimate interest of the lecturers and members in their course (Art. 6(1)(f) GDPR). Your account's random ID remains only in the record of a lottery draw, in the usage statistics and for up to a year in the access log of the administration area, with no link to you. The data disappears from the server's backups after three months at the latest.

Go to “Delete account”

If you can no longer sign in, write to us and we will delete the account for you: contact@plat.plus

Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. Just write to us at the contact address above. You can also complain to a data protection authority.

Your right to object

Where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing it, unless we have compelling legitimate grounds or need it to establish, exercise or defend legal claims. You can object to the usage statistics without giving reasons, under Account → Privacy.