Waffensachkunde Pro

1. Controller and scope

The controller for Waffensachkunde Pro is MAtechnologies sp. z o. o., ul. Walowa 14c, 51-523 Wrocław, Poland. Privacy contact: support@matechnologies.eu, phone +48 71 707 21 95. This notice describes processing in the App and associated online features under the GDPR.

The App does not require its own user account. Learning progress and preferences are generally stored locally. Optional AI grading, purchases and technical security checks may nevertheless process data externally. No user account does not mean all requests are anonymous or exclusively local.

2. Local learning progress and preferences

Learning progress, test results, examination statistics and preferences are stored on your device to provide study features. The legal basis is Article 6(1)(b) GDPR where personal-data processing is necessary to perform the contract. Enabling AI alone does not upload an entire exclusively local learning history.

You can delete local data using the reset feature or uninstalling; operating-system backups may follow separate rules. We cannot remotely access or delete data kept exclusively on your device. Device deletion does not erase data or logs already processed externally.

3. Voluntary AI grading: flow, data and consent

When you enable AI grading and submit a written answer, the App sends the request over HTTPS to our Vercel backend. It forwards grading content through OpenRouter to an inference provider running a DeepSeek model. The inference endpoint identified for the service is Wafer in the United States (wafer/us). Actual forwarding also depends on OpenRouter routing and fallback settings. A DeepSeek model does not automatically mean a direct transfer to the DeepSeek company.

Submitted data includes your answer, question identifier, question text, reference answer and, where applicable, category and hint. Results include a score and explanation. On our side, processing serves the requested learning assessment; separate provider processing terms are explained in sections 5 and 6.

Optional submission of answer content relies on consent under Article 6(1)(a) GDPR. You may decline and study without AI. Switch off “KI-Bewertung” in your profile to prevent future App grading requests. You may also withdraw consent using our privacy contact. Withdrawal does not invalidate earlier lawful processing or recall a request already sent. Consent to AI grading is not blanket consent to arbitrary international transfers.

Free text is not automatically fully anonymized. Do not enter names, contact details, health or criminal-offence information, weapons identifiers or other unnecessary personal, sensitive or confidential content. Omitting a name does not rule out personal identification through content or technical data. This notice and the EULA do not replace separately required consent.

4. Technical data, hosting and integrity checks

Our backend and hosting provider process necessary connection data such as IP address, time, App version, request status and error information. Depending on enabled security checks, platform information, integrity proofs and pseudonymous device credentials are processed; Google Play Integrity and Apple App Attest may be used. Operating systems may also send diagnostic or crash information according to their settings.

Purposes are secure operation, troubleshooting, request limits and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting and reliably operating the service. Complete IP anonymization is not promised. OpenRouter and the inference provider receive forwarded grading content and service-related technical metadata; your connection IP at our backend is not automatically the IP a downstream model provider sees.

5. AI recipients and retention

Recipients include Vercel for hosting, OpenRouter, Inc. as AI intermediary and the routed inference provider, including the identified Wafer US endpoint. Model developer and actual inference provider must be distinguished: using a DeepSeek model does not itself establish processing by DeepSeek or in a particular country.

Our grading backend does not maintain its own permanent database of your written answers or learning profiles. Requests are processed to return a grade. Technical operational, security and error logs at hosting and service providers are separate. Their retention depends on service, endpoint and settings and purposes including security, abuse investigation, troubleshooting, billing and legal obligations.

Wafer states that its serverless inference requests do not store prompts or responses; technical request metadata is retained for 365 days according to Wafer. This is provider-specific information, not a guarantee for the full processing chain. OpenRouter retention, possible training use and other inference-provider policies depend on endpoint and settings. We therefore give no unconditional assurance that every request is processed without retention or never used for training. Contact us for information about actual recipients and retention arrangements.

6. International processing

Vercel, OpenRouter, Wafer, RevenueCat and store providers may process data outside the European Economic Area or make it accessible there, particularly in the United States. The identified Wafer endpoint is in the US. Other routed inference providers may use other locations. Exclusive EEA processing is not promised; a DeepSeek model name alone does not establish processing in China.

Personal-data transfers to third countries require an applicable basis under GDPR Chapter V, such as an adequacy decision covering the actual recipient or appropriate safeguards including EU Standard Contractual Clauses with necessary supplementary measures. Consent to learning assessment does not replace this assessment. This notice does not assert that every provider is EU-US Data Privacy Framework certified. Contact us for details of actual locations, recipients and applicable safeguards, and a copy of safeguards where appropriate.

7. Purchases and other communications

Apple and Google process store purchases; this does not give us full card or bank details. RevenueCat supports purchase verification and premium access. Data includes transaction identifier, purchase time, purchase or subscription status and a pseudonymous user identifier. Pseudonymous does not mean anonymous. The legal basis is Article 6(1)(b) GDPR; mandatory accounting relies on Article 6(1)(c).

When you contact us, we process contact details and your message to handle the request, relying on Article 6(1)(b), (c) or (f) depending on its nature. Providing support and resolving legal claims are our legitimate interests. Disclosure to authorities or courts occurs where required by law or another applicable legal basis exists.

8. Retention periods and security

Local data stays on your device until deletion. AI content and technical metadata follow the distinctions and criteria in section 5. Support correspondence is kept as needed to handle requests and, where necessary, resolve legal claims. Purchase and accounting records follow applicable statutory periods; there is no blanket ten-year period for all data.

Online requests and forwarding to OpenRouter are encrypted over HTTPS. Transport encryption does not prevent involved services from processing content needed for grading. Complete security, complete anonymity and uniform zero retention are not promised. Uninstalling or disabling AI does not delete external data lawfully retained; contact us for access or deletion.

9. Automated learning assessment

AI automatically produces scores and learning feedback and may make mistakes. Assessment is not an official examination and does not decide proficiency, admission or weapons permissions. It is not intended as a solely automated decision with legal or similarly significant effects under Article 22 GDPR. You may check feedback against reference material and report errors to us.

10. Your rights

Subject to statutory conditions, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and objection to legitimate-interest processing (21 GDPR). You may withdraw consent for future processing at any time (Article 7(3)). The right to object to direct marketing is unconditional.

Contact support@matechnologies.eu. We normally respond to rights requests within one month and explain any legally permitted extension. For exclusively local data we can only direct you to device-side deletion, and we do not require identity data unnecessary for the request. You may complain to a supervisory authority, particularly where you live, work or consider an infringement occurred (Article 77); in Poland this is the President of UODO. Complaints are not restricted to Poland.

11. Changes to this notice

We update this notice when features, recipients or legal requirements change and identify the revision date. Material changes will be communicated appropriately. Where new processing requires consent, it is obtained separately; publication or continued use does not replace it. Provider information and links below do not replace our own privacy obligations.