This privacy policy informs you about the processing of personal data in the Learn Battle app, in Learn Battle Studio and in the Institute Dashboard. It covers, in particular, institutional evaluations, course documents, and the voluntary use of AI-supported question creation in the app (AI Assistant, using OpenAI by default) and in Studio (AI Assistant and AI Course Creation with Mistral or OpenAI as the selectable provider). Our general privacy policy applies to this website.
Last updated: 11 September 2026
This privacy policy informs you, pursuant to Art. 13 and 14 GDPR, about the processing of personal data in connection with the use of:
The general privacy policy published at learn-battle.de applies to that public website. This notice is a privacy information notice; contractual provisions on data processing on behalf of a controller may be contained in Part B of the Studio Terms.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Lioverse UG (haftungsbeschränkt)
Karl-Arnold-Straße 31
52525 Heinsberg
Germany
Email: datenschutz@learn-battle.de
Represented by: Annika Latz and Dennis Koob
A data protection officer has not currently been appointed. For data protection inquiries, you can reach us at datenschutz@learn-battle.de.
Lioverse UG operates Learn Battle and is responsible for collecting, storing and using the account, learning and usage data described in this notice, as well as for providing the disclosed evaluations. This also applies where an educational institution covers the cost of a license.
Under the institutional license model described here, the educational institution purchases licenses for Learn Battle. Lioverse determines the purposes and essential means of processing within its own service. Funding by the institution does not change this responsibility. An institution admin named by the institution receives access to the license metrics and aggregated usage analytics described in Section 6. Individual analytics on teachers or students are not provided in the institution dashboard.
For personal data of third parties in uploaded course documents and expressly provided AI inputs, Lioverse may, by contrast, act as a processor for the respective responsible teacher or institution. Within this limited area, the client determines the teaching purpose, the content and the recipients; processing is governed by the effectively agreed data processing agreement in Part B of the Studio Terms. The mere purchase of an institutional license does not make the institution the client for all platform processing.
The educational institution receives aggregated metrics through the institution dashboard. The institution admin acts on behalf of the institution. Where such information — for example in small groups or through the institution's additional knowledge — allows conclusions about individual persons, the institution is itself responsible under data protection law for any further use for its own institutional purposes. It must ensure its own legal basis for this and inform the data subjects accordingly. Our responsibility for calculating and providing the evaluations remains unaffected.
We receive data:
Purpose: secure, stable and error-free operation; defense against attacks and misuse. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the security and functionality of our services.
Purpose: registration, login, account administration, authorization checks and provision of the service. Legal basis: Art. 6(1)(b) GDPR. Where institute-admin data is transmitted by an institution and the data subject is not themselves a party to the contract, processing to perform the contract with the institution is based on Art. 6(1)(f) GDPR; the legitimate interest is establishing and administering the agreed access.
To calculate learning progress, game scores and institutional evaluations, usage events may be internally associated with an account via a user identifier. This association is processing of personal data, even where the later display is aggregated or shown without names.
We process this data to provide the learning and game features and your personal learning progress, based on Art. 6(1)(b) GDPR. For the further generation and provision of aggregated course and institution evaluations, as well as for personal releases, the separate information in Section 6 applies.
No decision is made based solely on automated processing with legal or similarly significant effect within the meaning of Art. 22 GDPR.
Public registration is not possible for the Institute Dashboard. After institutional licenses are purchased, we set up institute-admin access for the person named by the institution. Access takes place via Learn Battle Studio at app.learn-battle.de.
We process the personal account and usage information listed here internally to provide and administer Studio access, license administration, and support and onboarding. Institutions receive only aggregated usage analytics under Section 6, not usage reports relating to individual teachers. The legal bases in Section 5.2 apply to account and access administration, and Section 6.4 applies to generating and providing the aggregated evaluations.
Stripe is used exclusively where a teacher pays for a Studio subscription themselves. The purchase and use of an institutional license is not processed via Stripe; no user account data is transmitted to Stripe for this purpose alone.
Purpose and legal basis: contract performance under Art. 6(1)(b) GDPR, and fulfillment of commercial and tax law obligations under Art. 6(1)(c) GDPR.
The institute admin sees the license metrics and aggregated evaluations listed below for the assigned institution. Both teacher usage and student usage are evaluated and displayed only in aggregated form. There are no personal, individual views in the institution dashboard.
6.1.1 License and health metrics
Institution-wide, the number of learning packages and questions created, the content-creation trend, and the number of teachers needing support are also shown. The module overview contains the module name, semester designation, and an activity status derived from aggregated usage values.
6.1.2 Aggregated usage analytics on teachers
Teacher usage is shown in the institution dashboard in aggregated metrics. These include:
No named teacher lists or usage analytics linked to names, email addresses or user identifiers are shown. In particular, the institute admin does not receive information on the last activity, the number of content items created, or the support status of individual teachers. The evaluations serve to assess use of the funded licenses and support needs at an aggregated level.
6.1.3 Aggregated student and learning metrics
For students, the dashboard shows no names, email addresses or user identifiers. Aggregated values are shown, in particular:
To calculate the teacher and student metrics, Learn Battle internally processes personal usage data and user identifiers. Activities, answers and participation are assigned to the respective institution, module or course area. The underlying data remains personal data during this processing. The values shown in the dashboard are aggregated. In small groups, or through combination with additional knowledge, indirect conclusions about individual teachers or learners may nonetheless be possible. Aggregated values are therefore not automatically anonymous.
6.1.4 Access protection
Institute admins may retrieve data only within their released institution area. No cross-institution disclosure takes place. Access is restricted based on the assigned institution, role and authorizations.
The app indicates where a module is managed by a teacher or an admin. For such modules, the responsible teacher and, where a corresponding institution assignment exists, the institute admin may receive aggregated evaluations of usage and learning progress. The underlying learning activities remain associated with the respective account at Learn Battle. The marking is a transparency notice, not consent to an individual, personal analysis.
Separately from the Institute Dashboard, authorized teachers may receive individual learning and progress data of learners where the data subject has separately and actively opted in. The legal basis is Art. 6(1)(a) GDPR. This consent is voluntary and may be revoked at any time with effect for the future. The institute admin does not receive individual student views through their dashboard role.
Revoking an individual opt-in ends any future individual view based on it. Processing for our own learning features and separately justified aggregated evaluations is not automatically ended by this; the respective legal bases and rights continue to apply.
For processing personal data to generate and provide the described aggregated module and institution evaluations, we rely on Art. 6(1)(f) GDPR. Our legitimate interests are administering funded licenses, providing needs-based support, and improving the use of learning offerings based on aggregated metrics. Processing is limited to the assigned licenses and modules and to the recipients described. This does not cover providing individual usage or performance analytics on teachers or learners in the institution dashboard.
You may object to this processing under Art. 21 GDPR on grounds relating to your particular situation. We will review the objection and will not continue processing the affected data unless compelling legitimate grounds, or grounds relating to legal claims, override it. Accepting an institutional license is not a blanket data protection consent.
Teachers may attach documents and learning materials to courses or modules. In doing so, we process:
We store documents on our server infrastructure at netcup in Germany. Storage and the release chosen by the teacher serve to provide course materials. Art. 6(1)(b) GDPR applies to our own account data required to fulfill the usage contract. For personal data of third parties within documents, the responsible teacher or institution must establish the legal basis and provide the required information. Where we process this content on behalf of a controller, we act on its documented instructions and the data processing agreement in Part B of the Studio Terms; Art. 28 GDPR is not itself a permission to collect the data.
Merely attaching, storing or releasing a course document does not result in transmission to Mistral or OpenAI. A transmission only occurs once you provide content as input for one of the AI features described in Section 8, select the provider, and confirm processing in line with the notice provided there.
The uploading teacher determines, within the available settings, whether a document is visible only to themselves or also to authorized app users of the relevant course or module. Learn Battle technically implements this choice. Teachers should review visibility before releasing a document.
Documents may contain personal or confidential information. Teachers and institutions may upload only content for whose processing and provision they hold the necessary rights and legal bases. The Studio Terms exclude special categories of personal data under Art. 9 GDPR, criminal-law data under Art. 10 GDPR, individual grade lists, and unnecessary identification data from regular upload and from AI inputs. Extending this scope requires a separate, permissible agreement and suitable protective measures.
When a document is deleted, the associated extracted texts and embeddings are included in the deletion process. Failed deletions are reprocessed. A document may only continue to exist after a teacher account is deleted where it remains associated with an institutionally managed course or module, a continuing lawful provision is agreed, and the necessary rights exist. For Client Data, the instructions of the party actually responsible and the return and deletion obligations under Part B of the Studio Terms apply. A remaining technical association alone does not justify further storage.
Learn Battle offers AI-supported creation of learning questions both in the Learn Battle app and in Learn Battle Studio. In the app, the voluntary "AI Assistant" feature lets you have learning questions created from an uploaded PDF document or a topic you enter. In Learn Battle Studio, the voluntary "AI Assistant" and "AI Course Creation" features let you have learning questions created from texts or documents you provide yourself; there, you choose Mistral or OpenAI with GPT models as the provider. All AI features are voluntary; manual content creation and the remaining features can be used without using AI.
In the Learn Battle app, the "AI Assistant" feature lets you have learning questions created automatically from an uploaded PDF document or a topic you enter. Use is optional; you can continue to create learning questions manually or use ready-made question packages without using the AI Assistant.
For question creation in the app, we use OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, as the default provider. Unlike in Studio (Section 8.2), there is currently no choice between multiple providers in the app. A separate account with OpenAI or ChatGPT is not required for this.
We transmit to OpenAI the PDF document you uploaded or the topic you entered, including text segments extracted from it, together with the technical work instructions and API metadata required for the task, such as model identifier, request identifier, timestamp, scope and processing status. OpenAI processes this data to generate the output and returns the created learning questions to Learn Battle.
Before content is transmitted, we inform you within the AI Assistant about the processing involved and obtain your separate, unambiguous confirmation. Without this confirmation, no content is transmitted to OpenAI. The information on legal bases and withdrawal in Section 8.4, on processing on our behalf and OpenAI's own purposes in Section 8.5, on the absence of model training in Section 8.6, on storage and deletion in Section 8.7, and on locations of processing and transfers to third countries in Section 8.8 applies equally to this use in the app.
In Studio, you may choose between Mistral AI, 15 rue des Halles, 75001 Paris, France, and OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The connection is made via our respective API integration. A separate account with Mistral or ChatGPT is not required for this.
Your choice applies to the respective creation task. Inputs are transmitted to the selected provider. There is no automatic switch to the other provider, for example in the event of an outage. For a new task, you may choose a different provider and confirm the corresponding processing.
We reserve the right to change the range of AI providers we offer in the app and in Studio, for example by adding a further provider or by restricting or removing an existing provider, including for technical, legal or contractual reasons. Which providers are used, or are available for selection, is always shown transparently in the app and in Studio before use. There is no entitlement to the permanent availability of a specific provider.
We transmit to the provider selected in Studio the texts or document content that you provide as input within the respective Studio AI feature, including text segments extracted from them. This is supplemented by the technical work instructions and API metadata required for the task, such as model identifier, request identifier, timestamp, scope and processing status. The provider processes this data to generate the output and returns the created learning questions to Learn Battle.
Where text recognition or vector representations (embeddings) are required for your document input, the choice of provider also applies to these processing steps. The release covers only the selected input. Switching providers does not automatically result in reprocessing of documents or embeddings already stored with the other provider.
Outside the "AI Assistant" feature in the app described in Section 8.1 and the "AI Assistant" and "AI Course Creation" features in Studio, we do not transmit any further app, learning or dashboard data to the AI providers. In particular, we do not automatically add student answers, learning progress, institution evaluations or other account content as AI input. Personal data may nonetheless be transmitted where it is contained in your texts or documents. Transmission takes place via our servers; a user's own account with Mistral, OpenAI or ChatGPT is not linked to Learn Battle.
Before content is transmitted, we inform you within the respective AI feature about the provider used and the processing involved. Insofar as we are responsible for the transmission and AI processing of your own personal input, this is based on your voluntary consent under Art. 6(1)(a) GDPR. This consent is obtained through a separate, unambiguous confirmation. Without confirmation, no AI task is sent to that provider.
You may withdraw your consent at any time, with effect for the future, via the revocation option provided within the AI feature or by email to datenschutz@learn-battle.de. The lawfulness of processing until revocation remains unaffected. A transmission that has already been completed cannot be undone as a result; your rights to erasure and other data subject rights remain unaffected. Consent given for one provider does not apply to the other.
The account administration required for access verification, task assignment and billing is based on Art. 6(1)(b) GDPR where you are yourself a party to the contract. For business users of a contractually connected institution, Art. 6(1)(f) GDPR applies; our interest is providing and administering the agreed access. We process consent records — including user assignment, provider, timestamp, scope of the declaration and, where applicable, revocation — to fulfil our record-keeping obligation under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
For personal data about other individuals, for example in uploaded materials, the responsible teacher or institution must ensure a legal basis and provide the required information. Your own consent is not consent by those individuals. Within the scope of processing on behalf of a controller, we act on documented instructions under Part B of the Studio Terms. Consent and choice of provider also do not replace the safeguards required for transfers to third countries.
For the commissioned processing of personal AI content, we engage the respective provider used as a processor. Where we process document content ourselves on behalf of a teacher or institution, the AI provider acts, in that respect, as a sub-processor. The contracts and authorizations required for this under Art. 28 GDPR must cover the entire processing chain; choice of provider alone does not replace them. For OpenAI, the Data Processing Addendum forms part of the contractual terms applicable to the API.
Mistral also processes certain data for its own purposes, in particular abuse prevention and operational and usage statistics, in accordance with its terms. For OpenAI, commissioned content processing is governed by the API agreement and DPA; OpenAI's privacy notices apply to business, contact or support data that it processes under its own responsibility. Such data may arise, in particular, in connection with our operation of the API access. Model training on our inputs is not covered by this.
The inputs and outputs transmitted via our API access are not made available for training Mistral's or OpenAI's models. For Mistral, use for training is disabled; OpenAI does not use API content for model training by default. We do not enable any voluntary data sharing for training purposes and do not transmit inputs or outputs as training feedback. This does not constitute a commitment that content is not temporarily cached or reviewed for security purposes at the provider.
At Learn Battle, documents remain on our server infrastructure at netcup in Germany. Learning questions created are stored in accordance with your use. Section 7.4 and the retention criteria in Section 13 apply to documents and associated processing results. Withdrawing AI consent ends any further processing based on it; insofar as no other legal basis exists, the relevant personal data is deleted. Separately stored course materials remain subject to their respective purpose of provision.
Mistral: The retention rules of our API access apply to any temporary storage for task handling, security or abuse prevention. The disabled training use does not amount to an agreed zero data retention.
OpenAI: Security logs may contain inputs and outputs and are stored for up to 30 days by default; longer retention may occur due to statutory obligations or where necessary to avert danger. Depending on the API feature used, additional storage may arise: Responses are retained for at least 30 days by default; files or persistent stores until deletion. Disabling storage of Responses does not automatically prevent security logging. Zero data retention is not committed to for our access. In security cases, authorized personnel may review content.
Deletion within Learn Battle does not automatically and simultaneously delete data already held by the provider. We initiate required deletions within the available procedures and contractual obligations. Statutory retention requirements remain unaffected.
Mistral: According to the provider, the default hosting location is the European Union. Further processing outside the European Economic Area may occur via sub-processors.
OpenAI: When using the API, data may be processed in the USA and other countries outside the European Economic Area. Exclusively European processing is not guaranteed for our integration. OpenAI's European data residency requires separate activation and configuration; it covers supported content processing within the EEA and Switzerland, but not all system, billing, usage and support data.
Transfers to third countries take place under the conditions of Art. 44 et seq. GDPR. For this purpose, OpenAI's DPA provides for EU standard contractual clauses or an applicable adequacy decision. Mistral likewise ensures the safeguards required in each case. Additional protective measures are taken into account where necessary. You may request information and a copy of the relevant safeguards at datenschutz@learn-battle.de.
Where possible, use learning materials without personal data. In particular, remove learner names, grade lists, health data, and other information not required to create the learning questions. Do not upload personal or confidential third-party content unless you are authorized to process and transmit it.
For access, revocation or deletion requests regarding the AI content we have transmitted, you can reach us at datenschutz@learn-battle.de. Further rights and responsibilities are set out in Sections 15 and 16.
Further information on the providers
We engage service providers only insofar as necessary for operation, communication, payment or AI features. These include, in particular:
Where service providers process data on our behalf, contracts under Art. 28 GDPR are in place. Where a provider itself decides on the purposes and means of processing, it acts as an independent controller.
Stripe is used exclusively where a teacher pays for their Studio subscription themselves. The provider is Stripe Payments Europe Ltd., Dublin, Ireland. In this context, Stripe processes the information required for payment and the subscription, in particular payment information and billing data. The legal basis for our processing necessary for this is Art. 6(1)(b) GDPR; statutory retention obligations are based on Art. 6(1)(c) GDPR. Stripe acts as an independent controller for its own payment and compliance services. Learn Battle does not store complete credit card or bank details and receives the necessary payment-status and subscription information.
No payment processing via Stripe takes place for institutional licenses. Student learning data, as well as documents and AI inputs, are not transmitted to Stripe for payment processing.
Further information: stripe.com/de/privacy
If you enable push notifications, we process, in particular, a device-related push token, device platform and notification metadata. Delivery is via Firebase Cloud Messaging by Google Ireland Limited. The legal basis is your consent under Art. 6(1)(a) GDPR. You can disable push notifications at any time in the app or in your device settings. The lawfulness of processing until revocation remains unaffected.
We send necessary emails, such as invitations for institute admins, notices regarding account setup, password resets, and contract-related information. The legal basis is Art. 6(1)(b) GDPR or, for an institution's business contact persons, Art. 6(1)(f) GDPR. Our legitimate interest lies in performing and administering the agreed service.
We store personal data only for as long as necessary for the respective purpose or as required by statutory obligations. In particular, the following criteria apply:
Data necessary to assert, exercise or defend legal claims may continue to be stored, on a restricted basis, until the applicable limitation period expires.
The account and contract data marked as required is needed to set up a user account and provide the agreed service. Without this data, registration or use of the relevant feature is not possible. Optional information and consents are voluntary.
Subject to the statutory requirements, you have the right to:
For processing by Learn Battle, including the calculation and provision of aggregated dashboard evaluations, please direct your requests to datenschutz@learn-battle.de. Where your educational institution independently uses received information with personal data, or is responsible for document content, you may contact the institution directly regarding this. Where we process content only on behalf of a controller, we forward corresponding requests to that controller and support it in fulfilling them.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: ldi.nrw.de
We take suitable technical and organizational measures to protect personal data. These include, in particular, TLS encryption, role- and area-based access rights, access restrictions, security updates, secured deletion procedures, and the separation of institutional data areas.
Under the App Terms, app registration is available from age 13; any required civil-law consents remain unaffected by this. For minors, we take into account the particular need to protect their data. For consents to information-society services under Art. 8 GDPR, persons under 16 require the consent or authorization of their legal guardian. Funding a license through an educational institution does not automatically shift data protection responsibility. The institution is responsible for its own processing, for example its use of the information it retrieves.
We update this privacy policy where features, recipients, the legal situation, or processing operations change. The current version is available in the app, in Studio, and on our website.
For questions about data protection and requests to exercise your rights, please contact datenschutz@learn-battle.de.
For support requests, a contact form is also available in Learn Battle Studio. To process your inquiry, your details are stored as a task in our project management tool ClickUp (ClickUp, Inc., USA). This may result in personal data being transferred to the USA. By submitting the contact form, you consent to this processing (Art. 6(1)(a) GDPR); consent can be revoked at any time.
