Skip to main content

Privacy policy

Information about the processing of personal data under the GDPR.

Controller

Blueship Media Limited
Kinyra 28, Office 303
8011 Paphos
Cyprus
Email: td@blueship.media
Phone: +357 9605617

Purposes and legal bases

  • Operating the website (display, stability and security): Article 6(1)(f) GDPR (legitimate interests).
  • Contract and pre-contractual measures (account, platform use and support): Article 6(1)(b) GDPR.
  • Communication (email inquiries): Article 6(1)(b) or (f) GDPR.
  • Legal obligations (retention obligations): Article 6(1)(c) GDPR.

Academies (tenants)

Teach & Grow is a platform where creators can operate their own academies. Depending on the academy, the course provider may act as an independent controller for certain processing, such as content, student management and course communication, while we process data as a processor. The course provider’s notices and privacy information are available in the respective academy.

Hosting (Hetzner) and server logs

Our website and platform are operated in the EU by Hetzner Online GmbH (Germany). When you visit, technically necessary server logs are processed, such as IP address, date and time, requested page or URL, status code and user agent, to ensure secure operation, analyze errors and defend against attacks.

Legal basis: Article 6(1)(f) GDPR (security and stability).

Cookies and campaign attribution

Technically necessary cookies or tokens may be used for login sessions, CSRF protection and security features when you sign in to protected areas.

When a visit contains campaign parameters, we store a first-party cookie named okh_utm for 30 days. It records campaign source, medium, campaign, content and term. These campaign details are associated with the account when you sign up.

Website analytics (Umami Cloud)

We use Umami Cloud to analyze use of the public website. This includes page views, referrers, browser and device information, and country. According to the provider, Umami analytics works without cookies.

Provider information: Umami FAQ and Umami privacy policy.

Account and authentication (magic link)

When you create an academy or sign in, we process your email address in particular. We send a magic link by email for signing in. Technical metadata, such as time, IP address and user agent, may also be processed to secure the system.

Legal bases: Article 6(1)(b) GDPR (contract or pre-contractual measures) and Article 6(1)(f) GDPR (security).

Email delivery (Brevo)

We use Brevo (brevo.com) to send transactional emails, such as magic links, sign-in emails and, where applicable, system notifications. Your email address and the relevant sending or delivery status are processed in particular. Brevo acts as a processor for this purpose.

We do not send newsletters or marketing emails through the platform. If a course provider contacts you about its newsletter or marketing, this generally takes place through its own systems and under its own responsibility. See the notices in the respective academy.

Legal bases: Article 6(1)(b) GDPR (contract or pre-contractual measures) and Article 6(1)(f) GDPR (secure, reliable delivery).

Platform use (courses and progress)

When you use courses, we process data necessary to provide the platform, such as course access, lessons, course progress and the last playback position for videos. This lets you view content, continue learning and save your progress.

Legal basis: Article 6(1)(b) GDPR (performance of a contract).

Video hosting (Bunny Stream)

We use Bunny Stream (bunny.net) to deliver and play videos. In particular, IP addresses and technical device data are processed for technical delivery.

Legal bases: Article 6(1)(b) GDPR (platform services) and Article 6(1)(f) GDPR (stable delivery).

Payment processing (Digistore24)

Digistore24 handles payment processing for paid upgrades. When you purchase an upgrade, the data required for processing, such as order details, contact information and payment status, is processed between you, Digistore24 and us. Payment details, such as card or bank information, are generally processed directly by Digistore24 and are not stored by us.

Legal bases: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (legal obligations, such as retention).

Contact (email or form)

If you contact us, for example by email or through a contact form that may be provided later, we process your information to handle the inquiry and possible follow-up questions.

Legal bases: Article 6(1)(b) GDPR (pre-contractual or contractual matters) or Article 6(1)(f) GDPR (efficient communication).

Recipients and service providers

We use service providers, including processors where required for operating the platform:

  • Hosting (EU): Hetzner Online GmbH (Germany)
  • Video: Bunny Stream (bunny.net)
  • Email delivery: Brevo (brevo.com)
  • Payment processing: Digistore24
  • Website analytics: Umami Cloud

Retention periods

We keep personal data only as long as necessary for the respective purposes or as required by statutory retention periods.

Specific retention periods:

  • Server logs: 7–30 days, followed by deletion or anonymization.
  • Account data: for as long as the account is active. After cancellation or deletion, data is deleted within 30 days unless statutory retention obligations require otherwise.
  • Course data and content: for as long as the academy is active. After the academy is deleted, data is deleted within 90 days.
  • Payment data (through Digistore24): according to statutory retention obligations, for example ten years for invoices under section 147 of the German Fiscal Code (AO).
  • Email communication: for as long as needed to handle inquiries, then deleted within three years unless statutory retention obligations apply.

After the retention period expires, data is automatically deleted or anonymized unless statutory retention obligations, such as tax obligations, require otherwise.

Transfers to third countries

Hosting currently takes place in the EU. Transfers to third countries are not intended for operating the platform. If service providers outside the EU or EEA are used in individual cases in the future, we will ensure appropriate safeguards, such as EU standard contractual clauses, and update this policy.

Your rights

Subject to the relevant conditions, you have the following rights under the GDPR:

  • Access (Article 15 GDPR): request information about personal data stored about you.
  • Rectification (Article 16 GDPR): request correction of inaccurate data.
  • Erasure (Article 17 GDPR): request deletion of your data unless statutory retention obligations require otherwise.
  • Restriction of processing (Article 18 GDPR): request restriction of processing of your data.
  • Data portability (Article 20 GDPR): request your data in a structured, commonly used, machine-readable format.
  • Objection (Article 21 GDPR): object to processing based on legitimate interests for reasons relating to your particular situation.

How to exercise your rights: Email td@blueship.media or write to the address in the legal notice. State which right you wish to exercise and, where possible, which data is affected. We will handle your request without undue delay and within one month at the latest.

Complaint to a supervisory authority: You also have the right to complain to a data protection supervisory authority if you believe the processing of your personal data infringes the GDPR. The competent authority may be the authority where you live, work or where the alleged infringement occurred.

Policy date

Updated: 13 September 2026.

Other legal documents