Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Lucas Graf
Weißestraße 36, 04299 Leipzig, Germany
contact@lucasgraf.com

2. Note on the Nature of this Platform

This website is a learning and portfolio project for demonstration purposes, created as part of a training program at the Developer Akademie GmbH. It serves exclusively to showcase programming skills and is not intended for productive, commercial use.

Please do not use real personal data (e.g. your real name, real email address, or a real profile picture) when registering or using this platform — use test or fictitious data instead. Regardless of this notice, we treat all submitted data as if it were personal data and apply the protective measures described below without restriction.

The frontend is based on a template provided by the Developer Akademie GmbH, while the backend was developed independently.

3. Collection and Storage of Personal Data

When using this platform, the following data may be collected:

• Registration data: email address, password (stored encrypted)
• Usage data: viewing history and interactions with videos on the platform
• Technical data: IP address, browser type, operating system, access times

4. Purpose of Data Processing

The collected data is used for the following purposes:

• Providing the platform's functionality (registration, account activation, login, video streaming)
• Sending transactional emails (account activation, password reset)
• Technical administration and security of the website

5. Legal Basis

Processing takes place for the performance of the usage agreement or to carry out pre-contractual measures (Art. 6 (1) lit. b GDPR) and, where you have given consent, on the basis of Art. 6 (1) lit. a GDPR.

6. Disclosure of Data / Service Providers Used

Your data is only disclosed to the following technical service providers required to operate this platform. No data is passed on to third parties for advertising purposes.

• IONOS (IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany) — domain registration and server hosting for the backend (database, API).
• Cloudflare (Cloudflare, Inc., San Francisco, CA, USA) — routing and securing the connection between your browser and our servers. Cloudflare may transfer personal data (in particular IP addresses) to the USA; Cloudflare relies on the EU Commission's Standard Contractual Clauses for this purpose. Privacy policy: cloudflare.com/privacypolicy
• Vercel (Vercel Inc., Walnut, CA, USA) — hosting and delivery of the web interface (frontend). Vercel may also transfer data to the USA, likewise on the basis of Standard Contractual Clauses. Privacy policy: vercel.com/legal/privacy-policy

The legal basis for using these service providers is Art. 6 (1) lit. f GDPR (legitimate interest in a secure and reliable operation of the platform). Where required, data processing agreements or the respective industry-standard data protection agreements are in place with these providers.

7. Storage Duration

Your data is stored for as long as you have an active user account. After your account is deleted, your personal data is removed unless statutory retention obligations apply.

8. Cookies

This website uses a cookie to store the JSON Web Token (JWT) after login. The token is set as an HttpOnly cookie by the backend, meaning it cannot be accessed via JavaScript in the browser. This storage is technically necessary to provide the login and streaming functionality (Art. 6 (1) lit. b GDPR, § 25 (2) no. 2 TDDDG); separate consent is not required. The cookie is only sent to our own backend and is not passed on to third parties.

9. SSL Encryption

For security reasons, this website uses SSL/TLS encryption for the transmission of confidential content.

10. Your Rights

You have the following rights regarding your personal data:

• Access to your stored data
• Rectification of incorrect data
• Erasure of your data
• Restriction of processing
• Objection to processing
• Data portability in a structured, machine-readable format
• Complaint to the competent data protection supervisory authority

11. Contact

If you have any questions about data protection, feel free to contact us at any time at contact@lucasgraf.com.

Last updated: August 2026