This policy describes the personal data processed when you visit and use dunudu.com. It describes what the application actually does.

1. Controller

dunudu, 3400 Klosterneuburg, Austria
E-mail: info@dunudu.com

No data protection officer has been appointed; there is no legal obligation to do so.

2. Visiting the website (server and access logs)

Every request causes the server to process technical access data: IP address, timestamp, endpoint called, HTTP status, response time, referrer, user agent, language and a technical session identifier. These logs serve operation, troubleshooting and abuse prevention. To protect against overload, requests are counted and limited per IP address.

Legal basis: legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR).
Retention: automatic deletion after 90 days.

3. First-party usage measurement

If cookies are accepted, the website additionally reports page views and individual interactions to our own server in order to evaluate usage and errors. This evaluation happens exclusively within our own system. Without consent it does not happen at all. No third-party analytics services are used – no Google Analytics, no tag manager, no social media pixels, no advertising networks.

Legal basis: consent (a), revocable at any time – see cookies.

4. User account

An account requires an e-mail address, a password (stored only as a cryptographic hash), a name and the assigned roles. Added to this is the data arising from learning: quizzes taken and their results, learning progress and saved contributions.

Legal basis: performance of a contract (b).
Retention: until the account is deleted.

5. Chat and AI assistants

AI-assisted tutors are the core of the service. Questions you enter, texts you upload and the associated conversation history are transmitted to OpenAI for processing. The history is additionally stored in our system so conversations can be continued and results shown again. Consumption per account is recorded for cost control.

Please do not enter sensitive personal data into the chat or assistants – in particular no health, financial or identity document data, and no data about third parties. The processing takes place outside our sphere of control.

Legal basis: performance of a contract, or consent through active use (b/a). Transfer to OpenAI takes place to the USA on the basis of standard contractual clauses.
Retention: until the history or the account is deleted.

6. E-mail and newsletter

System e-mails (registration confirmation, password reset) and the newsletter are sent via Azure Communication Services. The newsletter requires explicit sign-up with confirmation of the e-mail address (double opt-in); every mailing contains an unsubscribe link. For each dispatch we log which message went to which address at what time and whether delivery succeeded. Open and click tracking is disabled.

Legal basis: contract for system e-mails (b), consent for the newsletter (a).
Retention: dispatch logs 90 days; a subscription lasts until you unsubscribe.

7. Uploaded files and media

Uploaded files and images are stored in Azure Blob Storage. Images are converted server-side into several sizes; metadata they contain (EXIF) is not carried over into the published variants.

Legal basis: performance of a contract (b).

8. Cookies and local storage

Details of cookies, the data stored in your browser and how to withdraw consent can be found on the cookies page.

9. Recipients and processors

• Microsoft (Azure App Service, Azure SQL, Blob Storage, Azure Communication Services) – hosting, database, files and e-mail delivery, EU data centres
• OpenAI – processing of input to chat, assistants and quiz generation (USA, standard contractual clauses)
• mahevi solutions – technical support and maintenance

Data is neither passed on for advertising purposes nor sold.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent given may be withdrawn at any time with effect for the future.

A message to info@dunudu.com is sufficient. Your account can also be deleted via the unregister page.

You have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb.gv.at.

11. Changes

This policy is updated when the processing changes. The version published on this page is the authoritative one.

Last updated: July 2026