Native CebuanoBisaya Buntag Trainer
Log in Get started

Privacy Policy

Last updated: August 2026

1. Who is responsible

Stefan Rosenwald
70563 Affalterbach, Germany
Email: contact@native-cebuano.com
Phone: +49 7144 7062010

As a small, single-person operation, we are not required to appoint a Data Protection Officer. For any privacy question, contact the email address above directly.

2. What data we collect and why

2.1 Account data

When you register, we collect your email address and a hashed password (we never store your password in plain text). This is used to create your account, let you log in, send you access to the trainer, and communicate with you about your purchase. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.2 Email verification

We send a confirmation link to the email address you provide, to verify it belongs to you and to prevent misuse. Legal basis: legitimate interest in account security and fraud prevention (Art. 6(1)(f) GDPR).

2.3 Payment data

Payments are processed by PayPal and, for GCash/Maya, our payment partner PayMongo. We do not receive or store your full card, PayPal, GCash, or Maya login credentials — these are entered directly on the payment provider's own secure page. We only receive confirmation that a payment was completed, and a transaction reference. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Because GCash and Maya operate in the Philippines, using these payment methods may involve your payment data being processed outside the European Economic Area, by PayMongo and the respective wallet provider, under their own privacy and security terms.

2.4 Learning progress

If you use the online trainer, your learning progress (words practiced, streak, review schedule) is stored on our server, linked to your account, so it's available whenever you log in. If you use the downloaded offline version, your progress is stored only in your own browser (or the Claude app environment, if applicable) on your device, and is never transmitted to us.

2.5 Cookies

We use only strictly necessary cookies: a session cookie that keeps you logged in, and a security token that protects our forms from cross-site attacks. These cookies do not track you across other websites, and we do not use analytics, advertising, or marketing cookies. Because these cookies are strictly necessary for the service you requested, they do not require separate consent under Art. 6(1)(b) GDPR / §25(2) TTDSG — but we still show a short notice on your first visit for transparency.

3. Who receives your data

  • Hosting provider: IONOS SE (Germany) — hosts our server, database, and email delivery.
  • Payment providers: PayPal and PayMongo (processing GCash/Maya payments) — receive the data necessary to process your payment.
  • We do not sell your data, and we do not share it with advertisers.

4. How long we keep your data

We keep your account data for as long as your account exists. If you request account deletion (see Section 6), we delete your account and associated learning progress promptly, except where we are legally required to retain certain records (e.g. proof of a completed sale, for a limited period under German commercial and tax law).

5. Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request erasure of your data ("right to be forgotten")
  • Request restriction of processing
  • Receive your data in a portable format
  • Object to processing based on legitimate interest
  • Lodge a complaint with a data protection supervisory authority — in Germany, typically the authority for the state of Baden-Württemberg

To exercise any of these rights, email contact@native-cebuano.com. You can also delete your account yourself at any time from your account page.

6. Account deletion

Since Native Cebuano is a one-time purchase (no subscription), "cancelling" means deleting your account. You can do this yourself from your account dashboard at any time. This permanently removes your login credentials and stored learning progress from our database. It does not affect any offline copy of the trainer you may have already downloaded to your own device.

7. Security

We use industry-standard measures to protect your data: passwords are stored using strong one-way hashing (never in plain text), the site is served over HTTPS, and access to the database is restricted. No system is 100% secure, but we take reasonable, proportionate steps for a service of this size.

8. Changes to this policy

We may update this policy if our practices change, e.g. when adding a new payment method. The "last updated" date at the top will always reflect the latest version.