Privacy Policy

Last updated: 27 September 2026

This policy explains how AquariumLesson handles personal data when you browse the site, create an account, use My Aquariums or the community, contact us, subscribe to the newsletter, or place an order. It is information about processing, not a request for blanket consent.

How we use data

We process data for the purposes described below. Some processing is needed to provide a page, account, requested feature, transaction, or reply; other processing, such as optional analytics or newsletter emails, depends on your choice. Our legal bases are Article 6(1)(b) GDPR for requested services or steps toward a contract, Article 6(1)(c) for legal obligations, Article 6(1)(f) for the legitimate interests described below, and Article 6(1)(a) where you give consent.

Website delivery and security

When you load a page, technical request data such as IP address, requested URL, time, browser and device information, and error or security signals is processed to deliver the site, maintain availability, and investigate abuse. Hosting and content delivery involve Hostinger and Cloudflare. This is based on our legitimate interest in operating and protecting the service (Article 6(1)(f) GDPR). Security controls may include CleanTalk and Cloudflare Turnstile where relevant. They are not treated as advertising merely because they check requests. Technical logs are retained according to the operational and security need and applicable provider settings; we do not claim a fixed period that has not been verified.

Accounts and authentication

If you register, we process the account details you provide, such as email address, username or display name, profile details, credentials or authentication identifiers, and necessary session information. We use them to create and operate your account, authenticate you, and protect it (Article 6(1)(b) and, for abuse prevention, Article 6(1)(f) GDPR). Registration information required by the form is necessary for an account; providing optional profile details is your choice. Account data is kept while the account is active and thereafter only as needed for legal obligations, security, or specific disputes. A deletion request may not erase every copy or legally required record immediately.

Google Sign-In and One Tap

Google Identity Services may be offered as a sign-in option, including One Tap on supported devices. Choosing this route involves Google processing authentication requests and passing verified identity information, such as a Google account identifier, name, and email address, to AquariumLesson. We use that information for account access under Article 6(1)(b) GDPR. One Tap is an authentication feature, not our analytics or advertising consent. You can use the available non-Google account route instead. Google's own processing and possible international transfers are governed by its service terms and privacy information.

My Aquariums

My Aquariums stores information you enter about your aquariums, livestock, plants, care plans, tasks, water tests, logs, issues, notes, and related photos. We use it to provide the features you request (Article 6(1)(b) GDPR). Some information is private to your account; a public aquarium or profile can expose the fields and media you choose to publish. Do not enter information about other people unless you have a basis to do so. Aquarium records normally remain until you edit or remove them or close the account, subject to necessary backups and legal obligations.

Community, profiles, and submitted content

If you use community features, we process your chosen profile information, posts, comments, reactions, and related moderation data so the feature works and other users can see content you intentionally publish (Article 6(1)(b) GDPR). We may review or restrict content to maintain a safe service and address abuse (Article 6(1)(f) GDPR). Public content may be seen or copied by others while available; changing a visibility setting does not guarantee removal of copies already obtained by third parties. Private account information is not automatically a promotional submission.

Images and media

Images you upload may contain personal information, including visible people, locations, or embedded metadata. We process the files and technical derivatives to show them in the feature you use, manage permissions, and prevent misuse (Article 6(1)(b) and, for security, Article 6(1)(f) GDPR). Visibility depends on the feature and your publication choices; not every upload is public or private. Some older media was stored through a legacy upload path. We are reviewing whether its direct file URLs fully enforce later privacy-setting changes, so you should not assume that changing a setting can retract every previously accessible copy. Contact us if you need help with a particular image.

Contact requests

When you use the contact form, we process the name, email address, topic, page URL if supplied, message, and technical anti-spam data to handle and respond to your request. The form is handled through Elementor and stores a submission and sends an email notification. The legal basis is Article 6(1)(b) GDPR where the request concerns a service or potential contract, otherwise our legitimate interest in answering inquiries (Article 6(1)(f)). The details marked required on the form are needed to send and answer your request; a page URL is optional. We retain the request as long as needed to deal with it and any related follow-up or legal claim. Sending a contact message does not subscribe you to marketing.

Newsletter

If you sign up through the homepage newsletter form, we process your email address and subscription/confirmation status in FluentCRM to send the newsletter on the basis of your consent (Article 6(1)(a) GDPR). New contacts are configured for double opt-in. You can withdraw consent using the unsubscribe option in an email or by contacting us. Newsletter data is kept until you unsubscribe or the service is discontinued, subject to a limited record needed to demonstrate or honor your choice. The separate account newsletter preference is not presented here as a confirmed FluentCRM subscription or unsubscribe mechanism.

Analytics and attribution

Optional measurement uses Google Tag Manager and Google Analytics 4 to understand visits and improve the site. Where enabled, this can involve online identifiers, page URLs, referrals, and interaction events. WooCommerce may use Sourcebuster information for campaign or order attribution. These optional activities are activated only after the relevant consent category has been granted (Article 6(1)(a) GDPR); refusing them does not stop necessary site features. You can change or withdraw your choice at any time through the site's cookie preferences. Withdrawal stops future optional collection through our controls and removes relevant first-party identifiers where technically possible; it cannot retroactively undo data already sent to a third party. See the Cookie Policy for storage details.

Shop and orders

If you use the shop, WooCommerce processes cart and order details, contact and billing information, products, amounts, and transaction status to fulfil the order, provide support, and comply with tax and accounting duties (Article 6(1)(b) and (c) GDPR). A payment provider receives the information needed to process the payment; available providers depend on the checkout method you select. Order details required at checkout are necessary to complete a purchase. We retain order records for the applicable tax/accounting obligations and any necessary claims period; optional marketing attribution is separate from required checkout processing.

Affiliate links and external content

Some pages link to retailers through affiliate links. Following such a link takes you to the retailer or affiliate service, which may receive a referral identifier and ordinary request data; we may receive commission information rather than your full purchase details. We do not treat a normal external link as an embedded tracker. If we measure referral activity on this site, that optional measurement follows the applicable consent setting. Embedded media, such as videos, may connect to its provider when you choose to load it; see the Cookie Policy and the provider's information.

Recipients and international transfers

Depending on the feature, data can be handled by our hosting and CDN providers (Hostinger and Cloudflare), Google for chosen sign-in or consented measurement, security services such as CleanTalk or Turnstile, email-delivery services for messages, and payment providers for purchases. Public community content is visible to other users and visitors as described above. We do not sell private aquarium records as advertising data. Some services may process information outside the European Economic Area. We are checking the precise provider roles, locations, and applicable transfer safeguards; please contact us for information about a specific transfer. We do not claim that all data remains in the EU.

Retention and deletion

Retention depends on the purpose: account and aquarium data while the feature is in use; contact requests while needed for response and follow-up; newsletter details until withdrawal, with a limited record of that choice; orders for legal accounting duties; security records for operational need; and consent records to document preferences. We review or remove data when the purpose ends, subject to legal retention, disputes, security incidents, and backup cycles. We do not promise immediate deletion from every backup, cache, recipient, or third-party copy. You may request information or deletion through the contact channel above.

Your rights and choices

Under the GDPR, you can request access to your personal data, rectification of inaccurate data, erasure where applicable, restriction of processing, and data portability where its conditions are met. You can object to processing based on legitimate interests, and withdraw consent at any time for processing based on consent, without affecting earlier lawful processing. These rights can be subject to legal conditions and exceptions; a request does not always require immediate deletion. Contact us through the link above and we will assess your request. You may also complain to the Austrian Datenschutzbehörde.

Changes to this policy

We may update this policy when the site or processing changes. The date above shows the current version. An update to this information does not by itself turn your use of the site into consent to processing that requires a separate choice.