Last updated: November 2026. A German version is also available.
1. Controller
The controller for data processing on this website and in the CourseStart web app (my.coursestart.app) is:
Helicon Solutions LLC
30 N Gould St, Ste R
Sheridan, WY 82801
USA
represented by Josef Büttgen
E-mail: contact@coursestart.app
Terms such as “personal data” or “processing” are used as defined in Art. 4 of the General Data Protection Regulation (GDPR).
2. Hosting and delivery of this website
This website is served via Cloudflare Pages by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data such as your IP address, date and time, page requested, referrer, browser and operating system in order to deliver the site, protect it from attacks and keep it stable. The legal basis is our legitimate interest in secure and fast operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses also apply.
3. Analytics with Plausible
We use Plausible Analytics (Plausible Insights OÜ, Estonia), a privacy-friendly, cookie-free analytics tool. Plausible does not store personal data or IP addresses; visits are only evaluated in anonymised, aggregated form (e.g. page views, referrer, country, device type). Data is processed in the EU. The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).
4. Contacting us
If you contact us by e-mail or WhatsApp, we process the information you provide (e.g. name, e-mail address, phone number, message) to answer your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is hosted by Namecheap, Inc. (USA). When contacting us via WhatsApp, the privacy policy of WhatsApp Ireland Ltd. also applies, and data may be transferred to the USA; if you prefer to avoid this, please e-mail us. We delete enquiries once they have been dealt with, unless legal retention obligations apply.
5. Newsletter
For our newsletter we process your first name, e-mail address and chosen language. Sign-up uses a double opt-in process: you first receive an e-mail with a confirmation link and are only added once you click it. As proof, we log the time of sign-up and confirmation and your IP address. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every e-mail or by e-mailing us.
We use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) to send and manage the newsletter. Brevo processes the data on our behalf within the EU and may record whether a newsletter was opened and which links were clicked in order to improve delivery. Your data is deleted when you unsubscribe.
6. Embedded YouTube videos
Some blog posts embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode (youtube-nocookie.com). Data such as your IP address is only sent to YouTube once you play a video, and it may be transferred to the USA. The legal basis is our legitimate interest in an engaging presentation (Art. 6(1)(f) GDPR) or, where required, your consent by playing the video.
7. CourseStart web app (my.coursestart.app)
7.1 Class providers
When you create a CourseStart account, we process your account data (e.g. name, e-mail address), your classes and settings and – on paid plans – billing data in order to provide the platform (Art. 6(1)(b) GDPR). You can delete classes and registration data in your account at any time.
7.2 Participants and parents
If you register for a class through a CourseStart registration form, the class provider is the controller of your data. We process the form data (e.g. name, contact details, children’s ages, payment status) as a processor on the provider’s behalf (Art. 28 GDPR). Please direct access or deletion requests to the class provider first. If that isn’t possible, you can also contact contact@coursestart.app.
7.3 Service providers
We use the following processors to operate the web app:
- Auth0 (Okta, Inc., USA) – sign-in and user accounts
- MongoDB Atlas (MongoDB, Inc., USA) – database
- Netlify (Netlify, Inc., USA) – hosting of the web app
- Cloudflare R2 (Cloudflare, Inc., USA) – file storage, e.g. class logos
- Stripe (Stripe Payments Europe, Ltd., Ireland) – online payments; Stripe is partly an independent controller for payment data
- Brevo (Sendinblue SAS, France) – confirmation and notification e-mails
- Api2Pdf (USA) – generating PDF documents such as tickets and attendance lists
- Sentry (Functional Software, Inc., USA) – error monitoring
- Mixpanel (Mixpanel, Inc., USA) and LogSnag – usage statistics and event logs to improve the app
- Plausible Analytics (Plausible Insights OÜ, Estonia) – cookie-free analytics
- Notion (Notion Labs, Inc., USA) – internal management of certain registrations
- OpenAI (OpenAI, L.L.C., USA) – AI-assisted extra features (e.g. music suggestions for dance classes), only when actively used
Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
8. Retention
We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods (e.g. tax law). It is deleted afterwards.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Please contact contact@coursestart.app.
You also have the right to lodge a complaint with a data protection supervisory authority – in Austria the Datenschutzbehörde (Barichgasse 40–42, 1030 Vienna, dsb.gv.at), in Germany the authority of your federal state.
10. Security
This website and the web app are only transmitted encrypted (HTTPS). Please note that data transmission over the internet – e.g. by unencrypted e-mail – may have security gaps.
11. Changes
We update this privacy policy when our service or the legal situation changes. The version published here applies.