Privacy policy

Last updated: October 30, 2026

1. Controller

Amir Asfour
Hans-Sachs-Straße 4
45307 Essen
Germany

Phone: +49 176 80732046
Email: [email protected]

2. In short

You can use ExcelHero without an account; your progress then stays in your browser only. We use no advertising trackers and no third-party analytics and load no fonts or scripts from Google. We only process data as far as needed to run the site, your account or a subscription you bought.

3. Hosting and server logs

The site runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. For every request the server briefly stores your IP address, date and time, the address requested, status code, amount of data and your browser's user agent, to keep the site secure (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest.

To see which pages are used and where the site gets stuck, we count page views and a few steps (such as an exercise solved or the payment page opened) on our own server, without cookies and without any third-party service. For this we combine your IP address and browser details with a random value that changes every day into an anonymous ID; we never store the IP address itself, and nobody can be recognised the next day. We store the page, the referring site (domain only), the country and the time. If a page crashes, we store the error message and the page to fix it (both Art. 6(1)(f) GDPR).

4. Cloudflare

Requests pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which protects the site and delivers it quickly, processing your IP address and technical connection data (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses also apply.

5. Your account

If you sign in, we store your email address, your progress (solved exercises, points, streak), your test results and, if any, your certificates. Sign-in codes and sessions are stored only as hashes. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). You can delete your account and all its data at any time on your account page.

A certificate is a public page with the name you enter for it, your score and the date. It is only created when you ask for it and can only be reached through its address.

6. Sign-in emails

We send your sign-in code by email via Resend, Inc. (USA) as our processor, which handles your email address and the message (Art. 6(1)(b) GDPR). Transfers to the USA are based on the EU Standard Contractual Clauses.

7. Sign in with Google (optional)

If you choose "Continue with Google", Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, sends us your verified email address. We ask for nothing else (Art. 6(1)(b) GDPR). Google's own privacy policy applies to its processing.

8. Paying for ExcelHero Pro

Subscriptions and one-time purchases are sold by Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as reseller (merchant of record). You enter payment details directly with Paddle; we never see them. Paddle tells us the status of your subscription so we can unlock Pro (Art. 6(1)(b) GDPR). On the Pro page we load Paddle.js to show prices in your currency, which gives Paddle your IP address (Art. 6(1)(f) GDPR). Nothing from Paddle loads on any other page.

9. Cookies and browser storage

We only use what the site needs (§ 25(2) no. 2 TDDDG): one cookie for signing in (eh_session), one for your language (eh_lang) and one for your Excel formula language (eh_excel). Your browser storage keeps your progress and these settings. You can delete them in your browser at any time.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Just write to [email protected]. You can also complain to a data protection authority, for example the Data Protection Commissioner of North Rhine-Westphalia (Germany).