QuestionAid

This comprehensive legal framework outlines the terms and conditions governing the use of QuestionAid services, including subscription policies, data protection practices, and liability limitations. The document sets forth user obligations, account management requirements, and the technical partnerships that enable service operations while adhering to GDPR standards. As the basis for the provider-user relationship, these terms establish the rights and responsibilities of both parties in utilizing the QuestionAid platform for generating legal questions and related services.

Service Agreement and Rights

The agreement between QuestionAid and users supersedes any prior arrangements and can be amended by posting revised versions on the website. Users must review and accept these changes, with failure to do so resulting in loss of authorization to use the service.

Account management requirements include providing accurate and complete information, maintaining password security, and restricting access to the account. Users must notify the company immediately of any security breaches or unauthorized account use. The service is intended for individuals at least 18 years old, and users must provide proper identification when creating an account.

Automatic billing processes are managed by the company through third-party services like Stripe for credit card data processing and Sendinblue for newsletter distribution. When automatic billing fails, customers receive an electronic invoice requiring manual payment within a specified deadline matching the billing period.

The company offers a free trial option for subscriptions, allowing users to sign up with billing information without immediate charges. Subscription fees can be modified at the end of the current billing cycle, with users given reasonable notice to cancel their subscription before the change takes effect.

Third-party services are used for various aspects of the service, including Cloudflare for content delivery, Formbricks for storing responses, Google for email and document storage, and Hetzner Online for website hosting. Personal data is processed based on user consent and legitimate interest, with standard contractual clauses used for data transfers to third countries.

The company maintains no control over third-party websites or services linked to their service, disclaiming responsibility for their content, privacy policies, or practices. They also disclaim responsibility for any damage or loss caused by reliance on third-party offerings. All processing of personal data is carried out under the GDPR, with users provided rights including information about stored data, correction of incorrect data, deletion of data, restriction of data processing, objection to data processing, and data portability.

The service is governed by German law, with any invalid provisions not affecting the remainder of the agreement. The company reserves the right to withdraw or amend the service at any time without liability for any resulting unavailability. The service is provided "AS IS" and "AS AVAILABLE" without warranties of any kind. The company's liability is limited to the amount paid for products and services, with no consequential or punitive damages. The agreement includes provisions that survive termination, including ownership, warranty disclaimers, indemnity, and limitations of liability.

Subscription and Billing Policies

Subscription activation for the free trial requires providing billing information, though users will not be billed immediately. Instead, subscriptions automatically renew under the same conditions unless canceled by the user or the company, maintaining continuous service based on the selected plan duration.

Billing cycles determine recurring payment intervals—monthly or annually—before automatic subscription renewals. If the automatic payment fails, the company issues an electronic invoice with a specific deadline for manual payment, matching the original billing period indicated on the invoice.

User information requirements for account creation emphasize the need to provide accurate, complete, and current details, including for identification verification purposes. Security protocols mandate maintaining password confidentiality and restricting account access to prevent unauthorized use, with immediate reporting required in case of security breaches or suspected hacking attempts.

In managing third-party services, Hecht + Marciniak employs Cloudflare for content delivery, Google for email and document storage, and Hetzner Online for website hosting. These technical partnerships facilitate essential service operations while adhering to data protection standards and privacy policies established through standard contractual clauses for intercontinental data transfers.

User Obligations and Data Protection

Users must provide accurate, complete, and current information when creating an account, and are responsible for maintaining password security and restricting access to prevent unauthorized use. In the case of security breaches or suspected hacking attempts, users must immediately notify the company. Failure to provide accurate information can result in account termination and loss of service authorization.

All personal data processing is governed by the General Data Protection Regulation (GDPR), with Hecht + Marciniak GbR serving as the data controller. The company processes data based on user consent and legitimate interest, with data retained for six months post-request processing or as required by law. Users retain rights to access, correct, delete, restrict processing, object to processing, and request data portability under GDPR Article 15 through 20.

The company employs several technical partners for service operations, including Cloudflare, Formbricks, Google, and Hetzner Online. Personal data shared with these third-party service providers includes IP addresses, device information, email addresses, and transactional data. Data transfers to third countries are governed by standard contractual clauses to ensure compliance with GDPR requirements.

Cookies are used for improved user experience, particularly for session management and security features. Technical necessity for registration, sign-in, and application functionality allows the company to process personal data under GDPR Article 6(1)(f), with session cookies stored for one month and CSRF tokens retained for browser session duration.

Third-Party Services and Data Sharing

The company processes personal data for website registration and question generation through technical service providers operating in the United States. Registration requires an email address and date of registration, with processing based on user consent under GDPR Article 6(1)(a). Data recipients include order processors for website operation and maintenance. Text excerpts are collected for question generation, and standard contractual clauses govern third-country transfers. Data storage is limited to the consent period.

Newsletter processing collects email addresses via input mask for double opt-in verification. The process includes registration logs, confirmation emails, and response tracking, with order processors serving as data recipients. No third country transfers occur, and data is retained only during the consent period before deletion. Users can revoke consent through website contact options or newsletter revocation links.

Technical operations rely on several third-party services, with personal data shared as follows: Cloudflare, Inc. receives IP addresses for content delivery; Formbricks stores responses and device information; Google handles email and document storage through Google Mail; Hetzner Online provides website hosting and QuestionAid application/database servers; Lexoffice stores billing contact information; and Posthog analyzes service usage anonymously. All data transfers to third countries adhere to standard contractual clauses for GDPR compliance.

Data protection is managed by Hecht + Marciniak GbR, located at Kronshagener Weg 61, 24116 Kiel, Germany. The company provides data subject rights including access, correction, deletion, data restriction, objection, and portability under GDPR Articles 15 through 20. Consent given can be revoked at any time, with effectiveness for future communications. Users can exercise their rights using contact details provided through the data protection officer. Complaints can be lodged with supervisory authorities through contact information available at [https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender- node.html](https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender- node.html).

Cookies enable improved user experience through session management and security, particularly for registration, sign-in, and application functionality. Technical necessity for these processes allows data processing under GDPR Article 6(1)(f), with session cookies stored for one month and CSRF tokens retained for browser session duration. The company employs state-of-the-art encryption methods (SSL via HTTPS) to protect data during transmission, ensuring secure communication between users and the service.

Legal Remedies and Disclaimers

Liability and Warranty

The company makes no warranties of any kind, express or implied, including merchantability, non-infringement, or fitness for a particular purpose. Users acknowledge that the service is provided "AS IS" and "AS AVAILABLE."

Limitations on Liability

The company will not be liable for indirect, punitive, special, incidental, or consequential damages, including attorneys' fees and related litigation costs. This exclusion applies even if the company has been advised of the possibility of such damages.

Termination and Renewal

The company reserves the right to terminate or suspend accounts and bar access at any time for any reason, with no prior notice or liability. Users may cancel their subscription through their online account management page or by contacting customer support.

Governing Law and Amendments

The agreement is governed by German law. Any prior agreements regarding service are superseded by this document. The company reserves the right to amend the service at any time without notice, with no liability for resulting unavailability. Terms may be amended by posting revised versions on the site, with users required to review and accept changes.