Privacy Policy
Version 1 · effective 8 October 2026
This policy explains how personal data is processed on wudang.academy and its subdomains (Wudang Academy), in line with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Who is responsible
Michael König-Weichhardt, trading as Wudang Academy (sole proprietor) Bachweg 10, 8410 Wildon, Styria, Austria Email: master@wudang.academy
We are the controller for the personal data of members, customers and visitors of wudang.academy. The site runs on the aio platform (aioengine.io), which the same sole proprietor operates; the aio Privacy Policy describes the platform itself.
2. Data we process
2.1 Members and customers
- First and last name, email address, language, an approximate city derived from the connection, and the newsletter opt-in state with its confirmation and opt-out dates.
- Sign-in data: one-time sign-in links and session cookies. Sign-in is passwordless; no passwords are stored.
- Membership and purchase data: plan, billing period, status, renewal and cancellation dates, and payment references from Stripe (no full card data; see section 4). For memberships taken out before the current site, billing references kept in HubSpot.
- Content you create: posts, comments (including voice comments), private messages, course and lesson progress.
- If you use the aio network to join several sites with one sign-in: your name, email address, avatar and language are kept in a platform-wide network profile so that other sites you join can use it.
- Messages you send us by email.
2.2 Visitors
- Technical connection data (IP address, browser, device) is processed by Cloudflare to deliver pages and protect the service.
- Usage statistics in Cloudflare Analytics Engine: page, event, country, device type and a short, truncated hash of the IP address. Registration events currently also contain the email address of the new account.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Membership, course access, sign-in, community, private messages, service email | Art. 6(1)(b) contract |
| Payment, invoicing, cancellation and refund handling | Art. 6(1)(b) contract |
| Newsletters and other optional email | Art. 6(1)(a) consent (double opt-in; withdraw at any time with the unsubscribe link or by email) |
| Security, abuse prevention, moderation, usage statistics, operating and improving the site | Art. 6(1)(f) legitimate interest |
| Accounting and tax records | Art. 6(1)(c) legal obligation |
No automated decision-making with legal or similarly significant effects (Art. 22 GDPR) takes place.
4. Processors and other recipients
We use the following service providers. Where a provider is outside the EU/EEA, the transfer is based on an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or on the EU Standard Contractual Clauses.
| Provider | Location | Purpose | Data |
|---|---|---|---|
| Cloudflare, Inc. | USA, global network | Hosting and storage, delivery and security, email sending (Cloudflare Email Service), usage statistics (Analytics Engine), selected internal AI functions (Workers AI) | all site data |
| Mistral AI | France (EU) | AI functions: translation of posts and comments, moderation, transcription of audio and video, search and assistant answers | the content submitted to the AI function |
| netcup GmbH | Germany (EU) | Servers for media processing (images, audio, video), translation and search | media files and texts being processed |
| Stripe | Ireland / USA | Payment processing for memberships and courses | payment and billing data |
| HubSpot | Ireland / USA | Billing records of memberships taken out before the current site (lookup and cancellation only) | name, email address, subscription records |
| Cloudinary | USA | Conversion of voice comments into a playable format (community voice comments when they are saved, blog voice comments when a browser cannot play the original) and preview images taken from blog videos | the voice recording or video concerned, including the voice of the member who recorded it |
| fal.ai (Features & Labels, Inc.) and Runway AI, Inc. | USA | Image and video generation for blog articles, started by the editors only | the prompt and any source image |
AI functions only receive the content needed for the task, for example a text, an audio file or an image. That content may contain personal data if you include it. We do not send analytics data or browsing histories to AI providers.
Browser requests to third parties: the Wudang wiki loads an icon library from unpkg.com and a chart library from cdnjs.cloudflare.com, and the Wudang blog loads emoji images from Google (fonts.gstatic.com). These providers see your IP address when your browser loads the file.
5. Cookies
We only use cookies that are strictly necessary for the service (Art. 5(3) ePrivacy Directive, section 165(3) TKG 2021). No tracking or advertising cookies are set.
| Cookie | Purpose | Duration |
|---|---|---|
csrf_token | Protection against cross-site request forgery | browser session |
aio_network | Sign-in across sites of the aio network | 30 days |
__Host-aio_* | Secure hand-over of a sign-in between site, inbox and admin | from 60 seconds up to the sign-in session |
cms_token | Admin sign-in session (editors only) | 7 days |
content_unlock_<slug> | Access to password-protected content | 1 day |
6. Retention
| Data | Retention |
|---|---|
| Account and member data, content | while the account or membership exists; then deleted on request, unless a legal obligation requires us to keep it |
| Newsletter opt-out records | kept so that the opt-out stays respected |
| Cancellation requests and their handling | as long as the membership exists and for the retention period of the related billing records |
| Usage statistics | individual events: 90 days (Analytics Engine); daily summaries: 1 year; monthly summaries: 7 years; yearly summaries: while the site exists. Summaries keep event labels, so the email address of a registration event currently stays in them for as long |
| Billing and accounting records (Stripe, HubSpot) | 7 years (section 132 BAO) |
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and you can withdraw consent at any time with effect for the future. Write to master@wudang.academy. We answer within one month.
You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.
8. Children
wudang.academy is not directed at children under 14. Members under 18 need the consent of a parent or guardian to buy a membership.
9. Security
All traffic is encrypted (HTTPS). Sign-in is passwordless with short-lived, single-use links and secure HttpOnly cookies. Paid videos are delivered only with a signed, time-limited ticket to signed-in members.
10. Changes
We publish a new version of this policy with a new version number and effective date. Material changes are announced on wudang.academy.
Related: Terms · Refund and Cancellation Policy · Imprint