Privacy Policy

The controller responsible for processing your personal data within the meaning of the Swiss Federal Act on Data Protection (revised FADP / revDSG) is:

Sole Proprietorship, Spink Systems, samuel@spink.dev.

For questions about data protection, you can reach us at samuel@spink.dev.

Kontera works in two ways, and this has direct consequences for data protection:

Offline (without an account). If no Supabase backend is configured or you are not logged in, the app runs entirely in your browser. Your entire progress (name, XP, competency values, badges, streak, exercise history) is stored exclusively in the localStorage of your device (key kontera.v1). No data is transmitted to us, no account is created, and we have no access to this data. If you clear your browser storage, your progress is gone — this is entirely within your control.

Online (with an account). If you create an account, your data is stored with our hosting and database provider Supabase, and the grading of your exercises runs server-side. The following sections refer to this mode of operation.

Account data: display name, email address, password (as a hash, never in plain text), preferred language, role (learner or teacher), and a coarse birth-year band (deliberately no collection of a full date of birth — data minimisation). Purpose: performance of the contract, i.e. enabling access to your account.

Learning data: progress per competency, XP, level, streak, solved exercises, competency mastery values, earned badges, theory progress. Purpose: performance of the contract — this is the core of the product.

Class data (class feature): If a teacher creates a class and you join using a join code, the membership (class, account, join date) is stored. Important — please read this: The teacher who manages the class currently sees the complete learning statistics (name, level, XP, streak, solved exercises, competency mastery) of all accounts that have joined. There is currently no granular sharing system that would let you turn individual data categories on or off — this is planned as a future feature but has not yet been built. You can leave a class yourself, self-service, at any time from your profile. Consider carefully whether, and which, class you join.

Exam invitations: If a teacher invites you specifically to a single exam (rather than through class membership), we briefly process your email address in order to match it to an existing account at the same school. Once the invitation is redeemed, the email address is replaced by an account reference; an unredeemed invitation is automatically deleted after 90 days.

Sharing links ("share" feature in the profile): You can generate a link that contains selected data (summary, competency values, optionally your name). This data is encoded directly into the link itself — it is not stored on our servers. Anyone who knows the link can see the data it contains for as long as the link exists. Once shared, a link currently cannot be revoked or deleted — not even by us, since we do not manage the data contained in the link on the server side at all. Therefore, only share such links with people you trust.

Technical data: IP address (only to secure the infrastructure, no separate evaluation), cookies, and browser storage as described in the

.

Kontera is aimed at learners from around age 15 (commercial apprenticeships, vocational baccalaureate, vocational school). There is currently no automated age or ID verification during registration — we rely on truthful information being provided. Parents or legal guardians should go through this policy together with minor users, in particular the section on the class feature (Section 3), since learning statistics are shared with a teacher as soon as an account joins a class.

A separate parental information notice is in preparation but is not yet available at this time.

We use the following service providers, who process data on our behalf as processors:

Supabase (hosting, database, authentication, sending confirmation emails): Ireland.

Hosting of the web application: Vercel

Analytics/tracking tools: [[ANALYTICS_TOOL oder "keine"]] — as of today we do not use any analytics, tracking, or advertising software; this codebase contains no corresponding libraries.

AI providers (personal or school key): Anthropic PBC (USA) and OpenAI, L.L.C. (USA) — only if you or your school has configured your own API key and you actively use an AI feature. Details, the legal basis, and the question of who is the controller are set out in Section 6.

AI provider (Kontera credit): Infomaniak Network SA (Switzerland) — only if you use an AI feature via AI credit (personal or through your school) instead of your own key. Details in Section 6.

If data is transferred to countries outside Switzerland or the EEA, we ensure the required level of protection (e.g. through standard contractual clauses, SCC).

Kontera offers optional AI features (generating exercises, AI-assisted grading suggestions for exams, AI-generated questions for competitions). These features are not part of normal learning operation: they only run when you explicitly trigger them. If you never use an AI feature, none of your data is ever transferred to an AI provider.

What is transferred. What goes to the AI provider is the content of your request: the parameters you chose (competency, exercise type, difficulty), any free-text topic/context you type, and — for AI-assisted grading suggestions — the text of your exam answer. Not transferred: your name, your email address, your account ID, or your learning progress. Do not enter names or other personal data into free-text fields.

Who it is transferred to. Depending on the provider selected, to Anthropic PBC (Claude) or OpenAI, L.L.C. (ChatGPT). Both process the content on servers in the USA. From a Swiss perspective the USA is not regarded as a country with an adequate level of data protection; the transfer is safeguarded by appropriate guarantees (standard contractual clauses, SCC) and the terms of the respective provider. We do not store the content sent to the AI ourselves; our audit log records metadata only (provider, model, timestamp, success/failure), never the content of your request.

Who the controller is — that depends on whose key is used:

(a) Your own API key (BYOK). If you connect your own Anthropic or OpenAI key, the contractual relationship for the AI usage is between you and the AI provider. You choose the provider, its data protection terms apply to you, and the provider bills the usage directly to you. Kontera merely forwards the request. We store your key encrypted (AES-256-GCM); the decryption secret lives outside the database. You can disconnect the key at any time — it is then revoked and permanently deleted after 90 days.

(b) Your school's AI key. If you belong to a school with an active license that has configured a school-wide AI key, your AI requests run on that key — even if you have never connected a key and never chose a provider yourself. In that case the school selected the AI provider and is the controller for this processing; the school concludes the necessary agreements with the provider and bears the cost. The school can set a daily limit per person. The app shows you, before every AI use, which key your request runs on; you can connect your own key instead at any time (case (a) then applies, and your own key takes precedence).

(c) Kontera AI credit (Infomaniak, Switzerland). Instead of your own provider key, you (or your school, on your behalf) can use prepaid AI credit. In that case your request runs through our own contract with Infomaniak Network SA (Switzerland) — we, Kontera, are the controller for this processing, not you and not your school. Your data stays in Switzerland; no transfer to the USA takes place. We charge you or the credit account the actual usage plus a fixed processing fee; usage is only possible while credit is available (no billing after the fact). For a school-wide credit pool, the school additionally sets a monthly limit per person — without such a limit, a person cannot use the school pool at all (an intentional abuse safeguard). Details on managing credit and withdrawals are in Section 11.

Legal basis. The processing is carried out to perform the user contract (providing the AI feature you requested) or — for minor learners using a school key — within the school's educational mandate. The AI features are voluntary: the entire learning operation (exercises, exams, progress) works without them.

Automated individual decisions. AI-generated grading suggestions are suggestions. The grade is always set by the teacher; there is no automated individual decision with legal effect within the meaning of Art. 21 revFADP.

In principle, we retain your account data and learning progress for as long as your account exists. For a small number of narrowly-scoped data categories, an automated, shorter retention period applies, after which they are automatically deleted: expired class join codes (30 days), unredeemed exam invitations and exam join codes (90 days), bank details from withdrawal requests (90 days after payout), security log entries (12 months), voided exam attempts (roughly 15 months after voiding). Payment-related records (payment references, amounts) are retained for 10 years due to a statutory retention duty (Art. 958f CO); on account deletion these are pseudonymised rather than deleted.

You have the right to obtain information about the personal data we process, to have inaccurate data corrected, to have data deleted, to receive or transfer your data in a common format, and the right to object to processing.

For access and data portability, a self-service data export is available in your profile and generates a complete data package (profile, progress, exams, collections, AI-credit history, security log) to download. You can also have your account deleted, self-service, directly from your profile — after a 72-hour grace period (during which you can undo the deletion), your account is permanently deleted; payment records subject to a statutory retention duty are pseudonymised rather than deleted (see Section 7). For correction, or if a self-service function is not available to you, you can reach us at any time at samuel@spink.dev.

You also have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB): Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

The connection to Kontera is TLS-encrypted throughout (https). Passwords are stored hashed by our authentication provider Supabase, never in plain text.

Access to learning data is technically enforced at the database level (Row-Level Security, RLS): database rules — not just application code — ensure that, in principle, only you yourself can access your own data, or that a teacher can only access data of accounts that have joined their class.

In the event of a data protection breach that is likely to result in a high risk to affected persons, we will inform the FDPIC and the affected persons in accordance with legal requirements.

Details on all cookies and storage mechanisms used can be found in the separate

.

If you start a subscription, top up AI credit (personally, or — as a school administrator — for your school's credit pool), or have credit paid back out to you, we additionally process payment and withdrawal data. Payment processing runs through our payment service provider Stripe, by card, TWINT, or bank transfer depending on the method chosen; full card data never reaches our servers. We store only a payment reference, the payment method, and the amount. Your AI-credit account shows your current balance and a list of all top-ups and usage entries (the ledger) — the latter without the content of the AI request itself, see Section 6.

If you request a withdrawal of your credit, we collect — only for this purpose and only in the withdrawal request — the IBAN and account-holder name you provide (for bank transfer) or your mobile number (for TWINT). These details are stored encrypted (AES-256-GCM; the decryption key lives outside the database) and are visible only to the platform team for reviewing and executing the payout. They never appear in logs or emails.

After the payout has been made, the IBAN, name, and mobile number are automatically deleted after 90 days. The payout reference, together with the amount and method, is retained as part of our bookkeeping (statutory retention duty under Art. 958f CO, 10 years). Unwithdrawn credit is forfeited upon account deletion and is not refunded (see the Terms of Use).

We adapt this policy whenever our offering or the legal situation changes. The current version, together with the date, is always shown at the top of this page ("Effective: …"). We additionally announce material changes within the product.