How Pippo protects your data

Slothworks IT GmbH

Goldlackgasse 7/2, 1220 Wien, Österreich

FN 676708i, Handelsgericht Wien (Commercial Court Vienna)

Managing director (Geschäftsführer): Anton Bayer

Email: wuff@pippo.app

Phone: +43 676 929 27 39

Your data is stored for as long as your account exists. If you delete your account, all related data (profiles, results, feedback) is deleted as well.

Feedback messages not linked to an account are deleted after 12 months at the latest.

All data is sent encrypted via HTTPS and stored in a secure database (Supabase).

By default, only you can see your child profiles and their results. If you invite other parents or caregivers, they can also see the data of the children shared with them (shared care). Teachers only see the data of children in their classes.

Passwords are never stored in plain text, but are protected with modern encryption methods.

Pippo uses only technically necessary cookies: for signing in (session cookie), to recognise active sessions (activity cookie, valid for 60 seconds) and, if you switch the language, for the language you chose. Without these cookies, login or correct session management would not be possible.

On devices where a child is signed in directly, technical pairing cookies (pippo_kid_session and pippo_device_pairings) are also used. They keep the child’s session going so that the child can practise without the parent’s login. These are not tracking cookies either.

If you switch the language (on the website, on a shared dictation or when choosing a child), Pippo remembers your choice in a technical cookie (pippo_ui_locale). This way, the sign-in page, shared links and the child selection also appear in that language. The cookie only contains the language code (e.g. “de”), no identifier, and is deleted when you close your browser. The legal basis is § 165(3) TKG 2021 (strictly necessary for the language you chose); to the extent the code is personal data at all, Art. 6(1)(f) GDPR (legitimate interest in showing the website in your language).

There are no tracking cookies, no advertising cookies and no third-party cookies. That is why no cookie banner is needed (Art. 5(3) ePrivacy Directive, § 165(3) TKG 2021 – Telekommunikationsgesetz, Austrian Telecommunications Act).

For use at school, pippo.app is deliberately built so that responsibility for pupils’ data stays with the parents. This is how it works:

• Teachers create a class and receive a class code (e.g. TIGER-42).
• Teachers cannot create pupil accounts directly.
• Parents receive the code, create the child profile in their own account and join the class themselves.
• The teacher then sees first name, year and learning progress – but not the email address, surname or date of birth.

In this standard set-up, the parents are the controllers under data protection law, and pippo.app processes the data on their behalf. A data processing agreement with the school is not required for this.

If a school nevertheless wants to use pippo.app formally as a central school tool (with the head teacher as controller under § 4(1) BilDokG 2020 – Bildungsdokumentationsgesetz, Austrian Education Documentation Act), pippo.app acts in this set-up as a processor under Art. 28 GDPR. In this case, the data processing agreement (Auftragsverarbeitungsvertrag, AVV) prescribed by the Bundesministerium für Bildung (BMB, Austrian Federal Ministry of Education) can be requested at wuff@pippo.app – pippo.app undertakes to comply with it.

The core services run on servers within the EU or in the UK: hosting (Vercel) in Frankfurt, speech output (Azure) in Western Europe, email (Resend) in Ireland, database (Supabase) in London. Thanks to the EU adequacy decision, a transfer to the UK is treated the same as a transfer within the EU.

Only the AI sentence generation via OpenRouter may use servers in the USA. However, no personal data is sent (only words, instruction and settings such as year, language and difficulty). Google OAuth transfers data to Google (USA) on the basis of the EU-US Data Privacy Framework.

You have the right at any time to:

• Access – find out what data is stored about you (Art. 15 GDPR)
• Rectification – have incorrect data corrected (Art. 16 GDPR)
• Erasure – have your data deleted (Art. 17 GDPR)
• Restriction – have the processing restricted (Art. 18 GDPR)
• Data portability – receive your data in a common format (Art. 20 GDPR)
• Objection – object to the processing (Art. 21 GDPR)

Just write to me at wuff@pippo.app or use the form:

If you believe that the processing of your data breaches the GDPR, you have the right to lodge a complaint with the supervisory authority: