Privacy notice
What we collect when you use PoisPois, why, who else handles it, and how to take it with you or have it deleted.
In effect from
Who we are
PoisPois is a European Portuguese course at poispois.app, with this site at poispois.com. PoisPois is the controller of the personal data described here. For anything about your data, write to [email protected].
The short version
- We collect what it takes to run your household’s course and bill for it — nothing for advertising, and we sell nothing to anyone.
- Your card details go to Stripe, never to us.
- What you type or say to the tutor is sent to AI providers to produce an answer.
- Any adult who owns a household can download everything or delete everything, themselves, at any time.
- This site sets no cookies. The app sets one, to keep you signed in.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Account: username, display name, email address, a hashed password (never the password itself) | To sign you in and to reach you about your account | Contract |
| Household: its name, its members and their roles (owner, parent, child), seat count, settings | To run one subscription for several people, each at their own level | Contract |
| Learning: placement results, level, lessons done, answers, mistakes, review cards, points, the preferences you set, and optionally where in Portugal you live | To teach you — the course is built from these | Contract |
| What you write or say to the tutor, in homework, missions and games | To answer, correct and mark it | Contract |
| Documents and notes you add to O Livro (pasted text, or uploaded PDF, text and CSV files) | To turn them into phrasebook entries for you | Contract |
| Billing: Stripe customer and subscription references, plan, amounts, dates, refunds | To charge, refund and keep the records tax law requires | Contract; legal obligation |
| Operational records: which emails we sent you, AI usage and failures per account, and server logs that include IP addresses and browser details | To keep the service working, secure and affordable | Legitimate interest |
Voice
When you use the microphone — pronunciation practice, speaking to the tutor, dictation — the recording is sent for transcription and scoring and then discarded. We keep the text of what you said where it is part of the exercise (a conversation, a marked answer), not the recording.
Children
A PoisPois account is opened by an adult. Children use it only as members of a household that a parent or guardian created and manages, and that adult agrees to this notice on their behalf. A child’s login needs no email address. We collect nothing from children beyond what their lessons need, and nothing from them is used for marketing.
Who else handles it
We use the following providers to run the service. Each processes data only on our instructions, for the purpose listed.
| Provider | What for | What they receive |
|---|---|---|
| Vercel | Hosting both sites; the AI Gateway; cookieless page analytics on this site | Requests to our servers; the text sent to AI models; anonymous page-view counts |
| Neon | The database | Everything in the table above except card details |
| Stripe | Payments and subscriptions | Your email address, card and billing details |
| OpenAI, through the Vercel AI Gateway | Generating lessons, the tutor’s replies, marking, transcribing speech | The text and voice of the exercise, and the lesson context — not your email address or payment details |
| Microsoft Azure Speech | The European Portuguese voices and pronunciation scoring | The Portuguese text being spoken; your recording when scoring pronunciation |
| Cloudflare | DNS, and storage for generated lesson audio | Requests to our domains; generated audio files |
| Resend | Sending account emails: sign-in links, invitations, reminders | Your email address and the email itself |
Under the API terms we use, OpenAI does not train its models on what we send it. Several of these providers are based in the United States. Where personal data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
How long we keep it
- While your household exists, we keep its data so the course can continue. Canceling the subscription does not delete anything, so you can come back to where you were.
- When a household is deleted, its accounts, progress, conversations, emails log and audio are removed straight away. Anything that has to outlive the account — a lesson another family also uses, for instance — is kept with your name removed.
- Billing records are kept for ten years, as Portuguese tax law requires, by us and by Stripe.
- Backups of the database are kept for a limited, rolling period and then overwritten; deleted data leaves them when they roll over.
Your rights
Under the GDPR you can ask to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent where we relied on it.
Export and deletion you can do yourself: the owner of a household can download a copy of all of its data, or delete all of it, from Conta → Os vossos dados (poispois.app/conta/dados) in the app — it happens immediately, without asking anyone. Anyone else in a household, and anyone with any other request, can write to [email protected]; we answer within one month.
You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority where you live.
What is required, and what is automated
An email address and the household details are needed to open an account and pay for it; without them we cannot provide the service. Everything else — where you live, your preferences, what you choose to type — is up to you.
Your lessons, marks and placement are produced automatically, but none of that is a decision with legal or similarly significant effects on you. We make no such decisions by automated means.
Cookies
This site (poispois.com) sets no cookies. Its page analytics and performance measurement are cookieless and count visits without identifying you.
The app (poispois.app) sets one cookie, ph_session, which keeps you signed in for up to 30 days. It is strictly necessary, so it needs no consent, and it is used for nothing else.
Changes
When this notice changes, the date at the top changes with it. If a change affects what we do with data you have already given us, we will email the owner of each household before it takes effect.