Privacy Policy
MIKO SaaS Platform · Rotmont GmbH · In accordance with the Swiss Federal Act on Data Protection (FADP; revised FADP in force since 1 September 2023) · Last updated: August 2026
This Privacy Policy covers two separate systems: the public website, playmiko.com, and the protected product, studio.playmiko.com. Where relevant, each section identifies which system it applies to.
1. Controller
Rotmont GmbH
Engelgasse 12, 9000 St. Gallen, Switzerland
E-Mail: datenschutz@playmiko.com
Website: https://playmiko.com
2. General information
Rotmont GmbH (“we”, “us”, “our”) operates the website playmiko.com and takes the protection of your personal data seriously. This Privacy Policy explains how we process your personal data in accordance with Article 19 of the Swiss Federal Act on Data Protection (FADP), which has been in force since 1 September 2023. Where applicable, it also provides information required under the EU General Data Protection Regulation (GDPR), in particular where individuals in the European Union are concerned. Under the Swiss FADP, data subjects must be informed transparently about the controller, the purposes of processing and, where applicable, recipients of personal data. Where data is transferred abroad, the recipient country and relevant safeguards should also be disclosed.
3. Personal data and purposes
Sections 3.1 to 3.6 apply exclusively to the product studio.playmiko.com. Processing activities on the public website playmiko.com are described separately in section 4a.
3.1 User accounts and authentication
Data: First name, last name, email address, encrypted password, organisation and role affiliation, registration timestamp and most recent sign-in timestamp.
Purpose: Providing and administering user accounts; authentication.
Retention: For the duration of the contractual relationship, followed by prompt deletion unless a statutory retention obligation applies.
3.2 Game activity and learning progress
Data: Responses and inputs within management simulations, scoring data, progress and outcome reports, and timestamps.
Purpose: Providing learning functionality, adaptive evaluation and the display of results to users and organisation administrators.
Retention: For the duration of the organisation’s contractual relationship.
3.3 Payment and billing data
Data: Organisation name, billing address, services ordered, invoice status and payment status.
Purpose: Processing subscriptions and meeting accounting obligations.
Retention: 10 years in accordance with Article 958f of the Swiss Code of Obligations.
3.4 Communications
Data: Email address, message content and timestamps.
Purpose: Support and transactional emails, including welcome emails and password-reset messages.
Retention: Until the matter has been resolved, and for a maximum of two years.
3.5 Technical access data and server logs
Data: IP address, anonymised after seven days; browser type; operating system; accessed URLs; and timestamps.
Purpose: Security, troubleshooting and prevention of misuse.
Retention: 30 days, followed by automatic deletion.
3.6 AI-powered functions
Functions: Mentor Chat, Practice Test Chatbot and evaluations.
Data: Your text inputs in Mentor Chat and the Practice Test at Level 5, game decisions, learning progress and the relevant catalogue context.
Purpose: Providing AI-powered mentoring and reflection dialogues; qualitative analysis of responses; and adaptive assessment.
Processing: Content is transmitted to the Lovable AI Gateway to generate responses and is then forwarded to Google’s Gemini models. Under the applicable contractual terms, providers do not use your content to train their models.
Retention: Chat histories and evaluations are retained for the duration of the organisation’s contractual relationship, and for no longer than 24 months from the relevant input.
Legal basis: Performance of a contract under Article 31(2)(a) FADP and Article 6(1)(b) GDPR, as well as your consent during onboarding.
4. Third-party providers and international transfers
We use the following third-party providers and have entered into data processing agreements with them.
Supabase Inc.
We use Supabase Inc. for database hosting and authentication for the product. In particular, login data, profile data and usage data, such as game progress and interactions within learning journeys, may be processed and stored on servers outside Switzerland and the EU. Supabase acts as a processor. Processing is carried out under a data processing agreement and on the basis of standard contractual clauses approved by the European Commission. Supabase is required to process personal data only on our instructions and to implement appropriate technical and organisational measures.
Lovable
We use Lovable for the development, hosting and operation of the product web application studio.playmiko.com. The primary processing of user master data, such as accounts, profiles and learning progress, takes place exclusively in our own Supabase instance. During the pilot phase, Lovable is used primarily as a technical platform and AI gateway. In operating the web application, Lovable may have access to technically necessary data, including IP addresses, log data, application content and configuration data, as well as error and performance information. When AI functions are used, such as Mentor Chat, practice dialogues and automated level summaries, relevant inputs are transmitted to Lovable’s AI gateway and then forwarded to Google Gemini. This content may contain personal data. Based on our current information, Lovable does not store this content permanently; however, Lovable is technically involved in the data flow. Data processing by Lovable primarily takes place on servers outside Switzerland and the EU and is subject to Lovable’s implemented privacy and security measures, as described in Lovable’s Privacy Policy and Trust Centre. For ongoing production operations, we plan to enter into a separate data processing agreement with Lovable or, alternatively, use independently operated infrastructure under which all processors are contractually bound by data processing agreements.
Google LLC (Gemini API)
We use Google LLC for the product’s generative AI functions, including Mentor Chat, practice dialogues and level summaries. Relevant user inputs are transmitted through the Lovable AI Gateway to Google’s Gemini models and processed in Google Cloud data centres, including in the United States. The following models are used exclusively: Gemini 3 Flash Preview, Gemini 2.5 Flash Lite, Gemini 2.5 Flash. Google processes this content and usage data in accordance with the data processing terms concluded with Google, including standard contractual clauses. Under those contractual terms, data is not used to train the models. We also configure our systems to limit transmitted data to the minimum necessary for the relevant AI function.
Mailjet SAS
We use Mailjet SAS to send transactional emails within the product, including confirmations, system notifications and security-related messages. This may involve the processing of email addresses and the content and metadata necessary for the relevant message. Mailjet acts as a processor under the Swiss FADP and may use this data only on our instructions and for the technical provision of email delivery. Processing primarily takes place in the EU. Transfers to additional countries outside Switzerland or the EU are based on appropriate safeguards, in particular standard contractual clauses, intended to ensure an adequate level of protection. Mailjet is required to protect personal data using appropriate technical and organisational measures. For all providers listed above, personal data may be transferred to countries that may not provide a level of data protection considered adequate under Swiss law, including the United States. In these cases, we rely on standard contractual clauses approved by the European Commission in accordance with Article 16(2)(d) FADP and, where applicable, adequacy decisions, such as the EU-US and Swiss-US Data Privacy Frameworks.
4a. Third-party providers for the website
The following third-party providers are used on the public website playmiko.com, which does not require a user login.
Neue Medien Münnich
Our domain and DNS administration, as well as parts of the web hosting for our public website, in particular playmiko.com, are provided through Neue Medien Münnich. Technical information, including domain, DNS and server-log data, is processed to ensure the secure and stable operation of the website. Neue Medien Münnich acts as a processor, operates data centres in Germany and is therefore directly subject to the GDPR. Our relationship is based on a data processing agreement requiring Neue Medien Münnich to process data in compliance with applicable data protection requirements and to implement appropriate security measures.
Calendly LLC
We use Calendly LLC for booking product demos and meetings. When you book an appointment through our booking page, the data you provide, such as your name, email address, preferred appointment time, time zone and any optional details about your request, is processed directly by Calendly. Calendly processes this data as a processor in order to send invitations, manage appointments and issue reminders. Processing primarily takes place in the United States on the basis of a data processing agreement and standard contractual clauses. Calendly is required to use the data only for appointment management and to implement appropriate security measures.
Google Site Kit / Google LLC
We use the WordPress plugin Google Site Kit on our website. It combines two Google services:
Google Search Console: Transfers website indexing and performance data to Google. This data does not relate to identifiable website visitors.
Google Analytics: Collects IP address, device and usage data from website visitors, including pages visited, time spent on the website and referral source, through cookies or similar identifiers.
This information is transmitted to Google LLC and may be transferred to the United States. Processing takes place only with your prior consent through our cookie-consent banner before Google Analytics cookies are set. We rely on standard contractual clauses and/or the EU-US and Swiss-US Data Privacy Frameworks for relevant international data transfers. Google Search Console, also accessed through Site Kit, does not set cookies and does not require consent. For all providers used on the website, personal data may be transferred to countries without an adequate level of protection, including the United States. In such cases, we rely on standard contractual clauses and/or applicable adequacy decisions.
5. Data security
We implement appropriate technical and organisational measures, including:
- Encryption of data transmission through TLS/HTTPS
- Row-level security (RLS) for tenant-separated database access
- Role-based access control (RBAC)
- Encrypted password storage using bcrypt
If a data security breach is likely to result in a high risk to the personality or fundamental rights of affected individuals, we will notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) as soon as possible. We will also inform affected individuals where necessary for their protection or where required by the FDPIC.
6. Cookies and local storage
Within the product studio.playmiko.com, we use only technically necessary cookies and local browser storage for authentication, including session tokens, and to store language preferences. No tracking, analytics or marketing cookies are used. Consent is therefore not required for these functions. On the website playmiko.com, we use Google Analytics cookies through Google Site Kit to measure website reach and usage. These cookies are not technically necessary. We therefore obtain your prior consent through our cookie-consent banner before they are set. Google Search Console, also included in Site Kit, does not set cookies and does not require consent.
7. Automated evaluation and AI notice Article 21 FADP, Article 22 GDPR and Article 50 EU AI Act
Parts of the product use AI models to generate content, including catalogue content and Mentor responses, or to assess responses, including the Practice Test Chatbot and scoring. These evaluations do not produce legal effects and are used solely to support your learning. No decision with significant effects on you is made solely through automated processing. AI-generated content is identified as such within the application.
8. Visibility to organisation administrators and facilitators
Administrators and facilitators within your organisation can see your learning progress, scores, badges and whether you have completed a learning journey. They cannot see your Mentor Chat content or the full wording of your responses in the Practice Test Chatbot. This content remains between you and the AI.
9. Your rights Articles 25 and 32 FADP
You have the following rights, subject to applicable legal requirements:
Right of access: You may request information about the personal data we process about you.
Right to rectification: You may request correction of inaccurate personal data.
Right to erasure: You may request deletion of your personal data where no legal retention obligation applies.
Right to data portability: You may request that your data be provided in a machine-readable format.
Right to object: You may object to processing for specific purposes.
To exercise your rights, contact us at datenschutz@playmiko.com
10. Data export in the app
Within the product, you can download your personal data and learning history at any time as a JSON/CSV bundle through your account settings.
Account deletion: You can delete your account through the settings. Your personal data will be permanently deleted within 30 days. Game decisions may be retained in anonymised form for the organisation’s aggregate reports.
11. Right to lodge a complaint
You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch