Privacy Notice and Legal Information

1Who we are#

Dr. Helmut Sedding
Winterthur, Switzerland
Email: hello@primopy.com for Primopy, hello@rprimo.com for Rprimo, hello@quisim.com for Quisim
Any of these addresses reaches us; write to whichever suits you.

We are a sole proprietorship based in the Canton of Zurich, Switzerland, and we operate three educational applications: Primopy, a Python editor with an optional AI tutor; Rprimo, an R editor with an optional AI tutor; and Quisim, a discrete event simulator with an optional AI assistant. This notice covers all three.

These details are published in accordance with Art. 19 of the Swiss Federal Act on Data Protection (FADP). Our full postal address is provided to the organisations we contract with and is available to data subjects on request.

Processing is governed by Swiss law, in particular the FADP and the Ordinance thereto. Where the EU General Data Protection Regulation applies to a specific activity, we comply with it in addition.

2Which part of this notice applies to you#

How we process your data — and who is responsible for it — depends on how you reached us. Find yourself below, then read Section 3 and the section named.

Section 3 applies to everyone. Sections 7 to 12 apply to everyone.

3What applies to everyone#

Where our systems run. The web applications, the sign-in process and our databases run on a server we install, configure and administer ourselves. The physical infrastructure for that server is provided by netcup GmbH in Nuremberg, Germany, which acts as our processor; see Section 8. Germany is recognised by the Swiss Federal Council as providing an adequate level of data protection, so this transfer requires no additional safeguards.

Server log files. Our server records the IP address of the requesting device, the date and time of the request, the resource requested, the HTTP status code and the browser identification string. We use this solely to operate the service securely and to investigate faults and attacks.

Our legal basis is our overriding legitimate interest in the secure operation of our systems.

Local storage in your browser. Our software stores data locally in your browser: your work in progress, your session identifier, interface preferences and, where a learning assistant is available to you, your conversation history. This data stays on your device. It is not transmitted to our servers and we cannot read it.

Because this storage is required for the service you have expressly requested, we do not ask for your consent to it, and we display no cookie banner. You may refuse or delete it at any time through your browser settings, in accordance with Art. 45c of the Swiss Telecommunications Act. The software will not function fully if you do, and clearing your browser data permanently deletes your work and your conversation history — we hold no copy and cannot restore it. On a shared or public computer, clear your browser data before leaving the machine.

Components loaded from third parties. Primopy and Rprimo run your code in your browser, and some of what they need is loaded by your browser directly from third parties:

• Primopy runs Python. The runtime and the front-end libraries are delivered by the jsDelivr content delivery network, and where you install additional Python packages during a session they are retrieved from the Python Package Index, operated by the Python Software Foundation in the United States.
• Rprimo runs R using webR (https://github.com/r-wasm/webr). The R runtime is delivered from webR's own servers at webr.r-wasm.org, and where you or your code install additional R packages during a session they are retrieved from webR's package repository at repo.r-wasm.org; both are served through the Amazon CloudFront content delivery network. A compression library is delivered by jsDelivr. Where a package you ask for is not in webR's repository, Rprimo asks R-universe, a service of the rOpenSci project in the United States delivered through the Cloudflare network, whether a package of that name exists on CRAN, so that it can tell you whether you have mistyped the name; that request contains only the package name.

In each case your browser connects to those services directly and transmits your IP address, browser identification string and the time of the request. We have no access to this data. These networks serve requests from nodes in several countries, so we cannot name a single destination in advance. No content you write, and nothing identifying you, your course or your organisation, is transmitted in these requests; the names of the packages you install are, because they are what is being requested.

We use no analytics, tracking pixels, advertising technology or social media plug-ins.

Enquiries you send us. If you contact us, we process your name, your email address and the content of your message in order to respond and to administer any resulting business relationship. We retain business correspondence for as long as the purpose requires and for as long as statutory retention obligations apply, in particular the ten-year period under Art. 958f of the Swiss Code of Obligations.

4Free access without a licence#

Both applications can be used without a licence. No institution stands between us in that case, so we are the controller.

Primopy and Rprimo, open access#

Primopy and Rprimo can be used to write and run Python or R without signing in at all. We ask for no account, no name and no email address. The only personal data that arises is the server log data described in Section 3, and it is not linked to you. Your work stays in your browser.

This mode includes no AI tutor. Nothing you write in it is sent to a language model.

Quisim demo editor#

The Quisim demo editor is open to anyone who can sign in with a SWITCH edu-ID.

Signing in. You authenticate with SWITCH, which operates the edu-ID service. SWITCH transmits a persistent identifier, your name and your email address to us. We never receive your password. SWITCH processes your registration data under its own privacy notice at https://www.switch.ch.

What we do with it. We use these attributes to give you access to the demo editor, to keep your work associated with you between sessions and to prevent abuse of a free service. We do not use them for marketing and we disclose them to no one.

Retention. We delete demo accounts after 36 months without a sign-in. You may ask us to delete your account at any time.

This mode includes no AI assistant. Nothing you write in it is sent to a language model.

5Full version through your university or school#

Where an institution has licensed our software for its students or staff, that institution is the controller and we act as its processor. It decides why and how your data is processed, and we process it only on its documented instructions under a data processing agreement concluded with it.

For information about that processing, and to exercise your rights in respect of it, please refer to your institution's own privacy notice or contact its data protection office. If you contact us instead, we will forward your request to the institution without undue delay and tell you that we have done so.

Signing in works as described in Section 4 for Quisim: you authenticate with SWITCH edu-ID and we receive a persistent identifier, your name and your email address. We never receive your password.

What we hold. Your course or licence membership, the join code you used where courses apply, and the technical data described in Section 3. We store neither your work nor your conversations on our servers; both remain in your browser.

Retention. We delete accounts after 36 months without a sign-in, and earlier if your institution instructs us to.

The learning assistant. Where your institution has enabled it, see Section 7.

6Full version through your employer#

Where a company has licensed our software for its staff, that company is the controller and we act as its processor under a data processing agreement.

Signing in. Depending on what your employer has arranged, you either authenticate through your employer's own identity provider — in which case we receive only the attributes it releases and never see your password — or you use an account we hold for your employer. In the latter case we store your username, your email address and your password as an Argon2id hash. We never store passwords in a form that allows us or anyone else to read them.

Accounts are created and closed on your employer's instructions. If you have forgotten your password, you can request a reset link, which we send to the email address held for your account; the link is valid for one hour and can be used once. We send these messages from our own server and use no external mail provider. We also notify you by email when your password or your recovery address is changed. If you believe your account should be closed, contact your employer, which will instruct us.

What we hold. Your account record, your organisation's licence scope and the technical data described in Section 3. We do not store your work on our servers.

7The AI tutor and assistant#

This section applies only where the AI tutor in Primopy or Rprimo or the AI assistant in Quisim is part of your licence. It does not apply to the demo editor.

You are interacting with software, not a person. Both are based on a large language model. They can produce information that is incomplete, outdated or incorrect, and their output should be verified before being relied upon. Please do not enter personal data about yourself or about others into them.

Where the model runs depends on what your organisation has chosen.

Operated by us. The model runs on hardware we operate ourselves, located in Switzerland, and is used solely to generate responses. Your prompts are sent to it from the application server in Germany and are passed to no external AI provider. Only the text needed to produce a response reaches the model; it holds no account data and no record of your course or organisation.

Operated or procured by your organisation. Your organisation connects the software to a language model it runs itself or obtains from a provider it has selected. We neither operate that model nor determine the terms on which it processes your prompts. How they are handled — including whether they are stored, where processing takes place and whether they are used for training — is governed by the arrangement between your organisation and that provider. Your organisation is responsible for putting those terms in place and for informing you about them.

If you are unsure which applies to you, ask your organisation or contact us.

Conversation content is not stored on our servers. Prompts and responses are processed in memory to generate an answer and are written neither to logs nor to databases. Your conversation history exists only in your browser.

No grading. The assistant can help you check your own understanding and give you feedback on your answers. That feedback is for your own use. It stays in your browser, is not shared with teaching staff, your institution, your employer or anyone else, and produces no grade, score or assessment of you as a person. Nothing it generates is used for or influences decisions about you.

Not for examinations. Our software is intended for teaching and learning. It is not designed or permitted for use in examinations or other assessed work.

8Disclosure to others and transfers abroad#

We do not sell personal data and we do not disclose it for advertising.

We disclose personal data only where necessary to operate the service — to processors bound by contract to process it solely on our instructions — or where a court or competent authority legally requires us to.

Our only processor is netcup GmbH, which provides the physical infrastructure for the server described in Section 3. We install, configure and administer that server ourselves, including the applications, the databases and the operating system. netcup has no access to them in the ordinary course of operation and no role in deciding what happens to your data. Because it controls the underlying hardware, and access therefore cannot be ruled out, it is treated as our processor and is bound by a data processing agreement.

Beyond this, the transfers described in Section 3 occur directly between your browser and jsDelivr, the Python Package Index, webR's servers and R-universe, without passing through our systems.

Payments. Licence fees are paid by bank transfer. We use no payment service provider and receive no card details. Our bank executes the transfer as an independent controller under its own obligations.

9Your rights#

You have the right to request access to the personal data we hold about you, to have inaccurate data corrected, to have data deleted where we have no legal basis or overriding interest in retaining it, to receive data you have provided in a machine-readable format or have it transferred elsewhere, and to object to processing based on our legitimate interest.

Write to us at either address given in Section 1. We will respond within 30 days, free of charge. We may ask for information sufficient to verify your identity first.

Where your institution or employer is the controller — Sections 5 and 6 — address your request to them. We will forward anything sent to us.

If you believe your data has been processed unlawfully, you may complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland.

10Data security#

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, passwords stored only as Argon2id hashes, and an architecture designed to minimise the personal data that exists at all. No system connected to the internet can be made entirely secure, and we cannot guarantee that unauthorised access will never occur.

11Changes to this notice#

We may update this notice to reflect changes to our software or to legal requirements. The current version is always published here with its version number and date. Where a change materially affects how we process your personal data, we will make it prominent rather than relying on this page alone.

12Third-party software#

Our software is built on open source components, which we use under their respective licences and gratefully acknowledge here. Nothing in this section affects your rights under the rest of this notice; it is published so that you, and the institutions that license our software, can see what runs in your browser and on what terms.

Python in your browser. Primopy runs Python using Pyodide, a port of CPython to WebAssembly, licensed under the Mozilla Public License, Version 2.0. The licence text is at https://www.mozilla.org/MPL/2.0/, and the source code at https://github.com/pyodide/pyodide. We use Pyodide unmodified. Pyodide includes CPython itself, which is used under the Python Software Foundation License.

R in your browser. Rprimo runs R using webR, a port of R to WebAssembly. R itself is licensed under the GNU General Public License, Version 2 or Version 3, and the webR distribution that contains it is licensed under the GNU General Public License, Version 3; the licence text is at https://www.gnu.org/licenses/gpl-3.0.html, the source code of webR at https://github.com/r-wasm/webr, and that of R at https://www.r-project.org. webR's JavaScript interface and its webr R package are licensed under the MIT License. We use webR unmodified. It is delivered to your browser from webR's own servers, as described in Section 3, and not by us; Rprimo's own code talks to it through its published interface and contains no part of R.

Other components delivered to your browser. Primopy's terminal is xterm.js and its fit addon, and the sharing links of Primopy and Rprimo are compressed with fflate; both are used unmodified under the MIT License. As described in Section 3, these components and Pyodide are delivered by the jsDelivr content delivery network rather than by us.

The code editor. Primopy's code editor is CodeMirror, with the Lezer parser for Python, both used unmodified under the MIT License. Unlike the components above, the editor is served from our own server, and its licence text travels with it at the top of the file.

Typefaces. The interface is set in Baloo 2, Nunito Sans and Google Sans Code, used under the SIL Open Font License, Version 1.1, whose text is at https://openfontlicense.org. The font files are served from our own server rather than from Google Fonts, so that loading a page tells no one but us.

Python and R packages you install. Where you or your course material install additional Python or R packages during a session, those packages are retrieved from the Python Package Index or from webR's package repository and are covered by their own licences, which we neither choose nor administer; many R packages are licensed under the GNU General Public License. Which packages a session installs depends on what the code asks for, so we cannot list them in advance.