Privacy Policy for Jabba (United Kingdom)

Last updated: 2 October 2026 · Version uk-1.3

This is the UK version. It is written for users in the United Kingdom and is governed by the UK GDPR and the Data Protection Act 2018. If you are in Denmark, a separate Danish policy applies.

In short

Jabba is an app for the home schooling of a single child. It is developed and operated by Cognition Software ApS. We make money by providing the app itself to you — never by selling, renting, or exploiting your child's information.

So we make three simple promises:

We never sell data. Neither your nor your child's information is sold, rented, or shared for marketing purposes.
No ads and no ad tracking. There are no ads in the app and no third-party ad tracking. The app itself doesn't use analytics tools by default — you can turn it on, but it stays off until you do (see section 11 on cookies and analytics). We collect necessary operational metrics, some of which are linked to the child's account (see section 2).
We collect as little as possible. The app stores only what's needed to help the child learn.

This policy explains what information the app processes, why we do it, who the information may be shared with, and what rights you have. We've written it to be understandable — including for a child old enough to read it — even without being a lawyer.

An important note on roles: Cognition Software ApS provides and operates Jabba and decides how and why the child's information is processed. Cognition Software ApS is therefore the legal "data controller". The companies that provide the technology behind the app (see the section on sub-processors) are "data processors" who may only process data on our instructions. As a parent/guardian you are not a data controller — you act as the child's guardian, safeguarding the child's rights and giving consent on the child's behalf (see section 9).

1. Who is the data controller?

The data controller for the processing of the child's and the parents' information is:

Company: Cognition Software ApS
Company reg. (Danish CVR): 45656462
Address: Griegsvej 249, 9200 Aalborg SV, Denmark
Email: privacy@cognitionsoftware.dk

If you have questions about how the child's information is processed, you can contact us at the email above.

UK representative (UK GDPR Article 27)

Because we are established outside the United Kingdom but offer Jabba to people in the UK, we are required under Article 27 of the UK GDPR to designate a representative in the UK, unless an exemption applies. Our UK representative acts as a point of contact for UK data subjects and the Information Commissioner's Office. You can reach our UK representative, or the controller directly, at privacy@cognitionsoftware.dk, and we will publish the representative's name and UK postal address here.

Data Protection Officer (DPO)

We have assessed whether we are required to appoint a Data Protection Officer under UK GDPR Art. 37. Although the app processes children's data and potentially special-category data (Art. 9) as a core activity, we assess — at the current scale — that the processing does not constitute "large scale" processing within the meaning of Art. 37, and that a DPO is therefore not legally required. We reassess this on an ongoing basis as the number of users grows, and will appoint a DPO (and update this section with contact details) if the requirements are triggered, or if we choose to do so voluntarily.

2. What information do we process?

About the child

Profile: First name or nickname (what we show in the app), role (child/"learner"), and year group / grade level, so the teaching hits the right level.
Interests: E.g. dance, music, or Roblox — so Jabba can make the teaching relevant.
How the child prefers to talk with Jabba: Whether the child prefers to type, speak, or both, plus break habits.
Screen and sound settings: Settings such as reduced motion, sound on/off, and font size.
Energy and mood: An input about the child's current energy level, so Jabba can adapt the tone. This is sent to the AI model as part of the conversation.
Conversations with Jabba: The child's written messages are stored, so the conversation can continue and be picked up again later. This includes conversations in homework help: since 29 September 2026 Jabba remembers them in the same way as the rest of the chat, and they are marked as homework.
Jabba's audio replies: When Jabba replies with voice, the audio file is stored privately so that you as parents can listen back to it afterwards (replay).
Pedagogical support profile: Settings about tone and strategies for calm/regulation, which you as parents set.

Fields we currently do not collect: The app has a technical field for the child's birth year (birth_year), but it is not collected in the current setup (the field is left empty). Year group / grade level, on the other hand, is collected (see "Profile" above).

Important note about the child's voice

When the child speaks to Jabba, the audio is converted to text immediately, and the raw recording is not stored with us — it is discarded right after it has been converted to text. We store only the text.

The raw audio is, however, sent to our speech-to-text provider (Google) to be turned into text, and is then discarded by us. How long the provider itself may retain the audio depends on their plan — see the section on sub-processors.

(Jabba's own audio replies are stored, however, so you can listen back — see above.)

Conversation flow and Undo

In chat, the child can start a conversation by pressing the microphone. It then reopens when Jabba finishes speaking. It stops if the child starts typing, leaves chat, or says nothing twice in a row. Audio may be sent for transcription during a short pause. Cancelling a request cannot recall audio the provider has already received. Unused text is discarded. Undo hides the turn in the child's chat and removes it from Jabba's subsequent context, but it remains in the parents' conversation history. Timing records contain no name, account ID, text or audio and are removed after 90 days by daily cleanup.

Lærings Lab (the calculation board)

When the child meets a calculation with numbers of two or more digits (or fractions or mixed operations) in the chat, in homework help, in a scanned task or in a maths step in the day's tasks, Jabba can open a calculation board, Lærings Lab. The lab starts with a short word problem about the child's own calculation. The child picks what the question is asking, works it out on the board with help, and finally says the answer in their own words.

The story is written by the AI model from the calculation, the child's year group, the child's interests and up to eight things Jabba remembers about the child (e.g. a pet, or the first name of a friend or family member). If you have turned Jabba's memory off, only the interests are used. For a scanned task, the task's own text is used as the starting point. Every story is checked automatically (numbers, units, reading level for the year group, and words that must not appear in a text for children). If it fails the check, or takes too long, a fixed, pre-written story that no AI wrote is shown instead.
What we store for each lab: where the lab was opened, the calculation, the story the child saw, how many hints the child used, how many steps Jabba showed, and whether the answer was right first time, a snapshot of the board so the child can carry on later, the status, stars and times. We also store a trail of the steps (which step and which type of mistake) — but never free text or the numbers the child types.
You can see it: Each lab appears in the day overview in the parent app with its story, and all labs are included in the data export.
Reports: If the child reports a line from a lab, a copy of the story shown is stored with the report.

Special-category information

If you as parents choose to note information about the child's diagnosis or sensory circumstances (sensory_notes) as part of the support profile, this may be special-category information under UK GDPR Art. 9 (e.g. health information).

Two things are important here:

This information is NEVER sent to the AI model. Diagnosis and sensory notes are kept separate and are not passed to Jabba's "brain" (see sub-processors). Only a secure, limited subset of the support profile (e.g. desired tone) is used by the AI model.
Processing special-category information requires explicit consent (Art. 9(2)(a)). You should only enter such information if you deliberately want to — otherwise leave the field empty (data minimisation).

About safety checks of the child's messages

Before a message is sent to the AI model, it is checked on our own server for signs that the child is in distress (see section 4). Because such a check can reveal matters about the child's health or mental state, we process potentially special-category information here under UK GDPR Art. 9. We do it solely to protect the child, the result is not passed on to third parties, and the scan itself happens on our own server.

About the parent/guardian

Login details: Email address and password (handled securely via Supabase Auth).
Role: Whether the account is a parent or a child.
Family access: If several guardians share access, members and roles (admin/editor/viewer) plus invitation codes are stored, so you can invite each other.
Subscription and payment: If you take out a subscription, the payment is handled by Stripe. Card details are entered directly with Stripe and never pass through our systems — we store only Stripe's customer and subscription id plus the subscription status. Purchases happen on the website, not in the child's app.
Email to you: We send service emails (e.g. password resets, family invitations, weekly and monthly recaps, and safeguarding alerts). The sending itself is done by our email provider Resend, which receives the recipient's address and the content of the email (see section 5).

Reports about Jabba's answers

When a child reports an answer, we store the selected answer, reason, feature it came from, learner id, time and review status at Supabase (EU). Reporting does not send audio or the whole conversation. Only staff with administrator access can view the report queue. Parents can obtain their child's reports through the data export.

Technical data for operations

Login links and device activity: When you create a login link for the child, we store only a

hash of the one-time code plus its creation, expiry, and use times. To show where the child is signed in, we store a coarse device type, browser, operating system, a verified session ID, and login/last-active times. Guardians with access to the child can see this information. These records do not contain the full User-Agent, an exact hardware fingerprint, a raw IP address, or login tokens. Device names are therefore estimates.

Memory, so Jabba can remember: Selected text excerpts from conversations are stored together with "embeddings" (a mathematical representation that lets Jabba remember context). Selected text excerpts and search text are sent to Cohere Embed v4 hosted by AWS Bedrock within the EU to calculate embeddings and retrieve relevant memories. The excerpts and calculated embeddings are stored at Supabase (EU). Cohere has no access to the content hosted by AWS. From 29 September 2026 this also covers homework help: what is remembered from it is marked as homework, and you can see and delete it under "Jabba's memories" like everything else. Raw audio and diagnosis or sensory notes from the support profile are not part of this processing. They are not stored if a conversation is marked with a safety flag.
Usage metrics: To keep track of operations and costs, we store technical measures per interaction — e.g. number of tokens, number of speech seconds, and which model/provider was used. These measures are linked via the account to your family and thus to the child, so they count as personal data. But they are used only for operations and cost management — never to profile the child and never shared for marketing.
Technical diagnostics: We store response times and technical error statuses in our operational data at Supabase (EU), to find faults and improve response times. Usage metrics are linked to the child; separate voice-turn timing records contain no user or learner ID, conversation text, or audio. The mobile app does not send crash reports to Sentry.
Mobile app updates: From version 1.0.2 the app fetches fixes and improvements from our own server (Netlify), so they don't have to wait for the App Store or Google Play. The app sends its version, platform (iOS or Android) and the update it is running. Each installation gets a random ID that decides when it receives a new update while we roll it out to a few at a time. The ID is not linked to your account or to the child. To spot an update that does not work, the app sends a short message when it starts and when a screen fails: the installation ID, app version, update, the type of error, the screen's name and a checksum of where the error happened. The message contains no text, no audio, no name and no account ID, and we do not store the IP address. The messages are kept at Supabase (EU) for 90 days.
Product analytics (only if you turn it on): Events about which screens and features are used — in the browser and in the app. The events are tied to a pseudonymous id derived from the account, so when the child is signed in the id is the child's. It is off by default and runs only if you turn it on in the family settings. No conversations, no audio, and no special-category notes are sent, and there is no session recording in the app on phone and tablet (see section 11).

3. What do we use the information for — and on what basis?

Here is each purpose with the lawful basis for processing under the UK GDPR.

Purpose	What it covers	Basis for processing
Create and operate the account	Login, profile, family access, delivery of the service itself	Contract — Art. 6(1)(b) (the service agreement is between Cognition Software ApS and the parent/guardian)
AI teaching with Jabba	Sending the child's messages to the AI model to get responses tailored to the child — including in homework help and the word problems in Lærings Lab	Consent — Art. 6(1)(a) (parental consent given by the holder of parental responsibility)
Speech-to-text and text-to-speech	Converting the child's speech to text and Jabba's replies to voice	Consent — Art. 6(1)(a)
Pedagogical support profile with special-category information	If diagnosis/sensory notes are entered	Explicit consent — Art. 9(2)(a) (in addition to Art. 6)
Memory, so Jabba can remember	Storing excerpts + embeddings so Jabba remembers context	Consent — Art. 6(1)(a)
Safety check of the child's messages (distress detection)	Scanning the message for signs of distress before it is passed on	Explicit consent — Art. 9(2)(a) for the potentially special-category scan. In acute risk, where the child cannot consent on their own, the child's vital interests (Art. 6(1)(d) and Art. 9(2)(c)) may also be a basis.
Operations, security, and cost management	Usage metrics that are technically necessary to provide and operate the service	Contract — Art. 6(1)(b) (limited to what is strictly necessary to provide the service)
Secure login and device overview	One-time links, session status, and the login/activity times shown to the parent	Contract — Art. 6(1)(b) (necessary for login, security, and account administration)
Service messages and email	Account and service email, weekly/monthly recaps, and the safeguarding alert to the parent, sent via our email provider	Contract — Art. 6(1)(b) for account and service email. The safeguarding alert sits under the safety-check basis above. Recap emails can be turned off in the settings.
Technical diagnostics	Response times and error statuses at Supabase (EU); usage metrics are linked to the child, while separate voice-turn timing records have no user id, conversation text or audio	Contract — Art. 6(1)(b), read with the security obligation in Art. 32 (strictly necessary to provide an app that works and is secure)
Investigating reported answers	Review the selected answer and correct errors or unsuitable content	Contract — Art. 6(1)(b) (necessary to provide a safe service)
Optional product analytics	Seeing how the app is used so we can improve it — off by default	Consent — Art. 6(1)(a) (the family's own toggle; on the website, the cookie banner under PECR)
Subscription and payment	Setting up and charging the subscription via Stripe	Contract — Art. 6(1)(b); accounting and tax records: legal obligation — Art. 6(1)(c)

We do not rely on "legitimate interests" to process the child's data for AI or profiling. When children are involved, we choose consent as the basis for everything beyond what is strictly necessary to deliver the service itself.

4. The child's safety (safety check / distress detection)

The child's wellbeing comes first. The app therefore has a safety feature (distress detection — an automatic check for signs that the child is in distress):

The detection happens in two layers: a fixed check on our own server for unambiguous distress expressions (e.g. clear statements of self-harm), and an assessment by the AI model of whether the child is genuinely expressing distress. Stories, quotes, jokes, and ordinary questions are not flagged.
If detected, the child gets a pre-approved, calm response that, among other things, refers to Childline on 0800 1111 — never an improvised AI response.
At the same time, the parent/guardian (the account holder) gets an alert in the app and an email. The email contains what was said (the child's message and Jabba's reply), so the parent can follow along directly. The email itself is sent by our email provider Resend — not by the database — so Resend receives both the parent's email address and the content of the email (see section 5).
The feature is a per-child setting that is on by default. The parent can turn it off under the child's settings. Even when it is off, the child still gets the calm referral to Childline on an unambiguous distress expression; only the alert to the parent is not sent.
There is no external escalation — the information is not automatically passed on to authorities or other third parties.

This processing happens to protect the child, and conversations marked with a safety flag are not stored in the memory feature. Because the check can reveal sensitive matters, we process it on an Art. 9 basis (see section 3).

Jabba is not an emergency service. If a child is in immediate danger, call 999. For non-urgent health advice call NHS 111. Childline (0800 1111) offers free, confidential support for children and young people.

5. Who do we share information with? (Sub-processors)

For the app to function, we use a few technical providers ("sub-processors"). They may only process data on our instructions, and each of them is covered by a data processing agreement (UK GDPR Art. 28) — for most, the provider's standard data processing agreement, which forms part of their terms. We do not permit the providers to use the child's content to train their own AI models — where a provider would do so by default (in practice only our voice provider), we turn training off in the account settings, so the child's data is not included in model training. No data is sold or used for advertising.

Provider	Purpose	What data they receive	Region
AWS (Amazon Bedrock — Google Gemma 4 31B)	Jabba's "brain": writes the responses in the conversation and the daily summaries, reads photos of the child's homework and of the child's own handwritten work, and marks the child's written answers. Also creates the schoolwork if OpenRouter cannot answer.	The child's message text, conversation history, first name, interests, energy level, and a secure subset of the support profile (for the child's own tasks: the subject, the level, the tone Jabba should write in, and how many small steps the task may have; for summaries: the day's activity data; for marking: the child's written answer and the task's marking guide; for a Lærings Lab story: the calculation, year group, interests and up to eight things Jabba remembers, e.g. first names of friends and family). Homework help sends the same as the rest of the chat, including what Jabba remembers. Not diagnosis/sensory notes.	EU (Frankfurt, eu-central-1). AWS does not train on data, and the model provider (Google) receives nothing. "Zero Data Retention" is enabled (data_retention_mode=none), so the child's content is not stored in abuse logs or any other logs. Processing stays in the EU/EEA.
AWS (Amazon Bedrock — Cohere Embed v4)	Finds relevant memories from earlier conversations so Jabba can follow up and avoid repetition.	Selected stored conversation excerpts and text used to search them. No raw audio or diagnosis/sensory notes from the support profile.	EU. Requests go to AWS in Frankfurt through an EU-restricted model profile. Cohere does not receive the content. The resulting search vectors are stored with the memories at Supabase.
OpenRouter (OpenAI gpt-5.6-luna on Microsoft Azure)	Creates the schoolwork and activities — it is what writes them by default. It is also the reserve for Jabba's "brain", for reading a homework photo, and for marking the child's answers if AWS cannot answer.	For the child's own tasks: the subject and level, the two settings that shape the task (the tone Jabba should write in, and how many small steps the task may have), the learning goal's text and which learning mode the task should practise, plus short descriptions of the tasks the child has recently been given for the same goal, so the next one is different. Those descriptions are titles and task types from tasks the app itself made — never anything the child wrote. Tasks made in advance for every child contain nothing about an individual child. As the reserve for Jabba's brain or for the Lærings Lab story: the same data as the AWS row above. During marking: the child's written answer and the task's marking guide. For a photo of the child's homework (Scan a task): the image itself. Not diagnosis/sensory notes, and not the child's own handwritten or drawn work — that path never changes provider.	EU. The call goes to OpenRouter's EU address and from there to Microsoft Azure in the EU, and nowhere else. "Zero Data Retention" is enabled, so the child's content is not stored, and the model's internal reasoning is never retrieved. UK-to-EEA transfers are covered by UK adequacy.
Google Cloud Speech-to-Text / Text-to-Speech	Provider of speech-to-text and text-to-speech in Danish and English. Not used for Jabba's "brain".	The child's microphone audio and/or Jabba's reply text	EU multi-region. Jabba's Google Cloud routes are fixed to Google's EU endpoints. Google states that data at rest and in use stays within Europe on this path.
Supabase	Database, login, and file storage — stores all data mentioned above. (Supabase does not send the app's email; Resend does, see below.)	All stored app data (profile, messages, audio replies, metrics, etc.)	EU-hosted (Frankfurt, eu-central-1). Support access from the USA is covered by the UK IDTA / UK Addendum.
Resend	Sending the app's email: the safeguarding alert to the parent, weekly and monthly recaps, and account/service email (password resets, family invitations, payment reminders).	The recipient's email address and the content of the email itself. For a safeguarding alert that means the child's message and Jabba's reply are in the email. No other app data.	USA (Resend, Inc.). Transfer under the UK IDTA / UK Addendum in the provider's standard data processing agreement. The content may be used only to deliver the email.
PostHog	Optional product analytics on the website and in the app (both web and mobile), so we can see how the app is used and improve it. Off by default.	Usage events (e.g. which screens are opened), a pseudonymous id derived from the account, and technical context such as device type and app/browser version. No conversations, no audio, no special-category notes. No session recording in the app on phone and tablet.	EU — PostHog Cloud EU; UK-to-EEA transfers are covered by UK adequacy. PostHog, Inc. is American; any support access is covered by the provider's standard data processing agreement with the UK IDTA / UK Addendum.
Stripe	Subscription and payment. This concerns the parent as the paying customer — not the child, and purchases happen on the website, not in the child's app.	The payer's name, email address, and payment/subscription details. Card details are entered directly with Stripe and never pass through our systems; we store only Stripe's customer and subscription id plus the status.	EU/UK — the contracting entity for European merchants is Stripe Payments Europe, Ltd. (Ireland). Transfers to the group's US entities are covered by Stripe's standard data processing agreement with the UK IDTA / UK Addendum (and the UK Extension to the EU-US Data Privacy Framework where Stripe, Inc. is certified).
Netlify	Hosting of the app itself: the pages and the app's server code	Technical connection data for visitors (e.g. IP address). What the child types or records passes through the app's server code on its way to the services above; the app does not store or log it at Netlify.	EU (Frankfurt) for the app's server code. The pages and files are delivered from Netlify's global network, from the server nearest the visitor. Netlify, Inc. is American, and operational logs (e.g. IP address and time) may be processed in the USA under the UK Extension to the EU–US Data Privacy Framework and/or the UK IDTA.

Important note about region and AI training: Our database (Supabase), Jabba's AI brain at AWS Bedrock, the task writer at OpenRouter/Microsoft Azure (which is also the reserve for the brain), the approved Google Cloud speech path and the product analytics (PostHog) process data in the EU. Our email provider (Resend) is American. Operational metrics and analytics events are not used for AI training. The app uses only Google for speech and does not switch to another speech provider on failure. We discard the child's raw microphone audio immediately after transcription, and diagnosis or sensory notes are never shared with a speech provider.

6. International transfers (outside the UK)

Our database (Supabase) and Jabba's AI brain (AWS Bedrock) are hosted in the EU (Frankfurt). The schoolwork is written at OpenRouter, which is also the reserve for the brain; both reach only their EU address and Microsoft Azure in the EU. Transfers from the UK to the EU/EEA are covered by the UK's adequacy regulations for the EEA, so no additional safeguard is required for that processing — the child's conversation text, tasks, and summaries are processed in the EU/EEA.

Google Cloud speech is processed through Google's EU multi-region. Product analytics (PostHog) is stored in the provider's EU region, so UK adequacy for the EEA covers it too. The app's server code runs at Netlify in the EU (Frankfurt); Netlify is an American company, and its operational logs may be processed in the USA. Resend (email) is American. Supabase stores all data in the EU (Frankfurt) but has an American parent company with possible support access from the USA; AWS, PostHog, and Stripe likewise have American group entities.

When personal data is transferred outside the UK, Chapter V of the UK GDPR requires a valid transfer mechanism. We rely on the following:

OpenRouter (with Microsoft Azure as its sub-processor): the call goes to OpenRouter's EU address and on to Microsoft Azure in the EU, so the transfer from the UK is covered by UK adequacy for the EEA. The app cannot send it anywhere else: both the address and the choice of upstream provider are fixed in the code, and a call to any other address is refused before it is sent. "Zero Data Retention" is enabled both on the account and on every individual call, so the child's content is not stored.
Google Cloud Speech-to-Text / Text-to-Speech: processing uses Google's EU multi-region and is covered by UK adequacy for the EEA. Google's DPA and transfer terms still govern any access or onward transfer outside the EEA.
Netlify: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, supplemented or replaced where needed by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
Supabase and AWS: data is EU-resident and covered by UK adequacy for the EEA; the UK IDTA / UK Addendum covers any support access from the USA by the provider's parent company.
PostHog: analytics events are stored in the provider's EU region, so the transfer from the UK is covered by UK adequacy for the EEA. Its American group entity is covered contractually by the standard data processing agreement with the UK IDTA / UK Addendum.
Resend: an American provider. The transfer is made under the UK IDTA / UK Addendum in the provider's standard data processing agreement and is limited to the recipient's address and the content of the email.
Stripe: the contracting entity for European merchants is Stripe Payments Europe, Ltd. (Ireland). Transfers to the group's US entities are covered by Stripe's standard data processing agreement with the UK IDTA / UK Addendum (and the UK Extension to the EU-US Data Privacy Framework where Stripe, Inc. is certified).

These transfers are supplemented by technical measures such as encryption, data minimisation (special-category notes are never sent out), and a Transfer Risk Assessment. You can get a copy of the safeguards by contacting us at privacy@cognitionsoftware.dk.

7. How long do we keep the information?

Reports about Jabba's answers: Kept while the child's profile exists, or until you reset the child's data. Reports are also deleted when the child or owner account is deleted.
Profile, conversations, and support profile: Stored as long as you use the app, or until you delete them.
The child's raw microphone audio: Not stored with us — discarded right after conversion to text. (The provider's own retention depends on their plan — see section 5.)
Jabba's audio replies: Stored in a private store for parental replay and deleted automatically after 30 days via a scheduled cleanup.
Memory excerpts/embeddings: Stored to give Jabba context; not stored on a safety flag and deleted when you delete data. This also applies to what is remembered from homework help.
Lærings Lab: Each lab and its trail are kept for 12 months and then deleted automatically. They are also deleted when the child is deleted. A copy of a story the child has reported stays with the report (see above).
Voice-turn timing records: Kept for 90 days and removed daily. They contain no name, account ID, text or audio. A random visit ID groups turns within a visit; timestamps can sometimes be correlated with other operational records.
Mobile app updates: The app's short start and error messages are kept for 90 days and then removed automatically.
Usage metrics: Stored for up to 12 months and used as long as we need them to keep track of operations and costs.
Login links and devices: Link audit information is kept for up to 30 days. An ended device

that is no longer remembered is kept for up to 90 days. Active or remembered devices are kept while needed for login and the device overview, or until the child/account is deleted.

Product analytics: Only if you have turned it on. Events are kept at PostHog (EU) for the retention period we have set on the project. If you turn analytics off, no further events are sent, and you can ask us to delete the existing ones.
Email: Our email provider (Resend) keeps sent email under its own logging policy so delivery can be troubleshot. We ourselves store only that a recap was sent to a recipient — not the content of the email.
Payment and subscription: Payment data sits with Stripe under Stripe's own periods. Accounting and VAT records are kept for 5 years from the end of the financial year they relate to, as required of the Danish company that operates Jabba.

You decide. As parents you can delete the child's data at any time (via the app's delete feature). If you want precise retention periods for a specific provider, these can be provided by the data controller.

8. Automated decisions and profiling

Jabba uses an AI model to create responses and tailor the teaching to the child's interests and level. This means the content is to some extent adapted automatically to the child.

However, no automated decisions with legal effect or similarly significant impact are made about the child (e.g. no automatic assessment that decides something important in the child's life), so Art. 22 UK GDPR is not engaged. The safety feature (distress detection) is a protection of the child and leads only to a calm response plus an alert to the parent — not to decisions about the child towards third parties.

The pedagogical support profile is controlled by you as parents, not by the AI model alone. In line with the ICO Age Appropriate Design Code, we do not use profiling to serve advertising or to nudge the child, and high-privacy settings apply by default.

9. Children's data, the Children's Code, and parental consent

Jabba is aimed at a single child and is used under the parents' responsibility. Children's information enjoys special protection under the UK GDPR.

The Children's Code: We design Jabba in line with the ICO's Age Appropriate Design Code. In practice: the best interests of the child come first; product analytics is off by default, and when a family turns it on it records only how the app is used — never the child's conversations, audio, or special-category notes — under a pseudonymous account id; we minimise the data we collect; we do not profile the child for marketing or use nudge techniques; parents have oversight of the child's activity; and we write our information — including this policy — to be understandable.
Age of consent for online services in the UK: Under section 9 of the Data Protection Act 2018, a child can give their own consent to an online service from the age of 13. If the child is under 13, the consent must be given or authorised by the holder of parental responsibility.
Who consents: Jabba is used by a child under an adult's supervision, and with us it is always the parent/guardian with parental responsibility who creates the account and gives consent on the child's behalf. It must be a person with parental responsibility — not merely someone invited as an "editor" or "viewer" in the family feature.
When the child turns 13: The child can consent on their own to processing based on consent. The policy and the consents should be reviewed at that point.
Special-category information: If you choose to enter diagnosis/sensory notes, it requires explicit parental consent (Art. 9(2)(a)). Only enter such information if you deliberately want to.
Documentation of consent: When you give consent, we record who consented, what was consented to, when, and which version of the text was shown — so the consent can be documented.

10. How do we protect the information?

EU hosting: The database is located in an EU region.
Access control (RLS): The app uses "row level security", so the child can only see their own data, and guardians only see data corresponding to their role.
Private storage of audio: Jabba's audio replies are kept in a private store and accessed only via time-limited, signed links.
Data minimisation before AI: Only what is necessary is sent to the AI model; sensitive notes are never sent.
Secure login: Passwords are handled via Supabase Auth.
No tracking in the app by default: In the app only the necessary session cookie that keeps you signed in is used. Analytics is off by default and only runs if you turn it on yourself (see section 11).
Limited technical diagnostics: Operational metrics are stored at Supabase (EU). Separate voice-turn timing records contain no user id, conversation text or audio. Usage metrics are linked to the child as described in section 2.

11. Cookies and analytics

We never use ad cookies, and we never sell data. Our use of cookies on our public website is governed by the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR. Here is exactly what we use — and when.

In the app itself (when the child or you are logged in) only the necessary session cookie via Supabase Auth is used, which keeps you signed in. It cannot be opted out of, as the app otherwise cannot log you in. There are no ad cookies.

Optional product analytics in the app: Under the family settings you can choose to turn on product analytics. It is off by default. If you turn it on, we use PostHog (hosted in the EU) to understand how the app is used, so we can improve it. This covers both the web app and the app on phone and tablet. It is entirely voluntary, and you can turn it off again at any time.

Session recording — where it can happen, and where it never does. On our website, analytics may include anonymised session recordings (see the cookie policy). If you have turned product analytics on, session recording can also run in the web app; everything typed is always masked and never recorded. In the app on phone and tablet it never happens — on or off — because the app is built so that session recording cannot be switched on. That is a deliberate design rule under the Children's Code, not a setting.

Technical operations and optional product analytics serve different purposes. The operational metrics in section 2 are collected even when product analytics is off. The mobile app does not include a Sentry SDK or send crash reports to Sentry.

On our public website (getjabba.com — e.g. the front page and the homework-help and science pages) we use analytics cookies from PostHog (hosted in the EU) to see which pages visitors find useful. Under PECR these cookies are set only if you give consent in the cookie banner, the data is not tied to an account or to the child, and you can change your choice at any time. Read more in our cookie policy.

12. Your rights

As a data subject (the child, represented by parent/guardian, and the parent themselves) you have the right under the UK GDPR to:

Access — to be told what information is processed, and to get a copy.
Rectification — to have incorrect or incomplete information corrected.
Erasure ("the right to be forgotten") — to have information deleted. The app has a built-in delete feature for this.
Restriction — to have processing restricted in certain cases.
Objection — to object to processing.
Data portability — to have your data provided in a common, machine-readable format and transferred where technically possible.
To withdraw consent — where processing is based on consent, you can withdraw it at any time. It is as easy as giving it, and it does not affect the lawfulness of processing that happened before you withdrew your consent.

We answer your requests without undue delay and at the latest within 1 month (Art. 12). You can exercise your rights by contacting the data controller (see section 1) or using the app's built-in features to view and delete data.

13. Is it voluntary to provide the information?

Using Jabba is voluntary. But some information is necessary for the app to function:

Without email/login, an account cannot be created.
Without the child's first name and messages, Jabba cannot hold a conversation or teach.

If you choose not to provide this necessary information, the corresponding parts of the app cannot be used. The information based on consent (e.g. sensitive notes) is always voluntary.

14. Changes to this policy

We may update this privacy policy, e.g. if the app gets new features or if the rules change. The latest version is always shown in the app with an updated date at the top. If we want to process information for a new purpose, you will be informed first.

Updated 2 October 2026 (same version, uk-1.3):

Mobile app updates are described in section 2: from version 1.0.2 the app fetches fixes from our own server and sends short, anonymous messages about starts and errors. They are kept for 90 days (section 7).
There are no new providers, no information about the child and no new purpose. We are therefore not asking you to accept the policy again.

Updated 29 September 2026 (same version, uk-1.3):

Lærings Lab is described in section 2: what the lab stores, what the AI model receives to write the story, and that you can see each lab in the day overview and in the data export. Labs are kept for 12 months (section 7).
Homework help is now remembered like the rest of the chat. Before, homework help used neither the child's interests nor what Jabba remembers, and nothing from it was remembered. Now homework help receives the same as the chat, and what is remembered is marked as homework.
There are no new providers and no new purpose beyond the AI teaching and memory you have already consented to. We are therefore not asking you to accept the policy again. You can turn Jabba's memory off and see, correct and delete memories under "Jabba's memories".

Version uk-1.3 (23 September 2026) — what is new:

Memory excerpts and search text are processed by AWS Bedrock in the EU using Cohere Embed v4. The previous statement that embeddings were calculated locally was incorrect and has been corrected.
Speech now uses only Google Cloud in the EU; the previous Gemini speech path has been removed.
Reports about Jabba's answers, staff access, export and deletion are described.
Technical diagnostics are clarified: usage metrics are linked to the child, and the mobile app does not send crash reports to Sentry.

Version uk-1.2 (18 September 2026) — what is new:

Two new providers are named: OpenRouter and Microsoft Azure (EU). OpenRouter is the service that now writes your child's schoolwork, and Azure in the EU is the only model provider the call may go on to. Both are fixed to the EU in the code, and "Zero Data Retention" is enabled, so the child's content is not stored with them.
What they see when a task is made for your child: the subject and level, the tone Jabba should write in, how many small steps the task may have, the learning goal's text and the learning mode — plus short descriptions of the tasks the child has just been given for the same goal, so the next one is different. Those descriptions come from tasks the app itself made, never from anything the child wrote. Tasks made in advance for every child contain nothing about an individual child. Never diagnosis or sensory notes.
Reserve, when AWS cannot answer: OpenRouter can also write Jabba's replies in the conversation, read a photo of the child's homework, and mark the child's written answers. A photo or drawing of the child's own handwritten work never changes provider and is only read at AWS.
Sections 5 and 6 have been rewritten so it is clear who does what, and where each piece of processing happens.

Because we are naming new providers that can receive the child's own words, this is a material change. We therefore ask you as guardians to accept the policy again the next time you open the parent dashboard. The child's own use of the app is not affected.

Version uk-1.1 (27 August 2026) — what was new:

Jabba is now also released as an app for iOS and Android. The processing is the same as in the web app; the platform is what is new. When the child records speech as an answer to a task on the phone, the recognition happens on the device itself — that audio never leaves the phone. If the child presses the dictate button in the chat, the audio is sent to our speech-to-text provider as before and discarded immediately afterwards (section 2).
Four providers are now named: Resend (sending email), Sentry (crash reports from the app), PostHog (optional product analytics — now in the app as well), and Stripe (payments). Correction, 23 September 2026: Sentry was planned but is not integrated into the mobile app and receives no data from it.
Correction: the policy previously said parent alerts were sent by Supabase. That is wrong — the email is sent by Resend, and sections 4 and 5 have been corrected so the most sensitive email points at the right provider.
New passages on what a crash report contains (and does not contain), how long it is kept, and that there is never session recording in the child's app.

That release named new providers too, so uk-1.1 was a material change rather than a clarification — and asked for the same renewed acceptance.

15. Complaint to the Information Commissioner's Office

If you are unhappy with how the child's or your information is processed, we would like to hear from you first — contact the data controller (section 1).

You also always have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
Helpline: 0303 123 1113
Web: www.ico.org.uk

If you have questions about this privacy policy, or wish to exercise your rights, you are always welcome to contact us at privacy@cognitionsoftware.dk.