Privacy Notice

Data we collect and why

• Account data (name or display name, email address, hashed password or Google sign-in identifier): to create your account, verify your email, sign you in and secure the account. Legal basis: performance of our contract with you.
• Workspace and content data (workspace name, members, invitations, quizzes, questions, images, event settings and branding): to provide the service. Legal basis: performance of our contract.
• Player data at events (the nickname a player types, their answers, scores and an anonymous device identifier that lets them reconnect): to run the event and produce results. We do not ask players for an email address or phone number for gameplay. Legal basis: performance of the contract with the workspace hosting the event, whose organiser decides what to do with the results.
• Billing data (plan, subscription status, billing period, invoices, company name and tax ID where you provide it): to manage your subscription and meet accounting duties. Card details are handled by our payment provider, not by us. Legal basis: contract and legal obligation.
• Technical and security data (IP address, browser and device information, request logs, rate-limit and error records): to keep the service available, prevent abuse and fraud, and debug problems. Legal basis: our legitimate interest in a secure, working service.
• Support messages you send us: to answer you and improve the product. Legal basis: contract and legitimate interest.
• Measurement and marketing cookie data, only if you consent: to understand site usage and measure campaigns. Legal basis: your consent, which you can withdraw at any time.

Who we share data with

We do not sell personal data and we do not use your quiz content or player data to advertise to you. Workspace data is isolated per workspace: other customers cannot access your quizzes, events, players or billing.

• Hosting and database providers that run the platform infrastructure on our behalf.
• Paddle.com, our Merchant of Record, for orders, subscription management, payments, invoicing and tax compliance.
• An email delivery provider for account emails such as verification, password reset and purchase confirmations.
• An AI provider that processes the prompt you type when you use the AI quiz generator, in order to return generated questions. Do not include personal or confidential information in those prompts.
• Professional advisers (legal, accounting) and authorities, where we are legally required or it is necessary to protect our rights.

International transfers

We are based in Hungary and process data in the European Economic Area where possible. Some providers may process data outside the EEA or the UK; in that case we rely on an adequacy decision or on Standard Contractual Clauses together with appropriate technical measures.

How long we keep data

• Account and workspace data: while the account exists, and deleted or anonymised after you delete the account or workspace.
• Event, player and result data: kept for the workspace so the organiser can review or export results, and deleted when the organiser deletes the event data or the workspace.
• Billing records and invoices: kept for the period required by tax and accounting law, which is longer than the account itself.
• Technical logs: kept for a short period for security and troubleshooting, then deleted.

Your rights

You can request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability of data you provided, and you can object to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time. You can also complain to your local data protection authority; in Hungary this is the NAIH.

To exercise a right, use the contact page or the support request form in your workspace. We answer within one month. Workspace owners can also export workspace data and delete the workspace from the dashboard, with a confirmation step before anything is removed.

Security

Access to customer data is restricted by tenant-aware database policies, so each workspace can only reach its own data. Traffic is encrypted in transit, passwords are stored hashed, privileged credentials and payment secrets stay on the server, and joining, answering and authentication are rate limited. Correct answers and explanations are not sent to player devices before they are revealed.

Cookies and consent

We use necessary cookies to keep you signed in, remember your language and keep a player connected to the event they joined; these are required for the service to work. Measurement and marketing cookies are only set after you accept them in the cookie notice, and everything is denied by default until you choose.

You can change or withdraw your choice at any time using the "Cookie settings" link in the footer. Your choice is remembered for six months. The big-screen display view never shows the notice, and no measurement or marketing tags load without consent.