Privacy policy

1. Data controller

The controller of your personal data is QUIZONATOR Sp. z o.o. with its registered office in Wrocław, ul. Św. Mikołaja 8/11/208, 50-125 Wrocław, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register under KRS number 0001149825, NIP (tax ID) 8971947982, REGON 540680867, share capital PLN 5,000.

For privacy matters, write to support@quizonator.com.

2. Scope of this policy

This policy covers the quizonator.com website, your Quizonator account, the Chrome extension and the Android and iOS apps. It also covers contact with support, payments, emails and the use of features based on AI models.

3. What data we process

4. Purposes and legal bases

Providing your email address is a condition for creating an account, and providing billing data is a condition for a purchase. Without them we cannot conclude the contract. You provide other data voluntarily, or it arises while you use the service. We process it for the following purposes and on the following legal bases:

• performance of a contract (Article 6(1)(b) GDPR): running your account, analysing questions, history, plan limits, handling payments and support
• the controller's legitimate interest (Article 6(1)(f) GDPR): security, preventing abuse and multiple accounts, diagnosing errors, statistics, developing the product, the shared answer base, informing you about our own services and establishing, pursuing and defending claims
• consent (Article 6(1)(a) GDPR): optional analytics and marketing cookies, the newsletter and other features for which we ask for separate consent
• legal obligation (Article 6(1)(c) GDPR): accounting and tax records and responses to lawful requests from authorities

5. How AI processing works

The question text and the context needed are sent to our backend and then, through an API, to the selected model provider to prepare a suggestion. The result returns to Quizonator and may be saved in your account history.

Do not send sensitive data or data about other people in your questions unless you have the right to share it. An AI result is a suggestion and may contain errors.

Under OpenAI's rules, data sent through the API is not used to train models by default. The provider may keep limited security logs in line with its current policy.

In the iOS app, before any content is sent for the first time, we ask for separate permission to send quiz content (questions, answer options and images) and the study materials you choose to Quizonator and OpenAI, and to save quiz results in your account history. You can withdraw this permission in the app's privacy settings: that stops new uploads but does not delete content already stored. Opening this policy is not such permission.

6. Shared answer base

To answer faster and more accurately, we save question text, answer options and suggested answers in a shared base, together with the correct answers read from test summary pages. With each question we also save the platform and the name and ID of the test and course.

We use the base to answer every user who comes across the same question. The base does not contain your email address or your name. Answers prepared from your notes or from screenshots are not added to it.

7. Recipients and data transfers

We use only the services needed to run the product. Which recipients are involved depends on the feature you use.

• OpenAI and other model providers available in the product: analysis of question content and materials
• Google (Firebase and Google Cloud): hosting of the backend and database, sign-in, push notifications, reCAPTCHA at registration and, in the apps, usage statistics (Firebase Analytics) and crash reports (Firebase Crashlytics)
• Google Play and Apple: app distribution and in-store payments
• Stripe: payments started on the website and invoices
• Netlify: hosting of the quizonator.com website
• Namecheap (Private Email): sending emails, MailerLite: newsletter, EmailJS: contact form
• ip-api.com: determining the country from the IP address to show the right currency and language
• Fontshare: website fonts, which the browser downloads from the provider's server
• Google Analytics, Meta and TikTok: only after you give the relevant cookie consent
• other technical infrastructure providers

8. Transfers outside the EEA

Some providers may process data outside the European Economic Area. In such cases we use the mechanisms provided for by the GDPR, in particular adequacy decisions or standard contractual clauses.

9. Cookies and similar technologies

Essential technologies keep your session running, protect registration and sign-in and remember your privacy choice. Google Analytics runs after analytics consent. Meta Pixel and TikTok Pixel run after marketing consent. You can change your settings at any time through the "Cookie settings" link in the website footer or in your browser.

10. Mobile apps and the extension

The extension reads question content on supported platforms and, in Snapshot mode, the part of the screen you select. The mobile apps open supported platforms in a built-in browser and read question content from the page open in it.

The apps use Firebase Analytics for usage statistics, for example opening the purchase screen or finishing a test, and the iOS app also uses Firebase Crashlytics for crash reports. You can turn off statistics in the app's privacy settings. In the iOS app the same switch turns off statistics and crash reports together.

11. Emails

We send the messages needed to run your account and payments, for example confirmations, invoices and password resets. We may also send messages about Quizonator features and offers. You can unsubscribe from each such message with one click. We send the newsletter only after you tick the consent box. In our emails we check opens and clicks to learn which information is useful.

12. How long we keep data

• account data: while the account exists and usually up to 30 days after it is deleted
• security and sign-in logs: as a rule up to 12 months
• history of questions, suggestions and your own materials: until you delete them or delete your account
• shared answer base: as long as the question is useful for answering
• after an account is deleted: a hash of the email address with the deletion date for 180 days and hashes of browser and device identifiers with the number of deleted accounts, without the email address in readable form; they make the Free plan available once per person
• billing records: for the period required by tax and accounting law
• correspondence: for as long as needed to handle the matter and to protect against claims

13. Your rights

You can request access to your data, its rectification, erasure, restriction of processing and portability, and you can object to processing. You can withdraw consent at any time. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland. Some rights have exceptions under the law, for example the obligation to keep accounting records.

14. Children and minors

The service is not directed at children under 13. Where the law requires a guardian's consent for specific processing of a minor's data, using that feature requires such consent.

15. Automated decisions and security

Answer suggestions are generated automatically, but they do not produce legal effects or similarly significant effects for you. We may automatically detect unusual sign-ins, multiple accounts created from one device or IP address and other abuse, and you can challenge a decision to block an account permanently by contacting support.

We use organisational and technical safeguards appropriate to the risk. No system, however, guarantees absolute security.

16. Changes and contact

If we make a material change to this policy, we will publish a new version and, where needed, inform users in advance. Send questions and requests about your data to support@quizonator.com.

17. Creator program recruitment

When you apply to the creator program, we process your form details: name, email, WhatsApp number, country of residence and origin, optional social profile, language, adult and consent declarations, and how you found us, including campaign labels in your link. If you submit an application video, we also process its contents, image and voice, recruitment progress and correspondence.

We use these data to assess your application, contact you and take pre-contractual steps at your request (GDPR Article 6(1)(b)). Optional WhatsApp contact is based on consent, which you may withdraw (Article 6(1)(a)). Form security and legal claims rely on our legitimate interests (Article 6(1)(f)). Providing the details needed to assess your application is voluntary, but without them we cannot complete recruitment.

Instructions for the unpaid introduction video are available right away. The video is used only for recruitment; submitting it does not grant permission to publish it as advertising. Collaboration terms and rights to paid publications are agreed separately after selection.

We use Google Firebase and Cloud Storage and Namecheap email to handle applications. WhatsApp/Meta receives data when we contact you through WhatsApp; Notion Labs may also receive them if we enable recruitment management in Notion. Section 8 explains transfers outside the EEA.

We retain recruitment data for the recruitment process, then only to the extent and for as long as needed for correspondence, legal claims or legal obligations. If we enter a contract, data needed for collaboration and payment are retained for the contract and statutory periods. Request deletion or withdraw consent at work@quizonator.com. Withdrawing consent does not affect earlier lawful processing.