This English version is provided for convenience. If it differs from the Romanian version, the Romanian version prevails.

Privacy Policy

Last updated: October 2026

1. Who we are

QuizX is a service for creating and running quizzes, polls and live Q&A sessions, which can also be used to give individual tests and homework. The Service is aimed at teachers, trainers and event organizers who want to engage an audience in real time.

The controller of the personal data described in this policy is Delta Super Store SRL, a company registered in Romania, with its registered office at Nicolae Grigorescu Street, Sânmartin, Bihor County, Romania, Trade Register number J2021001116053, tax identification number (CUI) 44155511, which operates the QuizX platform (“QuizX”, “we”). You can reach us at contact@quizx.ro, by phone at +40 750 407 434 or through our contact page. For any request about your personal data write to privacy@quizx.ro. For the collection and transmission of data through Meta's and Google's advertising tools, under the conditions described in section 11, we are joint controllers with Meta and, where applicable, with Google; for the further processing they carry out for their own purposes, Meta and Google are independent controllers.

For the data that teachers and schools enter or collect through individual tests, homework and classes (students' names, answers and grades), the controller is the teacher or school using these features, and QuizX acts as a processor (Art. 28 GDPR), as described in section 4. For automatic question generation, Anthropic, PBC acts as our processor (section 3).

2. Two types of users

Organizers (with an account): teachers, trainers, presenters — they create an account, manage quizzes and view the results.

Participants (without an account): school and university students, audience members — they join live sessions using only a game PIN and a nickname they choose themselves. They do not create an account, do not provide an email address and do not provide any identifying information.

Participants in tests and homework (without an account): students open the test page with a 6-character code from their teacher and type their name or pick it from the class list, if the teacher has created one. They do not create an account and do not provide an email address or any other contact details.

3. Data collected from organizers (with an account)

• Account information: Name, email address and encrypted password, provided at registration
• Google sign-in: If you choose “Continue with Google,” we receive your name, email address and profile picture from your Google account
• Content you create: The questions, answers and settings of the quizzes you create
• Billing data: Processed exclusively by Stripe — we never store card details
• Usage data: Number of sessions, number of participants, features used
• Ad measurement data (only with your marketing consent): identifiers from marketing cookies and ad links, your IP address and your browser's full identifier (user agent), and events such as creating an account, starting checkout, starting a trial, subscribing and the value of payments — see section 11
• Email preferences: the language we write to you in, whether you have unsubscribed from tips and news, and a random code used in the unsubscribe link, as well as a record of the emails we sent and of checkouts you started but did not complete (details below)
• Automatic question generation: the topic, text or PDF document you submit, only when you use this feature (details below)
• Public library: the quizzes you choose to publish, together with the author display name (details below)
• Feedback and testimonials: the rating you give after a session and, if you choose, your message, display name and role or organization (details below)
• Special prices: the eligibility declaration and the name of your school or organization, if you choose the teacher price or the community price (details below)
• Tests, homework and classes: the titles and settings of your tests and homework, and the class names and student lists you enter (section 4)
• Contract evidence: for every subscription bought online we keep your request for an immediate start, the order summary shown before payment, the confirmation email, any withdrawal statement and the yearly renewal notices, with their date and time

The emails we send you

In addition to strictly necessary emails (for example, password resets), we automatically send you a few emails related to your account:

• about your account and payments: a reminder a few days before your €0.49 first month ends, and a notice when a subscription payment fails;
• to help you get started: a welcome email right after you create your account, then, only where relevant, a nudge to create your first quiz (if you have not created one after the first day) and one to host your first session (if you have not hosted one within a few days of your first quiz);
• reminders about QuizX: one email if you started paying for a subscription but did not complete the payment (a few hours later), and one if you have not hosted a session for about 30 days after hosting at least one.

Legal basis: emails about your account and payments are necessary to perform our contract with you (Art. 6(1)(b) GDPR), so you receive them whatever your email preferences. We send getting-started emails on the basis of our legitimate interest in helping you use the service you chose (Art. 6(1)(f) GDPR). Reminders about QuizX are commercial communications about our own services, similar to the one you already use, sent to the email address you gave us when you created your account, under Article 12(2) of Romanian Law No. 506/2004 and on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

Unsubscribing: every getting-started email and every reminder, starting with the welcome email sent right after you create your account, contains an unsubscribe link. The link opens a page where you can unsubscribe with a single click, without signing in; email apps that show their own unsubscribe button (for example, Gmail) can unsubscribe you directly, also in one click. You can also object at any time through our contact page, and you can subscribe again at any time from the same unsubscribe page. Emails about your account and payments continue for as long as you have an account.

What we keep: the language of your emails (the interface language you created your account in, updated when you sign in using a language you chose or that was detected automatically), your unsubscribe choice and its date, the random code in your unsubscribe link, and a log of the emails we sent (email type, date and delivery result, without their content), kept for 400 days so we never send you the same email twice. For the unfinished-checkout reminder, we keep, for 180 days, the plan you chose and when you started and completed the checkout. Your email preferences are deleted when your account is deleted. Our emails contain no tracking pixels; their links carry campaign tags (utm_*), which our website analytics uses only as described in section 10.

Automatic question generation

If you use the automatic question generation feature, the topic, text or PDF document you submit, together with the options you choose (number and type of questions, difficulty, grade or audience, and language), are sent to Anthropic, PBC (United States), the provider of the model that writes the questions. Anthropic processes them as our processor, on our behalf, only to generate the questions you asked for. This happens only when you use the feature; we do not send your name, email address or any other account data.

Under Anthropic's commercial terms, the content we send is not used to train its models. Anthropic keeps it only for a limited period set out in its terms, including for safety and abuse prevention. The transfer of the data to the United States takes place under the standard contractual clauses approved by the European Commission, included in Anthropic's data processing agreement, and, where applicable, under the EU–US Data Privacy Framework.

On our server, the topic, text and PDF are not saved: they are kept in memory only while the questions are being generated, and the resulting questions for at most 15 minutes, so we can show them to you; they reach your account only if you add them to a quiz. We keep only technical data about each generation (date, model used, number of questions, amount of content processed and cost, outcome and any error), linked to your account, to apply your plan's daily limits and keep track of costs, until your account is deleted. Please do not include personal data (for example, students' names) in the texts or documents you submit. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR): generation happens only at your request.

The public quiz library

If you choose to publish a quiz in the public library, we keep a copy of its questions, title, description, subject, grades, language and the author display name you choose (you can use just your first name or the name of your school). After we review and approve it, the quiz appears publicly on the website (the /quiz-uri and /en/quizzes pages, including in search engine results) together with the display name, and any user can copy it into their account. Your email address and other account data are not shown. The legal basis is the performance of our contract, at your request (Art. 6(1)(b) GDPR), under the license described in the Terms and Conditions.

You can withdraw a submitted or published quiz at any time from the quiz menu: it disappears from the public pages, but copies other users have already made remain in their accounts. Quizzes that were submitted but not published (pending, rejected or withdrawn) are deleted when your account is deleted; published ones remain in the library without the author name and without any link to your account, under the license you granted.

Feedback and testimonials

After some live sessions, we may ask you in a small window how it went. Answering is optional: you can close the window (“Not now”), and if you close it several times, we stop asking. Your rating (one of the four faces) is saved only if you click it; your message, display name and role or organization are saved only if you fill them in and press “Send.” To decide when to ask you, we keep the date we last asked and how many times you chose “Not now.”

A testimonial is published on the website (currently on the home page), with the display name and role or organization you wrote, only if you ticked the box agreeing that it may be shown on quizx.ro with your name, and only after we read and approve it (Art. 6(1)(a) GDPR). Without that box ticked, we do not keep your name or role, and your message is used only internally, to improve the Service (legitimate interest, Art. 6(1)(f) GDPR). You can withdraw your consent at any time through our contact page: we remove the testimonial from the website, and the withdrawal does not affect the lawfulness of how it was shown until then. Feedback and testimonials are deleted when your account is deleted.

Special prices for teachers and communities

If you choose the teacher price or the community price (churches, youth groups and nonprofits), we keep the fact that you ticked the eligibility declaration, its date, the name of the school, institution or organization you entered and the offer you chose, linked to your account and subscription. The offer and the organization name are also saved in your subscription details at Stripe. We use them to give you the special price and, where needed, to check that the eligibility conditions are met (performance of our contract and our legitimate interest in preventing misuse of the special prices, Art. 6(1)(b) and (f) GDPR). This data is kept for as long as you have your account.

4. Data collected from participants (without an account)

• Nickname: The name a participant freely chooses when joining a session (e.g., “Dragon,” “Maria123”) — it is not verified and is not linked to a real identity
• Quiz answers: The answers given during the session, linked to the nickname, are stored in the organizer's database so that the results can be analyzed (e.g., the teacher can see that “Maria123” answered 7 out of 10 questions correctly)
• Score and leaderboard: Calculated from the answers, visible during the session and stored in the organizer's history

We do not collect IP addresses, location data, device information or any other personal identifier from participants or students.

Individual tests, homework and classes

Teachers can give a quiz as an individual test (taken in class, within a set time) or as homework (due by a deadline). Students enter with the test code and type their name or pick it from the class list. Teachers can create classes with student lists (for example, first and last names); students who have the test code can see the list so that each of them can pick their own name. For each student we keep:

• the name they typed or picked from the class list;
• the order in which they received the questions and answer options, the answers they gave, and when they started the test, were last active and submitted it;
• the score and grade calculated, any corrections made by the teacher and, for students in a class, how their grades change from one test to the next.

Who is responsible for the data: for this data, the controller is the teacher or school using tests, homework and classes: they decide what data to enter, for what purpose to use it and how long to keep it, and they are responsible for the legal basis of the processing, including informing students and, where applicable, their parents. QuizX processes this data as a processor, only to provide these features and in line with the teacher's instructions, and does not use it for its own purposes, for advertising or for website analytics. On request, through our contact page, we provide teachers and schools with our data processing agreement (Art. 28 GDPR). Students and parents who want to exercise their rights regarding this data can contact the teacher or school; if they contact us directly, we forward the request to the teacher and help them respond.

Who can see the data: results are visible only to the teacher who created the test. Students see their own result only if and when the teacher decides (the grade only, or the correct answers as well); there is no leaderboard, and the projector screen shows only how many students have submitted the test, without names or grades.

How long we keep the data: tests and homework, with students' answers and grades, as well as classes and student lists, are kept until the teacher deletes them (at any time, in the app: a test, a student's attempt, a student on a list or a whole class) or until the teacher's account is deleted, when we delete all of them. If we set a period after which closed tests and homework are deleted automatically, we will state it here.

Storage on the student's device: so that students can continue a test after reloading the page or losing the connection, the test page saves in the browser's local storage (localStorage) a random code for the attempt, any answers not yet sent to the server and the question they were on (see the table in section 10). The code stays saved after the test is submitted, so the student can see their result once the teacher releases it; it can be removed at any time by clearing the site's data in the browser. This storage is strictly necessary for the service the student and the teacher have asked for (Article 4(6) of Romanian Law No. 506/2004), so it does not require consent. The test and homework pages (/t) do not use analytics or marketing cookies, are not measured by our analytics system and do not load Meta's or Google's tools.

5. Use by participants who are minors

QuizX is designed so that students and children provide as little personal data as possible: a live session needs only a game PIN provided by the teacher and a freely chosen nickname, and a test or homework needs only the test code and the name the teacher asks for. Students do not create accounts and do not provide email addresses or any other contact details. The teacher/organizer is responsible for using the Service in an educational context and for informing students and parents about this policy.

We do not intentionally collect personally identifiable data from persons under the age of 18 for our own purposes. Students' names in tests, homework and classes are processed only on behalf of the teacher or school (section 4), who may, if they prefer, use only first names and initials. If you discover that a minor has provided personally identifiable data in a live session (for example, by entering their full name as a nickname), contact us and we will promptly delete that data.

6. How we use organizers' data

• To provide and improve the QuizX service
• To manage your account and subscription
• To send you emails about your account and payments (for example, payment confirmations, password resets, the end of your €0.49 first month or a failed payment) and the getting-started emails described in section 3
• To respond to support requests
• To detect and prevent abuse or fraud
• To occasionally send you reminders about QuizX, which you can unsubscribe from at any time (section 3)
• To generate questions at your request, to publish in the public library the quizzes you choose to publish and, only with your consent, to show your testimonial on the website
• To give you the special prices and check eligibility for them
• Only with your marketing consent: to measure how effective our ads on Meta and Google are, to let these platforms optimize ad delivery and to build advertising audiences (section 11)

7. Data sharing

We do not sell your personal data. We share data only with:

• Stripe — for payment processing; for the special prices, Stripe also receives the chosen offer and the name of the school or organization, saved in the subscription details
• Google — for OAuth sign-in (if you choose this option)
• Infrastructure providers — for hosting (data remains in the EU/EEA)
• Anthropic, PBC (United States) — as a processor, for automatic question generation, and only with the content you submit when you use this feature (section 3)
• Meta Platforms Ireland Ltd. and Google Ireland Ltd. — for measuring and optimizing our ads, only with your marketing consent (section 11)

Organizers can see the data from their own sessions, tests and homework (participants' nicknames or names, answers and results). We do not share this data with third parties. Only the content you choose to publish becomes public: quizzes approved for the public library and approved testimonials, with the display name you chose.

8. Data retention

• Organizer account data is retained until the account is deleted
• Live session history (nicknames + results) is retained for 90 days after the session takes place and is then deleted automatically
• Tests and homework (students' names, answers and grades), classes and student lists are kept until the teacher deletes them or until the teacher's account is deleted (section 4)
• Website analytics data is deleted automatically after 13 months, and exit survey answers after 24 months (see section 10)
• Ad measurement data: the marketing identifiers, IP address and user agent kept for conversions reported later are deleted automatically no later than 90 days after their last update, and the conversion log after 13 months (the Google click identifier in the log, after 90 days); see section 11 for details. Data received by Meta and Google is kept by them in accordance with their own policies
• The log of emails sent is deleted after 400 days, and the record of checkouts started but not completed after 180 days; email preferences are kept until the account is deleted (section 3)
• Texts and documents submitted for automatic question generation are not saved on our server, and technical data about generations is kept until the account is deleted (section 3)
• Feedback, testimonials and the declaration for the special prices are kept until the account is deleted; a published testimonial can be removed from the website at any time at your request
• Quizzes published in the public library stay public until you withdraw them; when your account is deleted, published ones remain in the library without the author name, and unpublished ones are deleted (section 3)
• Evidence of contracts concluded online (the request for an immediate start, confirmations, withdrawal statements and renewal notices) is kept for 3 years after the contract ends, including after the account is deleted, so that we can prove we respected your consumer rights; the legal basis is our legal obligation and our legitimate interest in defending ourselves in a dispute
• You may request the erasure of all data by contacting us

9. Security

We use HTTPS, encrypted passwords (bcrypt), secure sessions and restricted database access. No system is 100% secure — if you discover a vulnerability, please report it to us responsibly.

10. Cookies and local storage

We use three categories of cookies, all set on our own domain (first-party cookies): necessary cookies, which keep the website working and do not require consent; our own analytics cookies (qx_vid, qx_sid), which are set only with your consent to analytics; and marketing cookies (Meta and Google), which these platforms' scripts create only with your marketing consent and only on the public pages of the website (section 11). The two consents are separate: you can accept analytics without marketing, or the other way around. In addition to cookies, the test and homework pages use the browser's local storage (localStorage), only as strictly necessary for taking the test (section 4).

Meta's and Google's scripts may renew the marketing cookies on later visits, in which case the duration runs from the latest renewal. The Google tag may also use other cookies whose names start with _gcl_, for the same purposes and with the same duration. In addition to the cookies above, which are set on our domain, Meta and Google may read or set their own cookies on their domains (for example, fr on facebook.com or IDE on doubleclick.net), especially if you have an account with them; those cookies are governed by Meta's and Google's policies. If you withdraw your marketing consent, we delete all the marketing cookies on our domain from your browser; you can manage the cookies on Meta's and Google's domains in your browser settings or in your account settings with those services.

Participants who join sessions with a game PIN (the /play page) and students taking tests or homework (the /t pages) only receive the language cookies; tests and homework also use the local storage described in the table.

Website analytics

To understand where visitors run into difficulties and to improve the website, we use our own analytics system. The data is stored in our database in the EU, is not passed on to third parties and is not used for advertising.

What we record:

• the pages you visit, the time spent on each page, how far you scroll and which sections of the page were visible;
• clicks on interface elements (buttons, links, menus), identified by the element's internal name or visible label, including repeated clicks or clicks with no effect, which signal a problem;
• how forms are used, without their contents: whether you started filling one in, the names of the fields used, whether submission was rejected by validation (for example, a required field left empty) or whether you gave up;
• technical errors in the page or in communication with the server, and loading times;
• the device type (computer, tablet, phone), browser and operating system (general name only), the browser and interface language, and the time zone;
• the website you came from (domain only, for example google.com) and the campaign tags in the link (utm_source, utm_medium, utm_campaign);
• actions such as your choice in the cookie banner, switching the language, choosing the billing period on the pricing page or entering a game PIN on the home page (only whether it was valid, not the PIN itself);
• key account steps: creating an account, signing in, creating a quiz, hosting and finishing a session (without the quiz content), starting a payment, and activating or canceling a subscription.

What we never record in this data:

• form contents or typed text: names, email addresses, passwords, messages, quiz content (the only exception is a comment you choose to write in the exit survey, described below);
• your IP address (not even truncated or pseudonymized) or your browser's full identifier (user agent);
• payment data, which is processed exclusively by Stripe;
• the full page address: we keep only the path (for example /pricing), without parameters, except for the utm_* campaign tags;
• session recordings (video, screenshots, mouse movements): we do not use “session replay” tools. The data from this analytics system is not passed on to Meta, Google or any other third party; the advertising tools, used only with your marketing consent, are described separately in section 11.

Legal basis and your choice: tracking your journey on the website (the qx_vid and qx_sid cookies, linking pages and successive visits) takes place only with your consent (Art. 6(1)(a) GDPR), given in the cookie banner with the accept button or by turning on the analytics category in the settings. You can withdraw your consent at any time, as easily as you gave it, from the “Cookie preferences” link in the page footer; the qx_vid, qx_sid and qx_svy cookies are then deleted from your browser. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. If your browser sends the Global Privacy Control (GPC) signal, we treat it as a refusal.

If you decline or make no choice: no analytics cookie is set (only qx_consent, once you choose), and events are recorded anonymously and used only for aggregate statistics: they contain no identifier that would link them from one page to another, from one visit to another or to your account. For these anonymous statistics we rely on our legitimate interest in keeping the website working and improving it (Art. 6(1)(f) GDPR), to the extent that they could be considered personal data.

Linking to your account: if you have accepted analytics and then create an account or sign in, the browsing history from that browser is linked to your account, so we can understand what helped or confused you on the way to signing up. Without your consent, this link is not made.

Exit survey: we may sometimes ask you in a short, optional survey, before you leave the website, why you are leaving. We keep the reason you choose, any comment you decide to write, the page and the language; please do not include personal data in your comment. If you have accepted analytics, the answer is linked to your visit and, through it, to your account if that browser is linked to one; if you refused analytics or have withdrawn your consent, the answer is kept without any identifier.

How long we keep the data: recorded events and visits are deleted automatically after 13 months, and survey answers after 24 months. When your account is deleted, we also delete all analytics data linked to it, including the data of the browsers associated with it. The rights in section 12 also apply to this data.

11. Advertising and ad measurement (Meta and Google)

We promote QuizX with ads on Meta's platforms (Facebook, Instagram, Messenger and the Audience Network of partner apps and websites) and on Google (Google Search, YouTube and the Display Network). To find out which ads bring people who create an account, start a trial or subscribe, and to spend our advertising budget on the ads that work, we use the following tools, only if you give your marketing consent in the cookie banner:

• Meta Pixel and the Conversions API, provided by Meta Platforms Ireland Ltd. (Ireland). The Pixel runs in your browser; through the Conversions API, our server sends the key events (for example, creating an account, starting checkout, subscribing and payments) directly to Meta, including those your browser cannot see (for example, a payment confirmed by Stripe or a subscription renewal);
• the Google Ads tag (Google tag) and, if we enable it, Google Analytics 4, provided by Google Ireland Ltd. (Ireland).

What data is sent (only with your marketing consent):

• the public pages you visit (the page address and the referring page), the time of the visit and the technical information your browser sends automatically (for example, browser type, language and screen size);
• the events that show whether an ad worked: viewing the pricing page, creating an account (and the method: email or Google), starting checkout (the chosen plan and its value), starting a trial, subscribing and every successful payment, including renewals and add-ons (the value, currency, plan and an estimated subscription value), as well as sending the contact form. Each event has a random identifier, used so that it is not counted twice;
• the identifiers in the marketing cookies on our domain (_fbp, _fbc, _gcl_*, _ga) and the click identifiers the platforms add to the ad link (fbclid, gclid, gbraid, wbraid);
• your IP address and your browser's full identifier (user agent): Meta and Google receive them directly whenever your browser loads their scripts; in addition, our server sends them to Meta through the Conversions API, together with the events above;
• to match events with the platform's users: to Meta, your account's email address (or, for the contact form, the address you enter in the form), normalized (no spaces, lowercase) and irreversibly transformed with the SHA-256 hash function, and your internal account identifier, also transformed with SHA-256; for Google enhanced conversions and Meta advanced matching, the email address you type into the form is hashed directly in your browser, by Google's or Meta's script respectively, before it is sent. If Meta's Automatic Advanced Matching is turned on, the Meta Pixel may also read the email address, name and phone number you type into form fields on the public pages (sign-up, sign-in, contact), and hash them in your browser before they are sent; passwords are never read. Our server never sends your email address in plain text. Hashed data is still personal data (pseudonymized), because the platforms can compare it with their own users' data;
• mainly for conversions your browser cannot report to Google (for example, renewals or signing up with “Continue with Google”), we may upload to our Google Ads account a file containing only the Google click identifier (gclid), the type of conversion, its time, value and currency, and only for conversions made with your marketing consent.

Purposes: (a) to measure how effective our ads are: how many people reached the website from a given ad and how many of them created an account, started a trial or subscribed; (b) to let the platforms optimize ad delivery, that is, show our ads first to the people who, based on the platform's analysis, are more likely to be interested in QuizX; (c) to build advertising audiences on these platforms, for example people who visited the website or subscribed, in order to show them relevant ads or to exclude them from ads that are no longer relevant to them, as well as audiences of people with similar interests.

Legal basis: your consent (Art. 6(1)(a) GDPR), which is also required for storing and reading information in your browser (Article 4(5) of Romanian Law No. 506/2004, which implements the EU ePrivacy Directive). Marketing consent is separate from consent to our own analytics. Without your marketing consent, we do not load the Meta Pixel, no marketing cookies are set, no advertising identifiers are sent and our server does not report events to Meta (see below for when a withdrawal of consent takes effect); the Google tag is not loaded either, except in the advanced configuration of Consent Mode described below, and only until you make a choice. If your browser sends the Global Privacy Control (GPC) signal, we treat it as a refusal of marketing.

Google Consent Mode (v2): we pass your choice to the Google tag for each type of use (storing advertising and analytics cookies, sending user data to Google for advertising, and ad personalization); until you consent, all of them are set to “denied.” In the basic configuration, which is our default setting, the Google tag is not loaded at all before you consent. We may also use the advanced configuration: in that case, until you make a choice, the Google tag loads on the public pages in the “denied” state: it does not set or read cookies and does not use advertising identifiers, but it may send Google cookieless signals (for example, that a page was visited or that a conversion took place, the time, technical information about the browser and the IP address, which every server your browser connects to receives). Google uses these signals to estimate, in aggregate, the conversions that cannot be measured directly (modeling). If you decline marketing, withdraw your consent or your browser sends the GPC signal, the Google tag stops sending anything and is no longer loaded, not even in this state. For these signals we rely on our legitimate interest in measuring the effectiveness of our ads in aggregate (Art. 6(1)(f) GDPR); you can object at any time by declining marketing in the cookie banner or through the “Cookie preferences” link.

Who is responsible for the data: for the collection of data on our website through the Meta Pixel and its transmission to Meta, including through the Conversions API, we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR; judgment of the Court of Justice of the European Union of 29 July 2019, Case C-40/17, Fashion ID). The allocation of responsibilities is set out in Meta's Controller Addendum: we inform you and obtain your consent, while Meta handles requests about your rights for the data it stores after transmission; you can contact either of us. For the Google Ads tag, the collection of data and its transmission to Google Ireland Ltd. take place, as applicable, as joint controllers or as independent controllers, in accordance with Google's data protection terms for its customers; for Google Analytics 4, Google processes the data mainly on our behalf, as a processor.

After receiving the data, Meta and Google process it as independent controllers for their own purposes (for example, to provide and improve their advertising services and to personalize the ads they show you), in accordance with their policies: the Meta Privacy Policy, the Google Privacy Policy, Google's privacy and data protection information for business customers and how Google uses information from sites that use its services.

Transfers outside the EU: Meta Platforms, Inc. and Google LLC, in the United States, may receive or access the data. These transfers take place under the EU–US Data Privacy Framework, under which both companies are certified and for which the European Commission has adopted an adequacy decision, and, where applicable, under standard contractual clauses approved by the European Commission.

What we never send to Meta or Google:

• the content of the quizzes in organizers' accounts, of polls, Q&A sessions, tests and homework, or participants' and students' names, answers, grades or any other data (for the public pages of the quiz library, the platforms may receive, as for any public page, the address and public information of the page visited);
• card details (payments are processed exclusively by Stripe) or your password;
• the content of messages sent through the contact form, or your email address in plain text (not hashed), the texts and documents submitted for automatic question generation, or the name of the school or organization declared for the special prices;
• security codes in links, such as those for resetting your password or for team invitations;
• anything from the /play page, the test and homework pages (/t), the projector screen or inside the app (creating and hosting quizzes, the subscription page, administration).

What we keep on our server: some conversions happen after you have left the website (for example, a payment Stripe confirms later, or a subscription renewal). To report them correctly, we keep in our database in the EU, linked to your account, your marketing choice and, if you accepted, the marketing identifiers (_fbp, _fbc, Google click identifiers), the IP address and the user agent from your last action taken with marketing consent (creating an account, signing in, starting checkout). The identifiers, IP address and user agent are deleted automatically no later than 90 days after their last update, and your choice after 13 months without an update. We also keep a conversion log linked to your account (event type, date, value, currency, plan, the Stripe payment reference, the Google click identifier if there is one, and the transmission result, without the IP address or user agent) for 13 months, to check what was reported and to import conversions into Google Ads; the Google click identifier is deleted from the log after 90 days. Conversions for which you have not given marketing consent are recorded in the log as not sent, without your account identifier, without any marketing identifiers and with only an irreversible fingerprint (SHA-256) of the Stripe payment reference instead of the reference itself, only so we know how many were not reported and so they are not counted twice (legitimate interest, Art. 6(1)(f) GDPR). When your account is deleted, we also delete the data above that is linked to it.

Withdrawing consent: you can withdraw your marketing consent at any time, as easily as you gave it, from the “Cookie preferences” link in the page footer. From that moment, we stop sending events to Meta and Google from that browser, their scripts are no longer loaded on the following pages (not even the Google tag in the advanced configuration), and the marketing cookies on our domain are deleted. For events our server reports directly (for example, recurring payments), your choice takes effect, and we delete the marketing identifiers kept for your account, as soon as that browser next contacts our website while you are signed in to your account (for example, when you open a page or use the app); if you are not signed in at that moment, it takes effect the next time you sign in from that browser, or right away if you write to us through our contact page. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, nor the data Meta and Google have already received; for that data you can contact the platforms directly.

The platforms' own controls: you can also manage the ads you see in Meta Ad Preferences (in Meta Accounts Center), including the information about your activity off Meta technologies, and in Google My Ad Center, where you can turn off personalized ads.

12. Your rights (GDPR)

If you are located in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data rectified
• Request the erasure of your data (the “right to be forgotten”)
• Export your data in a portable format
• Object to processing in certain circumstances
• Withdraw at any time the consent you gave for analytics or marketing, without affecting the lawfulness of processing carried out before the withdrawal
• Lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro)

To exercise these rights, please contact us.

For data in tests, homework and classes, whose controller is the teacher or school, please contact them; we will help them respond to you (section 4). Where processing is based on our legitimate interest (for example, getting-started emails), you can object at any time, and you can unsubscribe from reminders about QuizX at any time, without having to give a reason.

13. Changes to this policy

We may update this policy from time to time. Registered users will be notified by email of any significant changes.

14. Contact

For privacy questions or data requests, please contact us.