Privacy Policy

Effective date: 3 October 2026

1. Data controller

The controller of personal data is AHYEON Tomasz Sawko, ul. Skarbka z Gór 122c/13, 03-287 Warszawa, Poland, tax id (NIP) 7181665800, operating the HeyQuiz platform (heyquiz.pro, app.heyquiz.pro). For all data protection matters please contact support@heyquiz.pro.

2. Who this policy covers

This policy describes the processing of data of: (a) Clients - people who created an Account in the Service and the members of their Organizations; (b) Participants - people taking part in quiz sessions without an Account, to the extent the Operator is the controller of their data (technical and security data); answers, results and data collected in forms are processed by the Operator on behalf of the Client as a processor - the rules are set out in the Data Processing Agreement, and information about purposes and legal bases is provided by the session organiser; (c) visitors of the heyquiz.pro pages; (d) people signed up to the HeyQuiz early access list (section 11); (e) newsletter subscribers and people contacting support.

3. Data collected at registration and sign-in

When you create an Account we collect:

• E-mail address (required for authentication and communication; deemed verified after clicking the verification link, a magic link or an invitation link)
• Name (visible to Organization members; used in communication)
• Password (stored only as a bcrypt hash; never in plain text) - if you register with a password
• Sign-in provider identifier (if you sign in with Google or Apple)
• Account language, marketing consent (date given/withdrawn)
• Proof of accepting the Terms and the Privacy Policy: document version, language, date, IP address and browser identifier (user agent) at the moment of acceptance
• Two-factor authentication secret (TOTP) and recovery codes - encrypted, if you enable 2FA
• A hash of the device fingerprint, browser and operating system name, approximate location based on IP and the sign-in date - for new-device sign-in notifications

Google user data (sign in with Google). If you choose to sign in with Google, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the standard OpenID Connect scopes: openid, email and profile - no access to Gmail, Drive, Calendar, Contacts or any other Google service. We receive the Google account identifier, the e-mail address with its verification status, and the name. We use this data solely to create and authenticate your Account, prefill your profile, link subsequent sign-ins to the same Account and send transactional service messages. We do not use Google user data for advertising or profiling and do not share it with third parties except where necessary to operate the Service (e.g. transactional e-mail delivery). You can revoke access in your Google account permissions; deleting your HeyQuiz Account permanently deletes the linked data. The same rules apply to Sign in with Apple, where you may hide your e-mail address.

4. Organization and billing data

For every Organization we store: name, language, time zone, participant data retention settings, billing e-mail address, company domain (if the Account was registered with a company address - used to detect trial abuse and for verification when restoring access), the Data Processing Agreement party details entered by the Owner (company name or personal name, address, tax id - optional, representative) and the history of DPA acceptances (version, date, who accepted, IP, snapshot of the party details). Payment processing is handled entirely by Paddle.com Market Ltd. We do not store card numbers or bank account details. From Paddle we receive and store: the Paddle customer id, subscription status and plan, billing period, transaction ids, Event Pass information and - to detect repeated use of the trial - a hash of the card brand, last four digits and expiry date; never the full card number.

5. Content data

When you create content we process: quizzes (questions, answers, settings), presentations (uploaded PDF, PPT, PPTX files, the slide images generated from them and annotation layers), branding profiles (graphics, logos, fonts, colours), configurations of prizes, data collection forms and webhooks (URLs, signing secrets - encrypted), session reports and data export bundles. Files are stored in Backblaze B2 object storage in the EU region and count towards the Plan's storage limit.

6. Session and Participant data (processed on behalf of the Client)

When a Client runs a session, the Service processes Participant data: a nickname or the details given in the form before joining (if the organiser enabled data collection, e.g. name, e-mail, the organiser's marketing consent), answers, results, response times, team assignment, reactions, prize claims and - in Expo Events - prize pick-up codes, leads and a device fingerprint hash used to limit the number of attempts. For this data the session organiser (Client) is the controller and the Operator the processor under the Data Processing Agreement. The Operator independently (as controller) processes the technical data of the Participant's connection (IP address, user agent, real-time connection id) to deliver the session, ensure security and prevent abuse. Participant data is anonymised automatically after the retention period set by the organiser (7-90 days, 30 by default), and test session results after 24 hours. The organizer may configure these data to be sent automatically to the organizer's own systems (webhooks) - the recipient is chosen by the organizer, who is responsible for it.

7. AI Assist data

If you use AI Assists (e.g. question suggestions, copy editing, report analysis), the content passed to the feature (a quiz fragment, a topic description, an anonymised report) is sent to a language model through OpenRouter only at your explicit request - never automatically. Requests are made with zero data retention at the model provider; inputs are not used to train models. We store usage metadata (action type, token count, estimated cost, date) to account for the Assist pool. If you connect your own API key, requests are made on your account with the model provider.

8. Technical data, analytics and error monitoring

• Network traffic. Traffic to heyquiz.pro and app.heyquiz.pro passes through the Cloudflare network (proxy, DNS, DDoS protection). Cloudflare processes the IP address and request headers to deliver and secure the connection; Cloudflare Turnstile protects the registration and sign-in forms, the early access list sign-up form on heyquiz.pro and the other public forms against bots, collecting a minimal set of session data and the verification result - no tracking cookies and no CAPTCHA to solve.
• Analytics. We collect anonymised usage data with Umami hosted on our own infrastructure in the EU: IP address (used only for geolocation, never stored raw), user agent, visited pages and used features, session duration and referrer. No cookies, no cross-site tracking; the data never leaves our servers.
• Error monitoring. To detect and fix errors we use Bugsink (Sentry-protocol compatible) hosted on our own infrastructure in the EU: it collects error traces, session metadata (browser, operating system), navigation breadcrumbs leading to the error and performance data - no quiz content. Data is kept for 90 days.
• System logs. Server and application logs (IP address, requested URL, response code, timestamp, account id for auditable operations) are kept for 90 days for security and diagnostics.

9. Technical communication

We send transactional e-mails necessary to run the Service: address verification, magic link, password reset, security codes and alerts (including sign-in from a new device), Organization invitations, Data Processing Agreement confirmations, trial, payment, limit and data export notifications, event reminders, inactivity and account deletion warnings. These e-mails are sent through Amazon SES in the EU region and cannot be opted out of while the Account is active, because they are necessary to provide the service (Art. 6(1)(b) GDPR). Notices about changes to the Terms, maintenance windows and material service changes are sent through the technical list in our self-hosted MailWizz instance - without promotional content.

10. Marketing communication

When registering an Account (and in the profile) the Client may consent to marketing communication (tips, product news, offers, a welcome series). The consent is voluntary and does not affect the ability to use the Service. The Client may withdraw it at any time with the switch in the profile or the unsubscribe link in every message. The marketing list is managed in a self-hosted MailWizz instance on our infrastructure in the EU; we sync the name, e-mail, language, plan and onboarding status to it. Withdrawing consent does not affect transactional e-mails (section 9).

11. Early access list

Before sales of paid plans open, you can sign up to the early access list on heyquiz.pro. The rules of the list - including the conditions of the beta programme and the discount - are set out in a separate document, the "Early access list rules" (heyquiz.pro/en/early-access-rules). In connection with the list we process: the e-mail address, the language of the page, the place on the page the form was sent from, the IP address and the date and time of sign-up, the version of the rules in force at sign-up, the date and IP address of the confirmation, the sign-up status (unconfirmed, confirmed) and the history of the messages sent (date, subject, delivery, link opened). Purposes: running the list and sending messages about the HeyQuiz launch and development (sign-up confirmation and welcome message, invitations with an invitation code, information about the development of HeyQuiz during the beta programme, the sales announcement, reminders about the end of the beta programme, information about a change to the rules or the closing of the list), determining the right to the "Beta" plan and the discount by comparing the Account's e-mail address with the list, and protection against automated sign-ups. The legal basis is consent given by turning on the consent switch in the sign-up form and confirmed with the link in the message (Art. 6(1)(a) GDPR); determining the right to the "Beta" plan and the discount consists of steps taken at the person's request prior to entering into a contract (Art. 6(1)(b)), and protection against abuse and demonstrating that consent was given are our legitimate interest (Art. 6(1)(f)). Consent may be withdrawn at any time with the link in every message from the list or by writing to support@heyquiz.pro; after you unsubscribe we delete the address from the list immediately. The list is run in a self-hosted MailWizz instance on our infrastructure in the EU; the HeyQuiz application does not store list addresses (it passes them to MailWizz at sign-up), and the form is protected by Cloudflare Turnstile (section 8). The early access list is independent of the marketing list (section 10): creating an Account does not move an address between the lists, and marketing consent remains a separate decision. Addresses not confirmed within 30 days are deleted; the whole list is deleted no later than 12 months after sales of paid plans open.

12. Legal bases of processing

We process personal data on the following bases set out in Art. 6(1) GDPR:

• Art. 6(1)(b) - performance of a contract: registration data, Organization and billing data, content, technical data necessary to run sessions, technical communication - necessary to provide the service you signed up for; and determining the right to the "Beta" plan and the discount for people on the early access list (steps taken at the person's request prior to entering into a contract, section 11).
• Art. 6(1)(a) - consent: marketing communication and the early access list (section 11); you may withdraw consent at any time without affecting the lawfulness of earlier processing.
• Art. 6(1)(f) - legitimate interest: anonymised analytics, error monitoring, security logs, new-device detection, bot and abuse protection (including repeated trial use, repeated attempts at an Expo booth and automated sign-ups to the early access list), establishing and defending claims, keeping proof of acceptance of legal documents. You may object to this processing at any time.
• Art. 6(1)(c) - legal obligation: to the extent regulations (e.g. tax law) require keeping billing records - these are kept by Paddle.
• Participant data in sessions is processed on the organiser's instructions (Art. 28 GDPR) - the legal basis is determined by the organiser.

13. Data retention

• Account and Organization data: for as long as the Account exists. Organizations inactive for 12 consecutive months may be deleted after warnings sent 30, 14 and 3 days ahead (not applicable to accounts with a subscription, contract or active Event Pass). Accounts not verified within 30 days of registration are deleted.
• Account deletion: after a 14-day grace period the data is anonymised and the files deleted; an anonymous record of the Organization's existence (without personal data) is removed after a further 30 days, together with technical records that had to survive until the file deletion was confirmed.
• Content (quizzes, presentations, branding, reports): for as long as the Account exists or until deleted by the Client; files removed from the Service are deleted from storage and reconciled daily against the file registry.
• Participant data: for the retention period set by the organiser (7-90 days, 30 by default) - then automatic anonymisation; aggregated session statistics stay with the quiz. Test session results: 24 hours.
• Data export bundles: 72 hours from generation; the export log (who, what, when) - for as long as the Account exists.
• Proof of accepting the Terms, Policy and Data Processing Agreement: for as long as the Account exists and for the limitation period of claims.
• Organization invitations: 7 days; magic links: 15 minutes; technical records of expired links: 30 days.
• Security data and logs: server logs and error monitoring 90 days; known devices - until removed by the Client or the Account is deleted.
• Analytics data: anonymised Umami data for 26 months.
• Billing data: subscription metadata for as long as the Account exists; invoices, transactions and payment data are kept by Paddle in line with its policy and tax regulations.
• Marketing list: until consent is withdrawn or the Account deleted.
• Early access list: until you unsubscribe (the address is deleted immediately after you unsubscribe), and no later than 12 months after sales of paid plans open; unconfirmed addresses - 30 days.

14. Data processors

Your data is processed with the help of the following sub-processors. We use only providers offering GDPR-compliant guarantees (data processing agreements and, for transfers outside the EEA, EU standard contractual clauses or an adequacy decision):

• Hetzner Online GmbH (Germany, Frankfurt data centre): the entire application infrastructure - application and panel servers, database, cache and queues, the real-time session server, and the self-hosted Umami (analytics), MailWizz (e-mail) and Bugsink (error monitoring) instances. Data stays in the EU.
• Backblaze Inc. (B2 storage, EU region): file storage - presentations, slide images, branding graphics, fonts, export bundles. Data is stored in the EU.
• Amazon Web Services EMEA SARL (Amazon SES, EU region): transactional e-mail delivery. Data stays in the EU.
• Cloudflare, Inc. (USA, global network): proxy and DNS for heyquiz.pro and app.heyquiz.pro, attack protection, Turnstile. Cloudflare processes connection data (IP address, headers) transiently to deliver traffic; transfer covered by EU standard contractual clauses and the Data Privacy Framework.
• Paddle.com Market Ltd (United Kingdom): payment processing as Merchant of Record, invoices, customer portal. The United Kingdom holds an EU adequacy decision.
• OpenRouter, Inc. (USA): access to language models for AI Assists. Content sent only at your request, with no retention at the provider and no use for training. Transfer covered by EU standard contractual clauses.
• Lunaweb GmbH / CloudConvert (Germany): conversion of uploaded presentations (PPT, PPTX, PDF) into slide images, with the processing region in Germany; files are deleted at the provider after conversion. Data stays in the EU.
• Google LLC and Apple Inc.: solely as sign-in providers if you choose to sign in with Google or Apple - they act as independent controllers for their own services.

We do not sell, rent or trade your personal data with any third party. Data is shared only with the listed entities, strictly for the purposes described in this policy.

15. Your rights under the GDPR

You have the following rights:

• Right of access (Art. 15): you may request a copy of all personal data we hold about you; we will provide it within 30 days in a structured, commonly used format.
• Right to rectification (Art. 16): you may correct inaccurate data in the Account settings or by contacting us.
• Right to erasure (Art. 17): the Owner may delete the Organization and all related data from the Settings page; deletion is carried out as described above. An Organization member may ask the Owner to remove them or write to us.
• Right to data portability (Art. 20): the Owner may export all Organization data (database + files) as a ZIP bundle from the Settings page.
• Right to object (Art. 21): you may object to processing based on legitimate interest (e.g. analytics); we will stop unless we demonstrate compelling legitimate grounds.
• Right to restriction of processing (Art. 18): you may request restriction while a dispute is being resolved.
• Right to withdraw consent (Art. 7(3)): at any time, without affecting the lawfulness of earlier processing.

To exercise these rights contact us at support@heyquiz.pro - we will reply within 30 days. If you are a session Participant and your request concerns answers or data collected in a form, we will forward it to the session organiser or help you contact them, because they decide on the purposes of that processing.

16. Automated decision-making

HeyQuiz does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (Art. 22 GDPR). The abuse-prevention mechanisms (suspected repeated trial, attempt limit at an Expo booth) only flag an event - a human decides on any restriction, and a Participant may turn to the booth staff. AI Assists create content at your request but make no decisions about you or your access to the service.

17. Security

We implement technical and organisational measures to protect your data:

• encryption in transit (HTTPS/TLS) and encrypted connections between infrastructure components
• passwords hashed with bcrypt; 2FA secrets, sign-in provider tokens and webhook secrets encrypted in the database
• isolation of Organization data at the application level; roles and permissions within the Organization
• two-factor authentication (TOTP) available for all accounts; new-device sign-in notifications; bot protection on forms
• regular, encrypted backups; a file registry reconciled daily against storage so that no file is left without an owner
• export and acceptance logs that cannot be changed or deleted from the application

18. Cookies

The Service uses only cookies necessary for its operation: the application session cookie (keeping you signed in and your language), the CSRF protection token, the "remember me" cookie (if you choose it), a signed cookie identifying the browser for new-device notifications (up to 400 days) and - on Participant join pages - a Participant session cookie allowing a return to an ongoing session. Cloudflare may set temporary cookies needed to secure the connection and for Turnstile verification, and Paddle session cookies during checkout. Umami uses no cookies. We do not use Google Analytics, advertising pixels or any tracking cookies. You can manage cookies in your browser settings; blocking the necessary cookies will prevent signing in.

19. Supervisory authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Polish supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You may also contact the data protection authority in your EU/EEA country.

20. Changes to this policy

We may update this Privacy Policy from time to time. We will announce material changes in the Service and, for registered Clients, by e-mail (technical list) at least 14 days before they take effect. Every version carries a version label and an effective date; the updated policy takes effect on the date shown at the top of this page.