This Policy explains what personal data the Quizyk service (the https://quizyk.com website and app) processes, why, on what legal basis, who receives it, how long it is kept and what rights you have. It follows the Law of Ukraine "On Personal Data Protection" and, for users in the European Union and the EEA, the General Data Protection Regulation (EU) 2016/679 (GDPR).
01Who is responsible for your data
The controller of your personal data is Arsen Marianovych Polivka, a sole proprietor (FOP) registered in Ukraine ("we"). Send any question about personal data to support@quizyk.com.
When a teacher, trainer, school or company uses Quizyk to collect responses from its participants (for example through pre-test intake fields, classes or workspaces), they decide what is collected and why. For that data they are the controller and we are a processor acting on their behalf. Direct questions about such data to the test author or organisation first; we will help them respond.
02What data we process
| Category | What exactly | Source |
|---|---|---|
| Account | E-mail address, name, password hash (we never store the password itself) or, when you sign in with Google, your Google account ID, name, e-mail and profile picture URL; the date you accepted the Terms; your marketing e-mail preference | You, Google |
| Profile | Username (generated from your name), bio, occupation, institution or organisation, activity streaks | You, the service |
| Content | Tests, questions, answer options, folders, cover images | You |
| Test attempts | Answers, scores, start and finish times, progress; for guests, the name you enter; answers to intake fields set up by the test author; certificates (recipient name, test, result) | You, the test author |
| Live rooms | Player name, answers, points and leaderboard position | You |
| Workspaces and classes | Membership, role, invitations; other members of a workspace see your name and e-mail | You, the workspace owner |
| Communications | Name, e-mail and message from the contact form; newsletter subscription; content reports (reason, comment) | You |
| Notifications | In-app notifications; for push notifications, your browser’s subscription endpoint and encryption keys | The service, your browser |
| Technical data | IP address and request data in hosting logs; a hashed IP address for rate-limiting forms; search terms, stored without any link to you | Your device |
| Analytics (only with consent) | Usage events (such as "test created", "test submitted"), pages viewed, a pseudonymous ID, once signed in your account ID and occupation, language, theme, device and browser type, approximate location derived from IP (country, city), error reports | Your device |
| AI import | Text, PDF or YouTube link you submit to generate questions, and the video transcript | You |
We do not ask for or collect your date of birth, ID numbers, payment details, device geolocation or special categories of data (health, religion and similar). Test authors must not collect such data through intake fields.
03Why, and on what legal basis
| Purpose | Basis (Ukrainian Law / GDPR) |
|---|---|
| Providing the service: account, creating and taking tests, grading, rooms, classes, certificates, notifications | Performance of the contract — the Terms of Service (Art. 11(1)(3) of the Law; Art. 6(1)(b) GDPR) |
| Processing participants’ responses for a test author or organisation | The author’s or organisation’s own basis as controller; we act on their instructions |
| Answering messages, handling reports and data requests | Contract; legitimate interest; legal obligation |
| Security: preventing spam and abuse, rate limiting, content moderation | Legitimate interest in a secure service (Art. 11(1)(6) of the Law; Art. 6(1)(f) GDPR) |
| Service e-mails: e-mail confirmation, sign-in, a welcome e-mail after sign-up | Contract |
| Newsletter: news, tips, a feedback survey | Your consent (Art. 11(1)(1) of the Law; Art. 6(1)(a) GDPR) — a separate checkbox or subscription form; withdraw with the link in every e-mail |
| Analytics and error reports (PostHog, Google Analytics) | Your consent through the cookie banner; withdraw at any time — see /cookies/ |
| Generating questions with AI | Contract — only when you start an import yourself |
04Who receives your data
We do not sell personal data or use it for advertising. Data is received only by providers that help us run the service, under data processing agreements:
| Provider | Purpose | Where data is processed |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage, authentication e-mails | EU (Ireland) |
| Netlify Inc. | Website hosting, server functions (contact form, newsletter, push, AI import) | USA, global CDN |
| Amazon Web Services | Application server api.quizyk.com and its CDN (CloudFront) | EU (Ireland); CDN — global |
| Resend Inc. | Sending e-mail: contact form, newsletter | USA |
| Anthropic PBC | Generating questions from material you submit | USA |
| Google LLC / Google Ireland Ltd. | Sign in with Google; Google Analytics — only with consent | EU and USA |
| PostHog Inc. | Product analytics and error reports — only with consent | EU (Frankfurt) |
| Your browser’s push service (Google, Mozilla, Apple) | Delivering push notifications, if you turned them on | Depends on the browser |
Other users see your data as each feature requires: published tests and your public profile (name, username, bio, published tests) are visible to everyone; a test author sees the results and answers of people who took the test; room participants see names and points on the leaderboard; a certificate is visible to anyone with its link; workspace members see each other’s names and e-mails. We may also disclose data where the law requires it.
05International transfers
Some providers process data in the USA. For users in the EU/EEA, such transfers rely on the provider’s certification under the EU–US Data Privacy Framework or, where there is none, on the European Commission’s Standard Contractual Clauses (Art. 45–46 GDPR). For users in Ukraine, transfers rely on the grounds in Art. 29 of the Law of Ukraine "On Personal Data Protection", in particular where the transfer is needed to perform the contract with you, and for analytics on your consent.
06How long we keep data
| Data | Period |
|---|---|
| Account, profile, your tests, classes, workspaces, certificates, notifications | For as long as the account exists. When it is deleted they are removed from the database; residual copies in the provider’s backups are overwritten within its normal backup cycle |
| Your attempts on other people’s tests and participation in their rooms | Stay with the test author after your account is deleted, but no longer linked to it (so that, for example, a class’s results stay complete) |
| Guest attempts and intake answers | For as long as the test exists, or until the author deletes them |
| Contact form messages | Up to 2 years after the matter is closed |
| Newsletter subscription | Until you unsubscribe |
| Analytics | No longer than 14 months |
| Hashed rate-limit keys, hosting logs | Short periods set by the providers |
07Your rights
Under Art. 8 of the Law of Ukraine "On Personal Data Protection" and Art. 15–22 GDPR you have the right to:
- know what data about you we process and receive a copy;
- correct inaccurate data — most profile fields can be edited in Settings;
- have your data and account deleted (the button in Settings sends us the request);
- restrict processing, or object to processing based on legitimate interest;
- receive your data in a machine-readable format (portability);
- withdraw consent at any time, without affecting processing before the withdrawal;
- lodge a complaint with a supervisory authority.
To exercise a right, e-mail support@quizyk.com from the address linked to your account. We reply within 30 calendar days; for complex requests this may be extended by two further months, and we will tell you if it is. It is free of charge.
You can complain to the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua) and, if you are in the EU/EEA, to the data protection authority of your country (list: https://edpb.europa.eu/about-edpb/about-edpb/members_en).
09Children
You can create an account on your own from the age of 16. Younger users may have an account only with the consent of a parent or other legal guardian, or when a school or teacher enrols them and is responsible for the legal basis for processing pupils’ data. Tests can be taken as a guest without an account; we ask only for a name, and a nickname is fine. If you believe a child gave us data without proper consent, contact us and we will delete it.
10Security
Data travels only over encrypted connections (HTTPS). Access to every row is restricted by rules enforced in the database itself, not only in the interface; correct answers are never sent to participants and grading happens on the server; passwords are stored only as hashes and guest session tokens as SHA-256 digests. If a breach puts you at risk, we will notify the supervisory authority within 72 hours and you without undue delay.
11Automated decisions
Test scores are calculated automatically from the answer key the author set, and the author can change a grade by hand. We do not make decisions with legal or similarly significant effects on you solely by automated means. How a test author or organisation uses results is their decision.
12Changes to this Policy
The effective date of the current version is shown at the top of this page. We will announce material changes in advance, in the app or by e-mail, and ask you to confirm the new version the next time you sign in.
This Policy is issued in Ukrainian and English. If the two differ, the Ukrainian version prevails.