Privacy Policy

1. Who we are

Quizotic (quizotic.live) is a live quiz and interactive presentation platform. This policy explains what personal data we collect, why, who processes it for us, how long we keep it, and the rights you have over it, including under India’s Digital Personal Data Protection Act, 2023.

Two roles. For host accounts, and for how we run and improve Quizotic, we decide how personal data is used: we are the data fiduciary. When a teacher, trainer, school, college or company runs a session, the data their participants enter belongs to that session, and the host or their institution decides how it is used; we process it on their behalf.

Questions, requests and complaints go to our Grievance Officer (section 12).

2. What we collect

Hosts (people with a Quizotic account):

• Name, email address and profile picture, from the sign-in you choose: an emailed sign-in code, Google, or Microsoft. We never see or store a password.
• For Microsoft and Google Workspace sign-ins, the organisation (tenant or domain) your account belongs to, so an institution’s plan can recognise its own staff and students.
• The role and organisation you tell us about, your country (from our network provider, recorded when you first sign in), language and time zone.
• What you create and upload: quizzes, presentations, images and documents.
• Your confirmation that you are 18 or older, and your email and notification preferences.
• If you create an API key, a one-way fingerprint of it, never the key itself.
• The feedback you give at the end of a session you host, linked to your account.

Participants (people who join a session): no account is needed.

• A display name, and the answers, free-text responses, drawings, questions and reactions you send during the session.
• Only if the host asks for them: your real name and, optionally, your email address.
• Only in rooms the host restricts to their institution: the name and email from your institution’s sign-in.
• Session feedback, if you choose to give it.

We do not store participants’ IP addresses in our database. Our hosting and security providers process IP addresses to deliver and protect the service.

3. Why we use it

• To run the service: sign you in, save your work, run live sessions, and produce reports for the host who ran them.
• To send the emails the service needs: sign-in codes, invitations, security and account notices.
• To send product and launch updates, only if you asked for them; you can withdraw from the Plan page or any email’s unsubscribe link.
• To ask you by email about feedback you gave on a session you hosted, and learn what to improve. Every such email has an unsubscribe link.
• To keep Quizotic secure: rate limits, abuse prevention and fault investigation.
• To understand and improve the product through analytics (section 6).
• To manage subscriptions and billing, once paid plans go on sale.

We do not sell personal data, show advertising, or build advertising profiles.

4. Children and students

Hosts must be 18 or older. We ask every new account to confirm this, and do not knowingly let anyone younger create one. If you believe a child has created an account, write to us and we will delete it.

Participants can be any age. Students often join sessions run by their school or teacher. In that case the school or teacher decides what is collected, such as whether real names are asked for, and is responsible for any consent their students or parents need to give.

For participant pages we keep collection to the minimum the session needs: no advertising, no profiling, no session recordings, and no analytics cookies. We record only anonymous page events for that single visit, to find errors and slow pages.

5. Who processes data for us

These providers process personal data on our behalf, under their own security and confidentiality commitments, and only for the purpose shown:

AI features receive only what you give them: your prompt, and the text or pages of a file you upload. They never receive participant names or answers. We send these requests only to AI providers that do not use them for training.

Because these providers work across borders, your data may be processed outside India, including in Singapore, the European Union, Japan and the United States. Institutions that need a written data processing agreement can request one from the Grievance Officer.

6. Analytics and cookies

• If you are in the European Economic Area, the UK or Switzerland (or we cannot tell where you are), the analytics that run in your browser, PostHog and Google Analytics, stay off until you press “Accept all” or switch them on under Cookie settings. “Reject all” keeps them off, and on participant pages visitors from those places send no analytics at all. Everywhere else they run by default, and you can switch them off the same way.
• Your choice is remembered for 6 months in one cookie, qz_consent. You can change it at any time from Cookie settings: in the footer of our home page, in the account menu of the dashboard, or on the cookie policy page, which lists every cookie and storage key we use, with its purpose and lifetime.
• Essential cookies keep you signed in, protect forms from forgery, and briefly hold one-time link tokens so they never appear in the address bar. Quizotic does not work without them.
• Product analytics (PostHog, EU) on our website and host pages records page views and product events. A signed-in host is linked to an internal account number only, never a name or email. Host pages may be session-recorded to find problems; text on live-session and report screens is masked, so participant names and answers are not recorded.
• Events our servers record when you use a feature, such as how long an AI quiz took to generate and what it cost, are linked to your internal account number only. They do not depend on the cookie choice.
• Participant pages (joining and playing a session) record anonymous page events for the single visit only: no cookies, no stored identifier, and no recordings.
• Google Analytics measures visits to our public website and host pages. It is not loaded on participant pages.
• Embedded videos that a host adds to a presentation load from YouTube’s privacy-enhanced mode or Vimeo, under their policies.

7. How long we keep data

• Your account and content stay while your account exists.
• Session reports, including participants’ names and answers, stay in the host’s account until the host deletes the session or their account.
• Live-session working copies expire within 6 hours of a session ending.
• Sign-in codes expire after 15 minutes and are then deleted.
• Follow-up practice links stop working after 30 days. They hold the quiz questions only, never participants’ names or answers.
• Email delivery records are deleted after 13 months. If you unsubscribe, we keep your address on a do-not-email list so the choice is respected.
• Backups roll over and expire within 30 days.

8. Your rights

• Access and a copy: download your data from Settings, or ask us for a summary of what we hold and who processes it.
• Correction: edit your profile in Settings, or ask us to correct anything else.
• Erasure: delete your account from Settings. After a 7-day grace period we delete your account, content, session reports and uploads, and ask our analytics provider to delete your analytics profile.
• Withdraw consent: for optional emails and notifications, at any time, as easily as you gave it.
• Nominate: name someone to exercise these rights for you if you die or become unable to; write to the Grievance Officer.
• Complain: to our Grievance Officer first (section 12). If you are not satisfied, you may approach the Data Protection Board of India.

Participants: for data from a session, contact the host or institution that ran it, or write to us and we will help.

9. Security

All traffic is encrypted in transit, and our database and file storage are encrypted at rest. Access is limited to the people who run the service. We rate-limit sign-in and joining, and review our security regularly. If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay, as the law requires. We do not store payment card details. Paid plans are not on sale yet, so no payment is processed today; when Pro goes on sale, payment processing will be handled by Razorpay, which is PCI-DSS compliant.

10. Google user data

Signing in with Google: Google shares your name, email address and profile picture with Quizotic. We use them only to create and identify your account.

Exporting to Google Sheets: when you choose Google Sheets on a session report, Google asks whether Quizotic may see, edit, create and delete only the specific Google Drive files you use with this app (the drive.file permission). Quizotic uses that permission once, to create the spreadsheet you asked for in your own Google Drive, and then discards it: the access token is never stored, Quizotic cannot open any other file in your Drive, and it does not read the spreadsheet back afterwards.

We do not sell Google user data, use it for advertising, or share it with third parties. You can remove Quizotic’s access at any time from your Google Account, under Security → Third-party apps with account access. Spreadsheets you exported stay in your Drive until you delete them.

Quizotic’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Quizotic for PowerPoint (Office Add-in)

Quizotic is also available as a Microsoft Office Add-in that runs inside a PowerPoint slide. Everything in this policy applies to the add-in; this section covers what is specific to it.

What the add-in reads: it reads which view PowerPoint is in — editing or presenting — so it can show the setup panel while you build the deck and the live question while you present. It does not read the text, images, notes or any other content of your slides, and it does not upload your presentation file anywhere.

What the add-in writes into your file: when you connect a deck to a quiz, three values are saved inside the .pptx itself — the quiz identifier, the session join code, and a map of which slide carries which question. These are stored in Office document settings, which means they travel with the file if you share or email the deck. Only these already-public identifiers are ever written there; your Quizotic API key and sign-in credentials are deliberately blocked from being saved into the file.

Microsoft services: the add-in loads the Office JavaScript library from Microsoft’s content delivery network, so Microsoft may receive a request for that file. We do not share your account data, quizzes, or participant responses with Microsoft.

12. Grievance Officer and contact

Mahesh Dhiman, Founder, Quizotic — info@quizotic.live

We acknowledge privacy requests and complaints within 7 days and resolve them within 30 days. We may ask you to confirm your identity first.

13. Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your data, we tell signed-in hosts before it takes effect.