Privacy Policy

Kwizza ("we", "us", "our") is committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws. This policy explains what we collect, why, how long we keep it, and your rights.

1. Who We Are & Privacy Officer

Kwizza is operated by Adama Camara and Emi Motai, carrying on business as “Kwizza” in Halifax, Nova Scotia, Canada. Our designated Privacy Officer is responsible for compliance with this policy and applicable laws. To reach them:

2. What We Collect

• Account information: email address and display name when you create an account.
• Quiz & learning data: subjects searched, scores, category breakdowns, time spent, session progress, and full attempt history (questions + answers).
• Preferences: quiz mode, pass mark, and UI preferences stored in your account.
• Technical data: browser type, device type, and IP address via standard server logs, automatically purged after 30 days. We also keep a first-party record of the pages viewed on Kwizza — the page address, the site that referred you, an approximate location (country, region, city) derived from your IP, and a daily rotating visit identifier. The IP address itself is not stored in this record. If you are signed in while browsing, these page views are associated with your account.
• Payment data: billing information is collected and stored exclusively by Stripe. On our side we store only your subscription status, period dates, and the Stripe customer and subscription identifiers needed to link your account to Stripe.
• Cookies: an essential session cookie (managed by Supabase) keeps you signed in. We also set one first-party cookie the first time you visit, recording how you arrived: the page you landed on, the domain of the site that referred you (the domain only — never the full address, so a search you typed is not stored), any campaign tag in the link, and the date. It lasts 90 days. If you accept our cookie banner, and only then, that record is saved once against your account if you create one, so we can tell which pages bring people to Kwizza; if you decline, it is never linked to you and simply expires. Accepting also loads Google Analytics, which sets analytics cookies to measure site usage; declining loads none. We use no advertising cookies and never track you across other websites.
• Waitlist (pre-launch): if you join the waitlist we store your email address, your browser language, where on the site you signed up, and your country (derived from your IP by our hosting provider; the IP itself is not stored with it). This is used for a single launch announcement and is never shared or used for other marketing.

3. Why We Collect It (Purpose & Legal Basis)

• Authentication: to identify you and maintain a secure session.
• Service delivery: to save your progress, generate personalised quizzes, and display your results.
• Billing: to process payments and manage your subscription status.
• Product improvement: aggregate, anonymised usage patterns to improve the platform.
• Email: to send you service email about your account (transactional), optional email about your studying such as reminders and progress nudges (lifecycle), and optional news about Kwizza (marketing). Lifecycle and marketing email are opt-out at any time; see Section 5 and Section 8.

4. Automated Decision-Making

Practice questions are generated automatically by an AI model (currently provided by OpenAI). We send only what is needed to build your exam: the subject or exam you request, the exam objectives and sources involved, and, for Drill sets, the question content you are practising. We do not send your name, email, or account details. The output is educational content and does not produce legal or similarly significant effects about you. You may review and dispute any AI-generated content by contacting us.

5. Third-Party Service Providers

We share data with the following processors under appropriate data protection agreements:

6. Data Retention

• Account & learning data: retained for as long as your account is active.
• Server logs / technical data: automatically purged after 30 days.
• Deleted accounts: all personal data is erased immediately upon account deletion (see Section 8), with one deliberate exception described in the next item. Sharing was withdrawn on August 5, 2026 and no new quizzes can be published; quizzes you shared before that date may remain available, permanently de-linked from your identity.
• Email suppression list: if your address hard-bounces, you report an email as spam, or you unsubscribe, we store that address on a suppression list and keep it there indefinitely, including after you delete your account. This is the only record we keep after deletion. We keep it precisely so that we can never email you again: deleting the entry would let a future signup or import quietly start mailing you, and would put the account mail everyone else depends on at risk. The entry holds the address and the reason only, and is never used to contact you, to profile you, or for marketing. You can ask us to remove it, which re-enables email to that address.
• Billing records: Stripe retains transaction records for 7 years as required by tax law; we retain only subscription status.
• Waitlist emails: kept until shortly after the launch announcement is sent, then deleted; removed earlier on request.

7. Security Safeguards

• All connections are encrypted via HTTPS/TLS.
• Database access is protected by row-level security (RLS): users can only access their own data.
• Authentication tokens are short-lived and rotated automatically by Supabase.
• Payment data is never stored on our servers. It is handled entirely by Stripe (PCI DSS compliant).

8. Your Rights

Under PIPEDA, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: update inaccurate data via your Settings page at any time.
• Deletion (right to be forgotten): delete your account from your Profile page. Deleting it yourself takes effect immediately and is permanent; if you email the request to us instead, we action it within 30 days. Erasure covers all personal data we hold, except an address already on the email suppression list, which stays there so that we can never mail you again (Section 6).
• Portability: export your quiz progress as a JSON file from Settings → Data Management.
• Withdraw consent: you may turn off lifecycle and marketing email at any time from the unsubscribe link in any such email, without signing in, and you may withdraw consent for all other processing at any time by deleting your account.
• Lodge a complaint: if you believe your privacy rights have been violated, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

9. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will:

• Notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible.
• Notify affected individuals directly as soon as feasible.
• Maintain a record of all breaches for a minimum of 24 months.

10. Cookies & Consent

We use one essential cookie (a session token, set when you sign in) to keep you signed in, plus a small browser preference that remembers your cookie choice. Analytics cookies (Google Analytics) are set only if you accept the cookie banner; if you decline, no analytics cookies are set and signing in still works normally. We use no advertising cookies. Separately from cookies, Kwizza keeps some data in your browser's local storage - in-progress quiz answers so a run survives a reload, interface preferences, and a counter for the free practice exam. This data stays on your device, is not transmitted to us, and is cleared when you clear your browser data.

11. Children's Privacy

Kwizza is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us personal information, contact us immediately and we will delete it without delay.

12. Changes to This Policy

We may update this policy. Material changes will be communicated to registered users via email at least 30 days before taking effect. The "Last updated" date above will always reflect the current version. Continued use after changes takes effect constitutes acceptance.

13. Contact & Complaints

Questions, concerns, or requests about this policy should be directed to our Privacy Officer: