Privacy Policy

Kwizza ("we", "us", "our") is committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), and other applicable privacy laws. This policy explains what we collect, why, how long we keep it, and your rights.

1. Who We Are & Privacy Officer

Kwizza is operated as an independent web application. Our designated Privacy Officer is responsible for compliance with this policy and applicable laws. To reach them:

2. What We Collect

• Account information: email address and display name when you create an account.
• Quiz & learning data: subjects searched, scores, category breakdowns, time spent, session progress, and full attempt history (questions + answers).
• Preferences: quiz mode, pass mark, and UI preferences stored in your account.
• Technical data: browser type, device type, and IP address via standard server logs. These are not linked to your account and are automatically purged after 30 days.
• Payment data: billing information is collected and stored exclusively by Stripe. We store only your subscription status and period dates.
• Cookies: one essential session cookie managed by Supabase to keep you signed in. No advertising or analytics cookies are used.

3. Why We Collect It (Purpose & Legal Basis)

• Authentication: to identify you and maintain a secure session.
• Service delivery: to save your progress, generate personalised quizzes, and display your results.
• Billing: to process payments and manage your subscription status.
• Product improvement: aggregate, anonymised usage patterns to improve the platform.

4. Automated Decision-Making

Quiz questions are generated automatically by an AI model (OpenAI). The AI uses only the subject name you enter — no personal data is included in these requests. The output is educational content and does not produce legal or similarly significant effects about you. You may review and dispute any AI-generated content by contacting us.

5. Third-Party Service Providers

We share data with the following processors under appropriate data protection agreements:

6. Data Retention

• Account & learning data: retained for as long as your account is active.
• Server logs / technical data: automatically purged after 30 days.
• Deleted accounts: all personal data is permanently erased immediately upon account deletion (see Section 8).
• Billing records: Stripe retains transaction records for 7 years as required by tax law; we retain only subscription status.

7. Security Safeguards

• All connections are encrypted via HTTPS/TLS.
• Database access is protected by row-level security (RLS) — users can only access their own data.
• Authentication tokens are short-lived and rotated automatically by Supabase.
• Payment data is never stored on our servers — handled entirely by Stripe (PCI DSS compliant).

8. Your Rights

Under PIPEDA and Quebec Law 25, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: update inaccurate data via your Settings page at any time.
• Deletion (right to be forgotten): delete your account from your Profile page. Deletion is immediate and permanent — all personal data is erased from our systems at the time of request.
• Portability: export your quiz progress as a JSON file from Settings → Data Management.
• Withdraw consent: you may withdraw consent for data processing at any time by deleting your account.
• Lodge a complaint: if you believe your privacy rights have been violated, you may contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or the Commission d'accès à l'information (CAI) if you are in Quebec at cai.quebec.ca.

9. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will:

• Notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible.
• Notify affected individuals directly as soon as feasible.
• In Quebec, notify the Commission d'accès à l'information (CAI) within 72 hours.
• Maintain a record of all breaches for a minimum of 24 months.

10. Cookies & Consent

We use only one essential cookie (a session token) necessary to keep you signed in. This cookie is set only when you sign in. No tracking, advertising, or analytics cookies are used. You may decline cookies but will not be able to stay signed in.

11. Children's Privacy

Kwizza is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us personal information, contact us immediately and we will delete it without delay.

12. Changes to This Policy

We may update this policy. Material changes will be communicated to registered users via email at least 30 days before taking effect. The "Last updated" date above will always reflect the current version. Continued use after changes takes effect constitutes acceptance.

13. Contact & Complaints

Questions, concerns, or requests about this policy should be directed to our Privacy Officer: