1. Data controller

Marcos Suarez Romero, sole trader (SIRET 897 513 065 00010), 2 Rue Pierre Curie, 94270 Le Kremlin-Bicêtre, France — marcossuarezr88@gmail.com — is the controller of personal data collected on Quizmify under the General Data Protection Regulation (GDPR).

2. Data collected

Account data via Google OAuth: name, email address, profile picture

Account data via email sign-up: name, email address, password — the password is never stored in plain text, only as a bcrypt hash that Quizmify itself cannot reverse

Usage data: quiz topics, answers, scores, experience points (XP), level, game history

Payment data: Stripe customer ID and checkout session ID — Quizmify never stores your card details, which are processed directly by Stripe

3. Purposes and legal bases

Providing the service (authentication, quiz generation, progress tracking) — performance of a contract (GDPR art. 6.1.b)

Processing payment for the Pro plan — performance of a contract (GDPR art. 6.1.b)

Security and abuse prevention — legitimate interest (GDPR art. 6.1.f)

4. Data recipients

Your data may be shared with the following processors, strictly as needed to run the service: Google (OAuth authentication), OpenAI (quiz question generation from submitted topics), Stripe (payment processing), Supabase (database hosting), Vercel (application hosting).

These providers are located outside the European Union (United States). Data transfers are governed by Standard Contractual Clauses or an equivalent certification mechanism (Data Privacy Framework).

5. Cookies

The Site only uses session cookies strictly necessary for authentication (managed by NextAuth). No advertising cookies or third-party trackers are used.

6. Retention period

Your data is kept as long as your account is active. You can request its deletion at any time from the My Account page or by writing to marcossuarezr88@gmail.com.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, port, and object to the processing of your data. You can exercise these rights by writing to marcossuarezr88@gmail.com. You also have the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr.

8. Minors

The Site is not intended for individuals under 15 years old without the authorization of a parent or legal guardian.