DRAFT. This notice is not yet in force. Before it is published we still need to add our postal address and ICO registration number (section 1) and decide on an EU representative (section 1). Remove this banner and the noindex tag once that is done. Send comments to hello@cslabs.uk.
Privacy Notice
1. Who we are
Qwizit is run by Chris Streames, a sole trader trading as CS Labs ("we", "us"), based in Liverpool, England.
- Email: hello@cslabs.uk (for any privacy question or request).
- Postal address: to be added before this notice is published.
- ICO registration number: to be added before this notice is published.
- EU representative: to be confirmed before this notice is published.
We are a small business and have not appointed a data protection officer; Chris Streames is responsible for data protection.
Our role
- We are the controller for account holders' details, billing records, security records and the player device token described below.
- The venue is the controller for the quiz data it chooses to collect and publish (teams, answers, scores, league tables, uploaded images and its staff hosts), and we process that data for the venue under our Terms of Service. If you played a quiz and want to use your rights over that data, you can ask the venue or us; we will help either way.
2. What we collect
Account holders and staff hosts
- Name, email address and the venue name given at sign-up.
- Password, stored only as a salted scrypt hash. We never store the password itself.
- Account type, whether the account is enabled, and when it was created and last changed.
- Billing record: plan status, trial end date, whether the founding offer applies, and the customer and subscription references Stripe gives us. We never see or store card numbers.
Venue and quiz data
- Venue details: name, web address, short description, usual day and time, whether the public page is on, league scoring and jackpot settings. The jackpot is a record only; Qwizit handles no money.
- Teams: team names and colours, and which account members can access each venue.
- Quizzes: dates, times, titles, questions used and round styles.
- Results: each team's answers, whether they were right, points, scores, places and answer times.
- League history, seasons and the jackpot record.
- Images uploaded for quizzes, with the uploading account, file size and upload time.
Players
- There are no player accounts. A player joins with a code or QR code and picks or types a team name. One phone answers for each team.
- We collect the team name, the team's answers and scores, and a hash of a random device token (see section 7) that keeps the team on that phone.
- We do not ask players for a name, email address, phone number or age. Please do not put anyone's full name or other personal details in a team name.
Daily Quiz players (DRAFT)
DRAFT. The free Daily Quiz is public and separate from a venue's quiz. If you choose to join its leaderboards, we store the nickname and lower-case email address you give us, your answers and scores, the quiz-days you played, and, only if you tick the separate box, your consent to Qwizit news and new quiz features together with the exact wording and time you agreed. Playing works without ticking that box. To delete your Daily Quiz details, email hello@cslabs.uk.
Public venue pages
If a venue switches on its public page, anyone can see the venue name, its description, its next quiz dates and its league table, including team names and points. The venue decides whether to switch it on.
Security and technical data
- Sign-in sessions: a random token in a cookie in your browser; our server keeps only a hash of it, with your account and an expiry time.
- Password resets: when you ask for a reset, we email you a link. We keep only a hash of the link's token, for one hour or until it is used.
- Audit log: a record of administrative changes to accounts (who did what, and when). It never contains passwords.
- IP addresses: used in memory to limit failed sign-ins, password resets, wrong join codes and live connections from one network. These records are never written to our database and are cleared within about 15 minutes (10 minutes for join codes, or when a live connection ends).
- Like most websites, our web server may keep short-lived request logs (IP address, time, page requested and browser type) for security and fault-finding.
3. Why we use it and our lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and running your account, and providing the service you signed up for | Account and venue data | Contract with you |
| Running quizzes, results, leagues and public pages for a venue | Quiz, team and player data | For us: the venue's instructions as processor. For the venue: usually its legitimate interest in running its quiz |
| Keeping a team on one phone | Device token hash | Legitimate interests (a fair, working quiz) |
| Billing, trials and the founding offer | Billing record, name, email | Contract with you |
| Service emails, such as password reset links | Email address | Contract with you |
| Security, preventing abuse and fixing faults | Sessions, IP addresses, logs, audit log | Legitimate interests in protecting the service and its users |
| Tax and accounting records | Billing records and invoices | Legal obligation |
| Handling disputes and legal claims | Relevant records | Legitimate interests |
We do not send marketing emails, we do not sell personal data, we do not use it for advertising, and we do not make decisions about anyone by automated means that have legal or similar effects. If we ever want to send marketing, we will ask first where the law requires it.
4. Who we share it with
We use these providers. Each acts on our instructions under a contract that protects the data, except where stated.
| Provider | What it does | Where |
|---|---|---|
| Fasthosts Internet Ltd | Hosts our server, database and files. | United Kingdom |
| Stripe | Takes subscription payments. We share the account holder's name, email and account reference. Stripe is also a separate controller for its own fraud-prevention and legal duties, and its privacy notice applies to the card details you give it. | UK, EEA and United States |
| Resend (Plus Five Five, Inc.) | Sends service emails such as password reset links. It receives the email address and the message, and keeps its email logs for 30 days. | United States |
We may also share data if the law requires it, to protect our rights or users' safety, or with someone who takes over Qwizit (we would tell you first). Venue data is shown to that venue's own account members, and on its public page if the venue switches it on.
5. International transfers
Our server and database are in the United Kingdom. Stripe and Resend may process data in the United States. Both are certified under the EU-US Data Privacy Framework and its UK Extension, and their data processing terms also include the European Commission's standard contractual clauses with the UK Addendum. For people in the EEA, the European Commission recognises the UK as giving adequate protection, so data can flow from the EEA to our UK server.
6. How long we keep it
- Account details: while the account is open. When an account is closed we delete the account record, its venue memberships and its sign-in sessions.
- Venue and quiz data: while the venue uses Qwizit, so it can keep its history and leagues. A venue with no remaining owner is archived and its history kept until the venue asks us to delete it, or until we find during our yearly review that it has not been used for two years, when we delete it.
- Teams and quizzes: a host can reset a quiz run or remove a team from it, which deletes that team's entry and answers for that run. Closing a venue or removing a team from a venue's list archives it rather than deleting its history.
- Billing records: six years after the end of the tax year they relate to, for tax law. Stripe keeps its own records under its notice.
- Audit log: up to six years, as a business record.
- Sign-in sessions: about 12 hours, or until you sign out or change your password. Password reset tokens: one hour.
- IP-based limits: in memory only, cleared within about 15 minutes.
- Backups: encrypted backups and short-term snapshots taken before updates may hold copies of deleted data until they are overwritten on their normal cycle.
Qwizit does not yet delete old data automatically, so we check stored data at least once a year and delete what we no longer need under the periods above.
7. Cookies and storage on your device
We use only storage that the service needs to work, or that remembers a choice you make in the app. There is no analytics, advertising or third-party tracking on Qwizit, and our pages load nothing from other websites. Because of this we do not need a consent banner. If we ever add anything non-essential, we will ask for your consent first and update this notice.
| Name | Type and who it affects | Why, and how long |
|---|---|---|
Session cookie (__Host-qwizit, or qwizit_sid on non-HTTPS test servers) | Cookie, set only when an account holder signs in. HttpOnly, SameSite=Strict and Secure. | Strictly necessary: keeps you signed in. Expires after about 12 hours or when you sign out. |
Player device token (quizToken) and join code (qKey) | Browser local storage on a player's phone. Not a cookie. | Strictly necessary: keeps your team on your phone and returns you to the quiz you joined. Only a hash of the token reaches our server. The join code is cleared when the quiz closes; the token stays until you clear your browser data. |
Player settings (qSound, qTheme) | Local storage on a player's phone. | Remembers sound on or off and light or dark theme. Stays on the phone and is never sent to us. |
Host and admin settings (qw.venue, qw.all, qw.setup.skip.*, hostIP, muted, music) | Local storage on the account holder's device. | Remembers the venue you were working on, setup prompts you skipped, the network address shown for joining, and sound and music settings. Stays on the device and is never sent to us. |
| Stripe | Cookies set by Stripe on its own payment pages, not on Qwizit. | Needed to take payment and prevent fraud. Stripe's cookie notice applies. |
8. Children
Account holders and staff hosts must be 18 or over. Quizzes are often open to all ages, so players can be any age. That is why Qwizit asks players for nothing more than a team name and keeps no player accounts, contact details or ages. Venues should not ask players for more, and team names should not include children's names. If you think a child's personal data has been entered, email us and we will remove it.
9. Your rights
You have the right to:
- ask for a copy of your personal data (access);
- ask us to correct data that is wrong (rectification);
- ask us to delete data (erasure);
- ask us to restrict how we use data, or object to uses based on our legitimate interests (restriction and objection);
- ask for data you gave us in a common, machine-readable format, or for it to be sent to someone else (portability);
- withdraw consent at any time where we rely on it.
Email hello@cslabs.uk to use any of these. There is no charge. We will reply within one month, or tell you within that month if we need up to two more months for a complex request. We may need to check who you are first. Players have no account, so to find a player's data we will usually need the venue, the quiz date and the team name. Some rights are limited, for example where we must keep records by law, or where the data belongs to a venue (we will pass the request on and help).
10. How to complain
Please tell us first at hello@cslabs.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live or work in the EEA, you can also complain to the data protection authority in your country.
11. Keeping data safe
Passwords and tokens are stored only as hashes. Data files on the server can be read only by the service. Access to venue data is limited to that venue's members. The service runs over HTTPS with a strict security policy, failed sign-ins and join codes are rate-limited, and backups are encrypted. Changing your password signs out your other sessions. If a personal data breach puts people at risk, we will tell the ICO within 72 hours and tell affected venues and people without undue delay.
12. Changes to this notice
We may update this notice. The version date at the top will change, and we will email account holders before any significant change takes effect.