GDPR

1. Data controller

Quidition.com is the data controller for personal information you provide when using the site. For any GDPR request, contact us through the in-app Feedback page and mark your message "GDPR request".

2. Personal data we hold

The categories of personal data stored in our database are:

• Identity & contact: email address, display name, avatar, sign-in provider identifiers.
• Account status: role assignments, subscription tier, membership number, tokens and credits.
• Quiz activity: guest names, submitted answers, response times, scores, top-score history.
• Content you create: custom and quick quiz definitions, questions, answers, AI-generation prompts.
• Chat: short in-quiz messages (deleted automatically at quiz start or end).
• Billing: Stripe customer/subscription IDs, plan and renewal metadata (card details are held only by Stripe).
• Communications: transactional email logs, delivery status, unsubscribe tokens and suppression records.
• Feedback you submit.

3. Lawful bases

• Contract: to provide the quiz service, run games and process subscriptions you buy.
• Legitimate interests: to secure the service, prevent abuse, and improve features.
• Legal obligation: to keep payment and tax records.
• Consent: for optional marketing communications where offered.

4. Your rights under GDPR

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your account and associated personal data ("right to be forgotten").
• Restriction — ask us to pause processing of your data.
• Portability — receive your data in a portable machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Complain — lodge a complaint with your local data-protection supervisory authority.

5. Account deletion

You can request deletion of your account at any time from the Account page or by contacting us via Feedback. When we delete an account we remove your profile, membership record, quizzes you created, answers, chat, tokens and subscription linkage. Anonymised aggregate data (for example, question popularity) and records we are legally required to keep (such as payment receipts) may be retained.

6. International transfers & processors

Data is processed by our hosting, database and email providers, and by Stripe for payments. Where any processor is located outside the UK/EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

7. Security

Access to personal data is restricted with row-level security in our database, encrypted transport (HTTPS), and least-privilege service credentials. Payment card data never touches our servers.

8. How to make a request

Submit any GDPR request via the Feedback page from the account whose data is concerned, so we can verify your identity. We aim to respond within one month.