Privacy Policy
Last updated: 24 July 2026
1. Who we are
Quizlo (the “Service”, available at app.quizlo.eu) is operated by David Azarian, K Beranovu 1190/15, Dolní Chabry, 184 00 Praha 8, Czech Republic, Company ID (IČO): 17064619, a sole trader registered in the Czech Trade Licensing Register (živnostenský rejstřík) (“we”, “us”). Contact for privacy matters: info@quizlo.eu, tel. +420 774 147 594.
2. Our two roles: controller and processor
Quizlo is a quiz builder used to collect leads. This creates two distinct situations:
- We are the data controller for the personal data of registered users (quiz creators) and visitors of the Service. Sections 3–13 apply to you.
- We are a data processor for the personal data of people who fill in a quiz (“Respondents”). The quiz creator is the controller of that data. If you took someone's quiz, see Section 6. Our processing on behalf of creators is governed by our Data Processing Agreement.
3. Data we process about account holders
| Category | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account | Email address, optional name, password (stored only as a salted cryptographic hash), interface language | Creating and operating your account, authentication | Art. 6(1)(b) – contract |
| Google sign-in | Google account ID, email, name (only if you choose “Continue with Google”) | Authentication | Art. 6(1)(b) – contract |
| Billing | Plan, trial and subscription status, Stripe customer reference. Card data is processed exclusively by Stripe and never touches our servers. | Paid subscriptions, invoicing | Art. 6(1)(b) – contract; Art. 6(1)(c) – tax law |
| Content | Quizzes and settings you create, incl. descriptions submitted to the AI generator | Providing the Service | Art. 6(1)(b) – contract |
| Security | IP address (processed transiently for rate limiting; counters expire within minutes and are not stored with your account), Cloudflare Turnstile bot checks | Preventing abuse, brute-force and spam | Art. 6(1)(f) – legitimate interest in securing the Service and preventing fraud. You may object to this processing at any time. |
| Communications | Transactional emails (verification, password reset, new-lead notifications) and support correspondence | Operating the Service, support | Art. 6(1)(b) – contract |
| Marketing attribution | Campaign parameters (UTM, ad click ID) from the link that brought you to us, saved with your account at registration | Measuring which of our own campaigns work | Art. 6(1)(f) – legitimate interest in measuring our own marketing. You may object to this processing at any time. |
We do not send marketing emails without your consent and we do not sell personal data. Advertising measurement (Meta Pixel) runs only with your consent — see Cookies below.
4. AI features
When you use “Generate with AI”, the business description you type is processed by a large language model (Meta Llama, run on Cloudflare Workers AI infrastructure) solely to produce your quiz draft. It is not used to train models. Do not include personal data of third parties in AI prompts.
5. Cookies
Strictly necessary cookies run the Service. Analytics and marketing cookies are set only if you allow them in the cookie banner:
| Cookie | Purpose | Duration |
|---|---|---|
| quizlo_session | Keeps you signed in (httpOnly, secure) | 30 days |
| quizlo_locale | Remembers your language | 1 year |
| g_state | Protects Google sign-in against CSRF | 10 minutes |
| Cloudflare Turnstile | Bot protection on forms | per Cloudflare policy |
| Consentio | Stores your cookie-consent choices | 1 year |
| _ga, _ga_* | Google Analytics – anonymous usage statistics (only with your consent) | up to 2 years |
| _fbp, _fbc | Meta (Facebook) Pixel – measurement of our own advertising (only with your consent) | up to 3 months |
| qz_mc | Remembers that you granted marketing consent, across quizlo.eu subdomains | 1 year |
| qz_utm | Remembers campaign parameters from the link you clicked (see “Marketing attribution” above) | 7 days |
Google Analytics runs with advertising features disabled and only after you consent via the banner; measurement data may be processed by Google LLC (USA) under the EU-U.S. Data Privacy Framework.
With your marketing consent we use the Meta Pixel and the Meta Conversions API to measure our own advertising campaigns: Meta receives page-view and registration events, and at registration a hashed (SHA-256) form of your email address is sent server-side so the conversion can be attributed to the ad. Without your consent nothing is sent to Meta.
Cloudflare Turnstile processes technical browser characteristics and interaction signals to distinguish humans from bots. Unlike traditional CAPTCHAs it does not track you across sites for advertising; see Cloudflare's Privacy Policy.
6. If you filled in a quiz (Respondents)
The person or company that published the quiz is the controller of the data you submit; we only process it on their behalf. What is stored: the contact fields the creator configured (e.g. name, email, phone), your answers, campaign (UTM) parameters, a two-letter country code derived from your IP address (the IP address itself is not stored with your submission), and timestamps. Quiz analytics use a random session identifier, not your identity.
To exercise your GDPR rights (access, erasure, etc.) regarding a quiz submission, contact the quiz creator — typically via the privacy notice linked in the quiz. If you cannot reach them, contact us at info@quizlo.eu and we will assist or refer your request to the controller.
7. Recipients and sub-processors
We share personal data only with providers necessary to run the Service:
| Provider | Purpose | Location / safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, email delivery, AI inference, bot protection | USA / global – EU-U.S. Data Privacy Framework, SCCs |
| Stripe, Inc. | Payment processing and invoicing | USA – EU-U.S. Data Privacy Framework, SCCs |
| Google LLC | Sign-in with Google (only if you use it); website analytics (Google Analytics 4, only with your consent) | USA – EU-U.S. Data Privacy Framework, SCCs |
| Meta Platforms Ireland Ltd | Measurement of our own advertising (Meta Pixel & Conversions API, only with your consent) | Ireland / USA – EU-U.S. Data Privacy Framework, SCCs |
Quiz creators may additionally connect their own third-party tools to a quiz – native integrations (e.g. Ecomail, Telegram, Slack, Discord) and custom webhooks. When a creator enables such a connection, new lead data is transmitted to that service on the creator's instruction; the creator is the controller of that transfer and their own agreement with the third-party provider applies. We never connect your leads to any third party ourselves.
We may also disclose data where required by law or to protect our legal rights.
8. International transfers
Data may be processed outside the EEA (notably on Cloudflare's and Stripe's infrastructure in the USA). Such transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, plus technical measures such as encryption in transit and at rest.
9. Retention
- Account data – for as long as your account exists. Deleting your account immediately deactivates all your published and embedded quizzes (iframes and widgets stop working on third-party sites) and permanently removes your quizzes, leads, analytics events, webhooks and integration connections. We also ask Stripe to delete your payment details and customer profile, except data that we or Stripe must retain under tax and accounting law.
- Respondent data (leads) – until the quiz creator deletes the lead, the quiz, or their account.
- Billing documents – up to 10 years, as required by Czech tax and accounting law.
- Security counters (rate limiting) – minutes.
- Database backups – up to 30 days (point-in-time recovery), after which deleted data disappears from backups as well.
10. Security
Measures include: TLS encryption in transit and encryption at rest; passwords stored only as salted PBKDF2 hashes; httpOnly session cookies; session invalidation on password change; strict tenant separation of data; HMAC-signed webhooks; bot protection and rate limiting; and atomic cascade deletion. No internet service can guarantee absolute security, but we treat any breach according to GDPR Articles 33–34.
11. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. You can exercise most of them directly in the app:
- Access / portability – download your account, quizzes and leads as JSON in Settings → Your data (all plans); per-quiz CSV export is also available on paid plans.
- Rectification – edit your profile in Settings.
- Erasure – Settings → Danger zone → Delete account (immediate, permanent, cascades to all your data).
For anything else, email info@quizlo.eu. We respond within one month. You also have the right to lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz – or with the supervisory authority in the EU member state of your habitual residence or place of work.
We do not carry out automated decision-making with legal or similarly significant effects.
12. Children
The Service is intended for business use by persons aged 18+. We do not knowingly collect data of children. Quiz creators are responsible for ensuring their quizzes are appropriate for their audience.
13. Changes
We may update this policy; material changes will be announced in the app or by email. The current version is always available at this address.