QuizOut Privacy Policy.

1. Who is responsible

Quiz Out is the controller for its own website, accounts, billing, security and support information. We are a processor for personal data in customer content submitted for generation, under the data-processing schedule. The WordPress site operator controls its articles, quizzes and reader information, and must provide its own privacy notice and lawful choices. This policy covers our service; it does not replace a site operator’s notice.

Contact support@quizout.io for all privacy enquiries, requests and complaints. Our postal contact is on the business details page. Our account service is for adults, and is not offered directly to children. If you believe a child has supplied personal data to us, contact us.

2. Information and lawful bases

• Accounts and sites: names, email addresses, password hashes, roles, connected site URLs, settings, API-key digests, usage references and terms version and acceptance time. We use these to provide and secure the service and manage access. Our basis is performance of a contract with you, or legitimate interests in providing the service to your organisation when you act for it. We do not collect an additional IP address as evidence of terms acceptance.
• Billing: purchases, subscription state, payment-provider references, invoices, refunds and legally required customer tax information. We process these to perform the contract and meet tax and accounting obligations. Stripe handles card details; we do not receive full card numbers.
• Security and operation: request metadata, IP addresses in infrastructure/access logs, authentication and abuse signals, audit events and limited error diagnostics. Our legitimate interests are protecting accounts, preventing fraud and keeping the service reliable. Application content, credentials and secret URL parameters are filtered from operational reporting.
• Support and enquiries: the contact details, organisation, website and message you supply, plus correspondence needed to resolve requests. We rely on steps requested before a contract, contract performance, or legitimate interests in answering enquiries and managing complaints, as appropriate.
• Optional communications and measurement: we use consent where required for marketing and optional website cookies. Account, security, purchase and privacy messages are service communications. Optional lifecycle email choices can be changed in the console or through the unsubscribe link where provided.
• Referrals: if you choose to save a referral, we connect a referral code to your later signup and record eligible rewards. The optional cookie requires consent. Once an account is attributed, our legitimate interests are operating the requested referral programme and preventing reward abuse. Referrers see totals and their rewards, not your email, website or account identifier.

We obtain information from you, authorised team members, your connected WordPress site, and providers such as Stripe when they confirm billing events. Required account, site and billing information is needed to supply the corresponding service. Optional choices are not a condition of using it. We do not sell personal data or use it for decisions producing legal or similarly significant effects based solely on automated profiling.

3. WordPress data and AI generation

The plugin stores articles, saved quizzes, edits, approvals, plays, answers, scores, results and optional reader leads in your WordPress database. Normal plugin operation does not send those reader records to Quiz Out. Your WordPress host, backups, integrations and local retention are controlled by the site operator. Readers should contact that operator about their information.

For generation, the plugin sends article title and text, generation settings and site/post references to our service. Caption requests send the supplied summary and settings. We check the request, send the content needed for generation to OpenAI and return the result. We store a usage ledger, not a permanent article or quiz library. Successful responses may remain in encrypted operational cache for up to 24 hours for safe retries. Request and response bodies are excluded from application logs.

We call OpenAI with store: false, which disables optional response storage; it is not a zero-retention guarantee. OpenAI may retain API content in abuse-monitoring logs for up to 30 days by default, or longer where legally required. We do not claim that our account has approved Zero Data Retention controls. Optional sharing of API inputs, outputs, feedback and evaluation data with OpenAI for model improvement is disabled for our production organisation. OpenAI states that API data is not used to train its models by default unless the customer opts in. See OpenAI’s API data controls.

Sample sharing is off by default. If an account owner explicitly enables it, we retain encrypted, locally de-identified titles, excerpts of up to 4,000 characters and quiz output, plus model and instruction versions. We remove selected identifiers where possible, but names and identifying facts may remain: these samples are not necessarily anonymous. Only the newest 100 per account are kept, for at most 30 days, and opting out deletes saved samples. Captions are not sampled. This choice is separate from terms acceptance and does not by itself establish a lawful basis for personal data about other people.

4. Cookies and similar storage

Essential session and security cookies keep you signed in and protect forms. They are needed for the account functions you request. A local-storage consent preference remembers your analytics choice for 180 days. These choices do not permit advertising cookies.

We write the optional encrypted, HTTP-only referral cookie only after you explicitly select and save the referral choice. It lasts up to 30 days and is used for first-touch signup attribution, not browsing-history profiling. You can decline it and still sign up, or remove it below. Removing it cannot undo attribution already recorded for a completed signup; contact us about that record.

With your permission, Google Analytics measures public-page visits and plugin download clicks using cookie identifiers, browser/device information, approximate location inferred from your IP address, and filtered page and referral information. It loads only after “Accept analytics”. Your analytics choice does not affect access to this website or your eligibility for plugin downloads. Use “Cookie settings” in the footer to change your choice; withdrawal stops collection and removes Analytics cookies. Collection requires unexpired consent. Analytics cookies last up to 180 days, renewed during consented visits.

Analytics is excluded from business details, sign-in, account, billing, administrative, unsubscribe and API pages. We do not send account identifiers, form contents, quiz answers or secret URL parameters. Only allowlisted campaign labels may remain in tracked URLs. Google Signals, advertising features and automatic enhanced measurement are disabled. Download events count clicks, not completed downloads or installations.

5. Providers, recipients and international transfers

Our primary hosting is Amazon Web Services (AWS), region eu-west-1 in Ireland. This does not mean every provider processes data only in Ireland. Authorised providers receive only information relevant to their role:

• AWS: application hosting, databases, backups, private temporary export storage and Amazon SES service-email delivery. Emails contain the recipient and information needed for the message.
• Hatchbox: server provisioning and deployment management, not a separate store for our customer database. Its operational access supports administration of our AWS servers. It displays application and infrastructure logs held on those servers without retaining a separate copy; log retention is managed on our infrastructure.
• OpenAI: submitted content and settings for generation, as described above.
• Stripe: payment processing, subscription administration, invoices, refunds and fraud prevention. Stripe also acts as an independent controller for certain payment, compliance and fraud purposes. See Stripe’s privacy notice.
• Honeybadger: filtered error and operational reporting. Article text, quiz output, credentials and sensitive form values are excluded.
• Google: optional, consented public-website analytics. See Google’s privacy notice.
• Our accountants: necessary invoices and financial records for bookkeeping, tax and accounting. Invoices are maintained in Stripe. Accounting disclosures are based on our accounting obligations, not analytics consent.

We may share necessary information with professional advisers or authorities to meet legal obligations, establish or defend claims, or prevent fraud. In a business transfer, any necessary disclosure is subject to confidentiality and applicable data-protection requirements, with notice where required.

Provider personnel or systems may process information in the UK, EEA, US and other countries. Where a transfer is restricted under UK data-protection law, we use an applicable adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the required assessment and supplementary measures. You can ask us which mechanism applies to your data and request information about the safeguards. We do not treat an EU hosting location or a provider’s response-storage setting as a substitute for those checks.

6. How long we keep information

• Account, site and usage records: while your account remains open and the records are needed, with a quarterly manual review of continued need. There is no automatic inactivity purge. Records are removed through account deletion, including on request, subject to legal retention and the shared-login exception below.
• Financial records: required invoices, transaction and tax records are retained for at least six years, or longer where a particular tax rule or legal claim requires it. Deleting an account does not erase these statutory records. They are restricted to accounting, compliance and related disputes.
• Temporary generation cache: no more than 24 hours. Optional samples: no more than 30 days, at most 100 per account, with earlier deletion on opt-out.
• Honeybadger: our project retains error records for 15 days after their last occurrence; a recurring error can therefore remain longer than 15 days from its first occurrence. Separate Insights events use the base allowance, for which Honeybadger publishes seven-day retention. These records are separate from our internal generation diagnostics.
• Generation failure diagnostics: selected encrypted, content-free details for 30 days; expired records are hidden and removed by hourly cleanup. They are restricted to operators and deleted with the site/account.
• Account exports: a compressed file in private object storage, available through a single-use download link for up to 24 hours. Consumed or expired files are removed by cleanup. Email contains a link, not the export itself. The service never offers a public archive of exports.
• Background tasks: completed tasks are cleared after one day; failed tasks remain until resolved or removed. They contain record references and the minimum delivery information, not articles or generated quizzes.
• Server logs: configured to rotate daily and retain 14 rotations alongside the active log. Older rotated logs are deleted as the rotation limit is reached. Backups: isolated copies age out within 30 days. If a backup is restored, applicable deletions must be reapplied before normal use.
• Enquiries and correspondence: for as long as needed to answer and resolve the matter. We review routine enquiries 12 months after resolution and delete what is no longer needed, while retaining necessary records for an unresolved complaint, claim or legal obligation. Matching enquiry records are removed by account erasure when the login is also removed.
• Google Analytics: user and event retention is set to two months; that setting does not limit aggregated reports. Provider retention, including OpenAI’s abuse logs and Stripe’s statutory records, follows the provider’s applicable obligations and controls.

Account owners can request export and erasure in console privacy settings or by email. A login shared with another account remains until no longer needed for that account. Deletion does not remove WordPress content or reader data, records another organisation independently controls, or records we must retain by law. We explain any applicable exception when responding. See our data map for the detailed categories and controls.

7. Security and access

We use encrypted transport, encrypted sensitive account and billing-reference fields, encrypted operational cache and samples, digest-only storage for site keys and tokens, role-based access and allowlisted audit records. We restrict operational access and maintain recovery and incident procedures. No internet service can guarantee absolute security. You should protect your credentials, manage team access and keep your WordPress software and backups current.

8. Your rights and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting processing that was lawful before withdrawal. These rights have legal conditions and exceptions.

Contact support@quizout.io. We normally respond within one month, and explain any lawful extension. We may ask for proportionate identity verification. Requests are normally free. If your request concerns a WordPress site’s reader records, contact that site operator; we can help identify the right route where possible.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113, or to your competent local data-protection authority. You can contact the regulator without first complaining to us.

9. Policy changes

We update the effective date when this policy changes. We give notice of material changes by email or a prominent account/site notice as appropriate, and obtain fresh consent where legally required. Changes to contractual processor obligations follow the Terms of Service.