Privacy Policy

Quizat (quizat.io) is responsible for processing your personal data. We are an educational platform based in Kuwait that uses artificial intelligence to help university students study more effectively.

To contact us about privacy: support@quizat.io

We collect the following categories of data:

a. Account data (provided directly by you)

• Full name and email address — required for registration.
• Password — stored encrypted (via Supabase Auth); we never have access to it in plain form.
• Optional information such as university, major, and academic year, if you provide it.

b. Uploaded files (temporary)

• PDF and PowerPoint files you upload to generate quizzes or flashcards.
• Stored temporarily in Supabase Storage and deleted immediately once processing completes or fails — we do not retain them.

c. Generated content and study activity

• Generated quizzes and flashcards and their questions (if you choose to save them in a course).
• Quiz results, attempt history, and performance scores.
• Courses you create and their organizational data.
• Quizzes you share via a public link and the record of that sharing.

d. Usage data (collected automatically)

• Your monthly generation counter, quota usage, and plan type.
• Language model usage statistics (number of tokens consumed — for operational purposes).
• Timestamps of logins and key activities.

e. Billing data

• The plan you are subscribed to, and your subscription date and status.
• Your Stripe Customer ID.
• Your credit card details: we never store these in any form — they are processed and stored by Stripe exclusively.

f. Technical data (collected automatically for security and operational purposes)

• IP address — to apply rate limiting and prevent abuse, not to identify you personally.
• Error and crash logs via Sentry, which may include a user identifier and technical context details about the error.
• Performance data and traces via Sentry to improve platform speed.
• Server logs via Vercel (HTTP requests, status codes) per Vercel's data retention policy.

g. Temporary browser storage (not accessible to the server)

• The current quiz or flashcard data (sessionStorage) — deleted automatically when the tab is closed.
• Your preference for dismissing the quota alert (sessionStorage).

We use your data only for the following purposes:

• Providing the service: processing your files, generating quizzes and flashcards, saving your results.
• Account management: identity verification, subscription management, service-related communication.
• Billing: processing payments, renewing subscriptions, and managing plans.
• Security and fraud prevention: applying rate limits, monitoring suspicious activity, protecting the platform.
• Improving the service: anonymized statistical analysis to understand usage patterns and improve performance.
• Legal compliance: retaining billing records as required by law.

What we never do: we do not sell your data, share it for advertising purposes, use it to show targeted ads, or build commercial profiles about you.

We process your data based on the following legal grounds:

• Contract performance: processing the data necessary to provide the service you subscribed to (content generation, saving results, subscription management).
• Legitimate interests: security, fraud prevention, and service improvement — in a manner that does not conflict with your fundamental rights.
• Legal obligation: retaining billing records in accordance with applicable financial and tax laws.
• Consent: for any processing not covered by the grounds above, we will request your explicit consent.

We share your data only with service providers necessary to operate the platform, each of which is bound by a data processing agreement and strict security standards. Here is the complete list:

• Supabase — PostgreSQL databases, authentication system, and temporary file storage. (United States · SOC 2 Type II certified)

  Processes: account data, generated content, results, temporary files, and subscription data.

• Anthropic (Claude AI) — The AI model used to generate quizzes and flashcards. (United States)

  Processes: the content of uploaded files during generation. Per Anthropic's stated policy, API data is not used to train models by default.

• Stripe — Payment processing and subscription management. (United States · PCI DSS Level 1 certified)

  Processes: your email address, your credit card details (which we never see), and your financial transaction history.

• Sentry — Software error monitoring and platform performance measurement. (United States · SOC 2 certified)

  Processes: error logs that may include a user identifier and technical context details (device type, browser, error path). Does not receive uploaded file data or generated content.

• Vercel — Application hosting and infrastructure. (United States · SOC 2 certified)

  Processes: request logs (IP addresses, URL paths, response codes) per Vercel's data retention policy.

We will not share your data with any other party except in one case: if required to do so by court order or applicable law, and we will make every effort to notify you before complying unless prohibited by law.

Given the sensitivity of this aspect, we explain exactly how it works:

• When you upload a file, it is stored temporarily in Supabase Storage in your own folder, protected by Row Level Security policies.
• The file's content is sent encrypted to Anthropic via a secure API for content generation.
• Once processing completes or fails, the file is deleted from Supabase Storage immediately and automatically.
• The Quizat team does not retain copies of your files after processing is complete.
• Per Anthropic's policy: data sent via the API is not used to train its language models.

Notice: if your files contain personal or sensitive information (student data, confidential exams, institutional documents), you alone are responsible for verifying that it is appropriate to upload and share it with a third party (Anthropic).

Quizat is a Kuwaiti company, but all of our main service providers (Supabase, Anthropic, Stripe, Sentry, Vercel) are based in the United States. By using the platform, you agree that your data may be transferred to and processed outside Kuwait and outside your geographic region.

We take care to choose providers committed to and certified under the highest internationally applicable data protection standards (SOC 2, PCI DSS). If you are in a region subject to special data transfer regulations (such as the EU), we are happy to provide additional details upon request.

We use only the following mechanisms:

• Session cookies: used by Supabase Auth to maintain your login state. Necessary for the platform to function and cannot be disabled.
• sessionStorage: used to temporarily store your current quiz or flashcard data in your browser, and automatically deleted when the tab or browser is closed.

We do not use advertising tracking cookies, third-party analytics tools that track your behavior across multiple sites, or any form of marketing tracking.

We retain each category of your data for the following period:

• Uploaded files: deleted immediately and automatically once the generation process completes or fails.
• Account data and study content: for as long as your account is active. When you delete your account, your personal data is deleted within 30 days.
• Billing records and Stripe transactions: 7 years from the transaction date, per legal and accounting requirements.
• Error logs (Sentry): per Sentry's default retention policy (typically 90 days).
• Server logs (Vercel): per Vercel's data retention policy.
• Rate limiting data: deleted automatically once the time window expires (typically minutes to hours).

We apply the following technical and organizational measures to protect your data:

• Transport encryption: all connections are protected with HTTPS/TLS.
• Password encryption: stored using strong hashing algorithms via Supabase Auth (bcrypt).
• Data isolation: Row Level Security policies in the database ensure each user can only access their own data.
• Rate limiting: all API endpoints are protected by rate limits to prevent abuse.
• Restricted access: access to sensitive data is restricted to necessary server-side operations (admin client) and never exposed to the frontend.
• Error monitoring: real-time monitoring of technical and security incidents via Sentry.

Despite these measures, no digital system is 100% secure. In the event of a security breach affecting your data, we will notify you as soon as possible in accordance with applicable legal requirements.

You have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete data directly from your profile page or by contacting us.
• Deletion: request deletion of your account and all your personal data (bearing in mind that billing records are retained as required by law).
• Portability: obtain your personal data in an electronic, machine-readable format.
• Objection: object to the processing of your data in certain cases, particularly regarding processing based on legitimate interests.
• Restriction of processing: request a temporary restriction on the processing of your data under specific circumstances.

To exercise any of these rights, contact us at support@quizat.io . We will respond to your request within 30 days of receipt. We may ask you to verify your identity before processing your request.

Quizat is intended exclusively for university students aged 18 and over. We do not knowingly collect data from anyone under this age. If we discover that a registered account belongs to a minor, we will terminate the account and delete its data immediately.

If you are a parent or guardian and believe a minor has registered on the platform, contact us immediately at support@quizat.io.

We may update this policy periodically to keep up with changes in our services or legal requirements. For material changes, we will notify you via email or a prominent in-app notice at least 14 days before they take effect.

Your continued use of the platform after the changes take effect constitutes acceptance of them. We recommend reviewing this page periodically for the latest updates.

For any questions, concerns, or requests regarding your privacy or data:

• Email: support@quizat.io
• Website: quizat.io
• Entity: Quizat Team — Kuwait

We aim to respond within 3-5 business days, and to access or deletion requests within 30 days.