GDPR Information & Your Rights

Introduction to GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to individuals in the European Economic Area (EEA). At Questingo, operated by Aimform Kft., we are committed to complying with GDPR and protecting your privacy rights.

What is Personal Data?

Under GDPR, personal data is any information that relates to an identified or identifiable individual. At Questingo, this includes:

Legal Basis for Processing

We process your personal data based on the following legal grounds:

1. Consent (Article 6(1)(a))

We process data based on your consent for:

2. Contract Performance (Article 6(1)(b))

We process data to fulfill our contract with you by providing the Questingo service.

3. Legitimate Interests (Article 6(1)(f))

We process data based on legitimate interests for improving service quality, ensuring security, and technical administration.

Your GDPR Rights

1. Right to Be Informed (Article 13-14)

You have the right to know what data we collect, why we collect it, how we use it, and who we share it with. See our Privacy Policy for complete information.

2. Right of Access (Article 15)

You have the right to:

• Confirm whether we process your data
• Access your personal data
• Receive a copy of your data

How to Exercise: Email access@questingo.com. We will respond within 30 days.

3. Right to Rectification (Article 16)

You have the right to correct inaccurate personal data and complete incomplete data.

How to Exercise: Update your information in Settings or contact privacy@questingo.com.

4. Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data when:

• Data is no longer necessary for its original purpose
• You withdraw consent
• You object to processing
• Data has been unlawfully processed

How to Exercise: Delete your account in Settings or email deletion@questingo.com.

Timeline: Complete data deletion within 7 calendar days.

5. Right to Restriction of Processing (Article 18)

You have the right to restrict how we process your data when you contest accuracy, processing is unlawful, or you object to processing.

How to Exercise: Email restriction@questingo.com.

6. Right to Data Portability (Article 20)

You have the right to receive your data in a structured, commonly used, machine-readable format (JSON).

How to Exercise: Email portability@questingo.com. We will provide your data within 30 days.

7. Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or direct marketing.

How to Exercise: Email object@questingo.com.

8. Rights Related to Automated Decision-Making (Article 22)

We use AI (Google Gemini, Cloudflare AI/Flux, and Replicate) to generate quizzes, flashcards, explanations, and images. Important details about AI-generated content:

• AI-generated quizzes and content cannot be edited after generation - if unsatisfied, you can regenerate new content
• No automated decisions significantly affect your legal rights or similarly significant effects
• AI is used to enhance learning experiences, not to make decisions about access or eligibility
• You can choose from existing pre-generated quizzes in the Explore section as an alternative to generating new content

How to Exercise Your Rights

Contact Methods

General Privacy: privacy@questingo.com
Data Protection Officer: dpo@questingo.com

Specific Rights:

• access@questingo.com (Right of Access)
• deletion@questingo.com (Right to Erasure)
• portability@questingo.com (Data Portability)
• restriction@questingo.com (Restriction of Processing)
• object@questingo.com (Right to Object)

Verification Process

To protect your privacy, we need to verify your identity before processing requests. Verification typically takes 1-3 business days.

Response Timeline

• Initial Response: Within 5 business days
• Complete Response: Within 30 calendar days
• Complex Requests: Up to 90 days (we will inform you of any delay)

Data Protection Principles

We process your data in accordance with GDPR principles:

• Lawfulness, Fairness, and Transparency
• Purpose Limitation
• Data Minimization
• Accuracy
• Storage Limitation
• Integrity and Confidentiality
• Accountability

International Data Transfers

Your data may be transferred outside the EEA to the United States. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) and additional technical measures.

Data Breach Notification

If we experience a data breach that poses a risk to your rights and freedoms:

• We will notify the relevant supervisory authority within 72 hours
• We will notify affected individuals without undue delay
• We will describe the nature of the breach and measures taken

Children's Privacy (GDPR-K)

Questingo is designed with children in mind. We comply with GDPR-K (Article 8) and COPPA for the protection of children's personal data:

• Children under 16 require verified parental consent to use our service
• Parent accounts create and manage child profiles with full control
• Parents can view, export, or delete their child's data at any time via Settings
• We minimize data collection for children to what is strictly necessary
• Session recordings do not capture sensitive input fields
• Analytics data for children is anonymized where possible

If you believe we have collected data from a child without proper parental consent, contact us immediately at privacy@questingo.com.

Data Processors and Third-Party Services

We use the following data processors who may process your personal data on our behalf:

• Supabase - Database and authentication (US)
• Cloudflare - Workers, R2 storage, AI image generation (Global CDN with EU presence)
• Google Cloud - Gemini AI for content generation, Text-to-Speech, YouTube API (US)
• PostHog - Product analytics and session recordings (EU - eu.posthog.com)
• Plunk - Transactional email delivery
• Replicate - AI image generation (fallback)
• OpenAI (Whisper) - Speech-to-text processing for voice features
• Twilio - SMS verification for parent identity verification
• Stripe - Credit card verification for parent identity (no card numbers stored)

All processors are bound by data processing agreements ensuring GDPR compliance. PostHog specifically processes data in the EU for enhanced data protection.

Behavioral Analysis and Profiling

To provide personalized learning experiences and parent insights, we analyze:

• Learning Dispositions: We assess persistence, flexibility, and metacognition based on quiz interactions
• Zone of Proximal Development: We analyze quiz performance to understand optimal challenge levels
• Interest Detection: We identify learning interests from video watching patterns and quiz topics
• Self-Aware Language: We detect metacognitive language patterns in quiz responses

This analysis is used solely to enhance the educational experience and provide insights to parents. It does not affect access to services or make decisions with legal effects.

Self-Serve Data Rights

You can exercise many of your GDPR rights directly within Questingo without contacting us:

• Data Export: Download your data in JSON format from Settings
• Account Deletion: Delete your account and all data from Settings
• Profile Management: Update or delete child profiles from Settings
• Consent Management: Review and modify your consents from Settings

Supervisory Authorities

You have the right to lodge a complaint with a supervisory authority if you believe we have violated GDPR.

How to File a Complaint

With Questingo (Preferred): complaints@questingo.com
With a Supervisory Authority: Contact your national data protection authority

Contact Information

General Privacy: privacy@questingo.com
Data Protection Officer: dpo@questingo.com
Complaints: complaints@questingo.com
Legal Matters: legal@questingo.com