Privacy Policy

1. The data controller

The controller of personal data is NEXSPOT TECHNOLOGY SRL, with its registered office at București, Sector 3, Aleea Slt. Adrian Cârstea 1, Bl. 30B, Sc. 1, Et. 5, Ap. 32, cod 031838, CUI/CIF 38147743, privacy email privacy@quizadero.com.

2. Scope

This policy applies to the data processed through the Quizadero website, the web application (the game opened in a browser) and the Android and iOS applications, the game accounts, the contact forms, communications with users, the security systems, the leaderboards, the community features and the cookies or similar technologies used on the website.

3. Categories of data processed

Identification and account data may be processed, such as username, email, encrypted password, language, country or region, and preferences; game data, such as scores, leaderboards, statistics, round history, answers, achievements and sanctions; technical data, such as IP, online identifiers, device, browser, operating system, logs, time of access, security actions, IP reputation scores or signals, proxy, VPN, Tor or datacenter indicators, approximate country, ISP/ASN and pseudonymized device identifiers (one-way hashed device fingerprints) used exclusively for security and fraud prevention; diagnostic data, such as error reports, crash reports and the technical context in which a fault occurred; communication data, such as messages sent through forms or to support.

4. Data that must not be sent

Users must not send, via chat, forms or profile names, sensitive data, the data of other people, identity documents, banking information, passwords or illegal content. If such data is sent accidentally, the operator may delete or restrict the content where it is reasonably and legally possible.

5. Purposes of processing

The data may be used to create and manage the account, authenticate users, run the game, calculate scores, display leaderboards, prevent fraud, detect proxy/VPN/Tor/datacenter usage, detect bots, scripts, multiple accounts and attempts to evade restrictions, moderate the community, respond to requests, send operational communications, perform maintenance, analyze performance, ensure security, prevent abuse, defend the operator's rights and comply with legal obligations.

6. Legal bases

Processing may be based on the performance of the contract or the terms accepted by the user, the operator's legitimate interest in security, fraud prevention, the stability and performance of the service (including error and performance monitoring), administration of the service and defense of its rights, consent for non-essential cookies, advertising measurement or marketing communications, as well as applicable legal obligations. Consent may be withdrawn for the future, without affecting processing carried out prior to the withdrawal.

7. Game data and public leaderboards

Some game-related information may be visible to other users, for example the username, avatar, level, score, leaderboard position, achievements or the results of certain rounds. Users should choose a profile name that does not unnecessarily reveal their real identity if they do not wish to do so.

8. Anti-fraud and security

To maintain fair competition, Quizadero may analyze logs, IP addresses, devices, response speed, gameplay patterns, login attempts, associated accounts and other technical signals. This may include generating a pseudonymized (hashed) device identifier to detect linked accounts and detecting signals of automated browser control. To protect the service against fraud and abuse, connection IP addresses may be checked through specialised third-party IP-reputation services. Only the IP address and technical request parameters are transmitted to these providers, which may be located outside the EEA (currently the United States); such transfers take place under standard contractual clauses or other applicable safeguards. You may request the identity of the current provider by contacting us. The raw device identifier is not stored; only an irreversible hash is processed. This processing is necessary for the security of the platform, the prevention of abuse and the protection of other players.

9. Recipients and providers

The data may be accessed by authorized personnel of the operator and by providers that support the operation of the service, such as web hosting, security, IP reputation and anti-fraud, IT maintenance, email, customer support, payment processors, anti-spam services or legal and accounting advisers. IP-reputation checks are performed through specialised third-party services, as described in section 8. We also use the following categories of providers: a network security and content delivery provider, which also runs the human-verification challenge and receives your IP address and technical browser/device signals; a database and authentication hosting provider and an application hosting provider, both of which store data in the European Union; a log-management provider, which receives the technical logs of our servers — these may contain your account identifier, your IP address and browser or device details — and stores them in the European Union; a transactional email provider, which delivers the email-address confirmation and password-reset messages, including when they are resent, and which receives your email address and the message content for that purpose; a provider of the short-lived counters used to limit repeated registrations, confirmation-email resends, password resets, password changes and player reports (the counters are keyed on the IP address and on an irreversible hash of the email address or, for password changes and player reports, on your account identifier, and are held in a data centre in the European Union); a mobile application update delivery service; and a crash- and error-monitoring service used to detect and diagnose technical faults in our mobile applications and in the web application — the data it receives from the mobile applications is described in section 18 and the data it receives from the web application is described below; all of it is stored in the European Union. In the web application, when a page or our servers encounter an error, when your browser records a technical warning or error message, when the web application records a technical diagnostic event (for example a lost connection to the game server), each time the web application is loaded in your browser (to measure how many visits run into an error) and, for performance measurement, in about one in five page loads and navigations and a smaller share of server requests, this service receives the error or event and its technical context, the page you were on, a short history of your most recent actions in the web application, the text of technical warning and error messages from your browser, your browser and device details, whether the visit ran into an error, and, when you are signed in, your account identifier. Each report reaches the service from your IP address; we have configured the service not to store that address or any location derived from it. We do not send the service your password, and automatic filters remove email addresses and access credentials before a report is sent. This monitoring data is processed on the basis of our legitimate interest in keeping the service stable and secure. The monitoring service does not store cookies or other data in your browser. You may request the identity of the current providers by writing to privacy@quizadero.com. Providers must process the data in accordance with the operator's instructions and applicable law.

If you accept marketing cookies on the presentation website or in the web application, Meta Platforms Ireland Ltd may receive page views and technical browser identifiers through Meta Pixel to measure advertising campaigns. In the web application, once you have accepted marketing cookies, our servers may also send Meta registration and first-game events (for example, that you have created an account), together with your account identifier, a hashed form of your email address, your IP address, your browser details and the Meta browser identifiers. Meta Platforms Ireland Ltd may transfer this data outside the EEA, including to the United States, under its own safeguards, as described in its privacy policy. None of this happens unless you accept marketing cookies. The Cookie Policy explains how to change your choice on the presentation website; in the web application you can withdraw your consent by deleting the site's cookies in your browser, after which you are asked again, or by writing to privacy@quizadero.com.

10. Transfers outside the EEA

Where providers process data outside the European Economic Area, the transfer is carried out on the basis of a valid legal mechanism, such as adequacy decisions, standard contractual clauses or other safeguards provided by the GDPR. This applies in particular to IP-reputation checks, where the IP address may be transmitted to providers located outside the EEA (currently the United States) under standard contractual clauses or other applicable safeguards; the identity of the current provider is available on request. The providers described in section 9 that host our database, authentication, application servers, logs, anti-abuse counters, error reports and performance data store that data in the European Union. Some providers are established, or process data, outside the EEA (currently the United States and Singapore; the network security and content delivery provider also routes traffic through its global network) — for example for network security and content delivery, the delivery of emails and app updates, or support and maintenance access. In those cases the transfer relies on an adequacy decision of the European Commission (such as the one covering providers certified under the EU-U.S. Data Privacy Framework) or, where no such decision applies (as for Singapore), on standard contractual clauses adopted by the European Commission. You may ask which mechanism applies to a given provider, and request a copy of the standard contractual clauses, by writing to privacy@quizadero.com.

11. Storage period

Data is kept for as long as necessary for the purposes for which it was collected. Account data is kept for the duration of the account's existence. Login, security and anti-fraud logs (including the IP address and browser details) are kept for at most 180 days; IP-address reputation checks for at most 90 days. Technical server logs held by our log-management provider are kept for at most 30 days, and error reports and performance data from the mobile applications and from the web application for at most 90 days. Technical game-round data is de-identified after 180 days and kept only in aggregate form, for statistics and anti-fraud purposes. Reports submitted by players are kept for at most 2 years, and the IP address attached to a report is deleted after 180 days. Billing data, where payments exist, is kept in accordance with the statutory tax periods. The counters used to limit repeated registrations, confirmation-email resends, password resets, password changes and player reports expire automatically within a few hours at most.

12. Account deletion

Users can permanently delete their account directly in the mobile app or the web application, from Settings, by confirming their username. Deletion takes effect immediately and cannot be undone: the account, the profile, the game history linked to the user's identity and the personal logs are erased, and in any retained chat messages the author's name is replaced with a neutral label ("Deleted player"), while the message text is kept. Apart from the data held by our providers and the backup copies described below, only a minimal set of data is retained for 2 years: proof of the account deletion (the identifier and the username), proof of acceptance of the policies and, for accounts under active sanctions at the time of deletion, the canonical email address and the pseudonymized (hashed) device identifiers, on the basis of the legitimate interest in preventing the circumvention of sanctions. Questions proposed by the player and already published remain in the game, without attribution. Data in backup copies expires according to the backup cycle. Technical server logs, and error reports and performance data from the mobile applications and from the web application, that our providers already hold are not erased immediately; they expire within the periods stated in section 11 and are kept until then on the basis of our legitimate interest in the security and stability of the service. Users who cannot access the game (for example, suspended accounts) may request deletion at privacy@quizadero.com. Deletion can also be requested without access to the app at https://game.quizadero.com/delete-account.

13. Data security

The operator uses reasonable technical and organizational measures, such as access control, encrypted or hashed passwords, updates, backups, monitoring, restriction of internal access and measures to protect against unauthorized access. No method of transmission or storage is completely free of risk, which is why users must protect their credentials.

14. Users' rights

Under GDPR, users may request access to their data, rectification, erasure, restriction of processing, portability, objection to certain processing and withdrawal of consent. Where processing is based on our legitimate interest (for example security, anti-fraud, error monitoring and performance measurement), you may object at any time, on grounds relating to your particular situation, by writing to privacy@quizadero.com. Users may lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP, Romania) or with the data protection authority of the country where they live or work, if they consider that their rights have been infringed.

15. Exercising your rights

Requests regarding personal data may be sent to privacy@quizadero.com. To protect the account, the operator may request reasonable additional information to confirm identity. A response is provided within the period laid down by GDPR, generally within one month, with the possibility of an extension in complex cases as provided by law.

16. Minors

The service is available to users aged 13 and over. Users aged 13 to 15 may play with the permission of a parent or legal guardian; for these users, chat and all consent-based (marketing) processing are disabled until the age of 16. We collect the date of birth at registration solely to apply these restrictions; it is never displayed publicly.

17. Automated decisions

Quizadero uses automated rules to detect abuse, protect accounts, filter spam and flag suspicious activity. Technical signals and IP reputation signals provided by specialized services may be used as one of the factors considered by these rules. Where there are strong indicators of cheating or abuse, the anti-fraud systems may automatically restrict or suspend an account in order to protect fair competition and other players. Affected users have the right to contest such a decision, to express their point of view and to obtain human review by writing to privacy@quizadero.com or contact@quizadero.com. Permanent measures are subject to review by the operator's staff. Automated restrictions may target the account, the device, the connection or the internet-provider network (ASN) that abuse signals repeatedly originate from.

18. Mobile applications

When you use our Android or iOS application, we additionally process: your device model, operating system name and version, and app version (transmitted when the app connects to our game servers, for compatibility, support and abuse prevention); and a session token held in your device's secure storage, together with local preferences (language, seen notifications, your blocked-players list). Those preferences stay on your device. The session token is stored on your device and is sent to our servers with each request in order to authenticate you. The mobile applications contain no advertising, attribution or cross-app tracking SDKs, and do not access your microphone, camera, contacts or location. They do use a crash- and error-monitoring service (see section 9) so that we can find and fix technical faults. When the app encounters an error, when it records a technical warning or error message or a technical diagnostic event (for example a lost connection to the game server), at the start and end of each app session (to measure how many sessions end in a crash) and, for performance measurement, in about one in five screen loads and navigations, this service receives the error or event and its technical context, the screen you were on, a short history of your most recent in-app actions, the text of technical warning and error messages, your device and app version details, a random identifier of the app installation, whether the session ended normally or in a crash, and, when you are signed in, your account identifier. Each report reaches the service from your IP address; we have configured the service not to store that address or any location derived from it. We do not send the service your password, and automatic filters remove email addresses and access credentials before a report is sent. This data is stored in the European Union and is processed on the basis of our legitimate interest in keeping the service stable and secure. Each time the app checks for over-the-air updates, it sends the update delivery service technical metadata about the app build and device platform (operating system, app runtime version, update and channel identifiers) together with a random identifier generated and stored on the device — not linked to your account, name or email — solely to determine and deliver the correct app update. If the previous launch of the app failed, the check also includes a short technical description of that error. The applications are distributed via Google Play (Google Ireland Ltd) and the App Store (Apple Distribution International Ltd), which process installation data under their own privacy policies.

19. Updates to the policy

The policy may be updated when changes occur to the game, the website, the providers, the legislation or the processing practices. The version published on the website is the version applicable at the time of consultation. For important changes, the operator may notify users via the website or email.