Privacy notice

Tiraverse Ltd, registered in England & Wales, company number 17036977, is the controller for teacher and administrator accounts.

Where a school uses Quizrook with its pupils, the school is the controller for pupil data and Tiraverse Ltd is the processor. Our Data Processing Agreement sets those roles out in full.

• Data at rest stays in the United Kingdom. The database, uploaded files and generated quizzes are stored on our own servers in London.
• Traffic passes through an EU edge. HTTPS is terminated by a reverse proxy operated by Hetzner Online GmbH in Helsinki, Finland. Requests transit that proxy; nothing is stored there.
• Backups stay in the United Kingdom.

• Account details: email address, display name, role, organisation, and either a password hash or the Google or Microsoft account you sign in with.
• Content you create: quizzes, questions, images you attach, and the source material you upload for automatic question generation.
• Attempts: a pupil's answers, scores, timestamps, and any audio, drawing or photo they submit as an answer.
• When a pupil leaves an attempt and comes back, we keep the times, how they came back and the time of their last activity, so the teacher can see them in Analytics.
• Locked attempts: we also keep the Safe Exam Browser version and platform (protection_client) used for the attempt.
• Pupils who join by share code are recorded under the name they type. When a teacher sets a quiz to need a school sign-in, the pupil gives an email address, which the teacher can limit to the school’s own email domains. The pupil either sets a password, which we store only as a hash, or signs in with Google or Microsoft, which gives us the name and email address of that account and an account identifier from the provider. We never receive the password of that account.
• Operational records: sign-in events, automatic-generation usage counts and cost per organisation, and error logs.
• Issue and Suggestion entries sent from the app, private ones included, are read by Forge, our automatic fix service, which may reply in the entry and mark it resolved.
• Contact messages: we store the name, email address, type and message submitted through the Contact form. The form does not send a stored sign-in. Messages stored with a signed-in sender, including earlier messages or requests carrying a valid sign-in for an active account, are linked to that account and organisation.

These are our sub-processors and the other outside services we send data to. We do not sell data, and we do not use it to train any model.

• Anthropic — automatic question generation and automatic marking. What is sent: for generation, the source material and question text a teacher submits for that request; for automatic marking, which is off unless a teacher turns it on for a question, the question, the teacher’s marking notes and the pupil’s answer (text, a transcript of a spoken answer, or a picture), with no name or email address. Anthropic is our default provider; an organisation can supply its own Anthropic API key instead, in which case its requests go to Anthropic under the school’s own contract. Keys are encrypted at rest.
• Resend — transactional email only: sign-up confirmation, password reset, result emails a teacher chooses to send, the link to a quiz a teacher shares with a colleague by email (with the colleague’s address, the sender’s name, the quiz title and its number of questions), and the messages sent with the Contact form (the message type, the name, the email address, the message and whether the sender was signed in), which it delivers to our inbox. It also carries a short note to the sender of a Feedback entry when someone else replies to it or changes its status: the entry’s title and a link to it, never the reply itself.
• Hetzner Online GmbH — the reverse proxy described above. Traffic in transit only.
• Image search providers — Pixabay, Pexels, Unsplash, Openverse, Wikimedia Commons and NASA, and also The Met, the Library of Congress and the Smithsonian if we switch them on. Only search words leave our systems: words taken from what a teacher types to find a picture, or short search words written during automatic question generation. No pupil data is sent to them.
• Groq — transcription of the audio and video files a teacher uploads as source material for automatic question generation (for a video, only its sound track is sent). It is used when our Groq key is configured, unless the organisation’s administrator chooses transcription on our own servers or turns transcription off. Pupils’ answers are never sent to Groq.
• Google and Microsoft — only if you choose to sign in with a Google or Microsoft account. The sign-in happens on their page, and they send us your account’s identifier, email address and name.
• Have I Been Pwned — when you choose a password at sign-up or when you reset it, we check it against passwords exposed in public data breaches. Only the first five characters of the password’s SHA-1 hash are sent, never the password itself or its full hash.
• Sites a teacher links to — when a teacher adds a web page, a Google Docs link or a YouTube link as source material, we fetch it from that site (for YouTube, the video’s captions). Only the link is sent.
• hCaptcha, run by Intuition Machines, or Cloudflare Turnstile, run by Cloudflare — the check on the Contact page that a person, not a program, is sending a message. hCaptcha is used when its hCaptcha keys are configured; Turnstile is used when hCaptcha is not configured and only Turnstile keys are configured. Whichever check is used loads only on that page and receives the visitor’s IP address and signals from their browser. hCaptcha is in the United States, so what it receives leaves the UK and the EU.
• Umami — page analytics. It sets no cookies and records no name, email or account. Per Umami’s documentation it collects the page address, the referring address, browser, operating system, device type and country, anonymised. It runs on every page of this site, so the address of a page a pupil opens is counted along with the rest. Umami’s servers are in the United States and the European Union, so this can leave the UK and the EU too. It also counts clicks on the sign-up buttons and, for the sample questions on the home page, whether each answer was right and the final score. It never receives a pupil’s quiz answer, a mark or a file.

Pupils’ spoken answers are transcribed on our own servers. A pupil’s recorded answer is never sent to an outside transcription service; only the transcript reaches automatic marking, as described above.

Ask us through the contact form and we will act within one month, as the UK GDPR requires. A school administrator can ask on behalf of a pupil.

• Export returns a ZIP with the account’s details, every quiz it wrote with its questions and settings, its folders, the source material it uploaded for automatic generation, the quizzes it took, its activity log, its saved question-type mixes, the names and sizes of its uploads, and its Feedback entries with their replies, history and file names. Spreadsheet formulas in the CSV files are neutralised.
• Erasure deletes the Contact messages and Feedback entries linked to the account at once, keeps the account’s replies on other people’s public Feedback under the name “a deleted account”, ends the account’s sign-in sessions, marks the account as deleted and takes its public quizzes out of the library. Thirty days after erasure a daily job permanently deletes the account with its quizzes, attempts, uploads and files; a quiz that was in the public library stays there under the name “a former teacher”, with no personal data.
• Both run against our API today (/api/v1/me/export and /api/v1/me/erasure). On the account page, use Download my data or Delete my account. You can also ask us through the Contact form; the deadline is the same.

• Erased accounts: a daily job permanently deletes them 30 days after erasure, as described above.
• Messages sent with the Contact form by visitors: deleted 12 months after they were sent.
• The audit log: routine entries (token refreshes, quiz edits and uploads) are deleted after 90 days; sign-in and pupil entries after 12 months; administration, billing, consent and account-deletion entries after 24 months; every other entry after 12 months.

Pupils use Quizrook at the direction of their school. Where consent is the basis for processing a pupil’s data, the school obtains it. For personal accounts below the age of digital consent, Quizrook asks a parent or guardian for consent. We send a consent e-mail with a link to the parent’s page, where they can give or refuse consent. We do not show advertising and we do not profile pupils.

A parent's consent request is kept for 14 days, and the held account is removed when the request expires.

• Passwords stored as Argon2 hashes, or sign-in with Google or Microsoft, with per-organisation isolation enforced in the database itself.
• Encryption in transit; bring-your-own model keys encrypted at rest.
• Security events (sign-ins, failed sign-ins, suspensions and role changes) are kept in an audit log that only our own staff can read; an export for a school's own IT team is not available yet.

We date every change to this notice and keep the previous version available on request. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.