---

This Privacy Policy explains how QuizzyNest Ltd ("QuizzyNest", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you visit or use quizzynest.com and related services.

QuizzyNest is designed for families. Parent or legal guardian accounts control access to the service. We aim to use as little personal data as possible and apply privacy-by-design and high privacy settings by default.

1. Who we are

QuizzyNest Ltd is the controller of the personal data described in this Privacy Policy.

2. Who this policy applies to

This policy applies to:

• parents or legal guardians who create, purchase, or manage an account;
• visitor activity on our website;
• information connected to an Avatar profile created and controlled by a parent or legal guardian.

3. The personal data we collect

3.1 Data provided by a parent or legal guardian

• Account details: name, email address, password or login details, and customer support messages.
• Parent or guardian confirmation: confirmation that the person creating the account is the parent or legal guardian authorised to use the service.
• Subscription and order details: plan type, purchase status, subscription status, transaction references, invoices, refunds, and related customer service records.

3.2 Payment information

• Stripe processes payments securely. We do not store full payment card details on our own servers.
• We may receive limited payment-related information from Stripe, such as payment status, subscription status, country, customer ID, and transaction references.

3.3 Avatar profile data

• Avatar name: a fictional or nickname-style name chosen by the parent or legal guardian.
• Age or age band: used to place the Avatar in the appropriate content level.
• Learning and progress data: quiz results, scores, badges, completion history, progress records, and related learning insights or reports.

3.4 Website and technical data

• Device and usage data: IP address, browser type, device type, operating system, pages viewed, timestamps, and basic technical logs.
• Security data: fraud-prevention and abuse-prevention information, including reCAPTCHA-related signals where used.
• Cookies and similar technologies: as described in our Cookies Policy.

4. How we use personal data

We use personal data to:

• create and manage parent or guardian accounts;
• deliver subscriptions, content, progress tracking, and parent-facing reports;
• process payments, refunds, and billing administration;
• send service emails, onboarding messages, password resets, and support communications;
• protect the website and service against fraud, abuse, and security incidents;
• monitor, maintain, and improve service performance and reliability;
• send marketing communications where permitted by law and, where required, with consent.

5. UK lawful bases for processing

5.1 Contract

We process personal data where necessary to provide the service you request, including account creation, subscription access, billing support, educational delivery, and parent-facing reports.

5.2 Legal obligation

We process and retain certain records where necessary to comply with tax, accounting, fraud-prevention, regulatory, or other legal obligations.

5.3 Legitimate interests

We process some data where necessary for legitimate interests such as service administration, security, abuse prevention, troubleshooting, and reasonable business improvement, provided those interests are not overridden by the rights and interests of individuals.

5.4 Consent

Where required by law, we rely on consent for certain marketing communications and certain non-essential cookies or similar technologies. Consent may be withdrawn at any time.

6. Parent-controlled use and child-related information

QuizzyNest is designed to be set up and managed by a parent or legal guardian. We ask the parent or legal guardian to provide information for the Avatar profile, and we do not ask for a learner’s real first name for use inside the platform.

If our service is used in a jurisdiction with specific rules for children’s data, including the United States, we aim to provide the parent notices and parent-controlled consent steps required by applicable law before collecting, using, or disclosing child-related personal information through the service, except where a limited legal exception applies.

7. COPPA notice for U.S. parents

If QuizzyNest is considered an online service directed to children under 13, or if we have actual knowledge that we are collecting personal information online from a child under 13, we seek to operate through a parent-controlled account model.

• We ask the parent or legal guardian to create the account.
• We ask for an Avatar name instead of a learner’s real first name inside the service.
• We use child-related data only to provide, maintain, support, and improve the educational service, parent reports, account administration, security, and other purposes described in this policy.
• We do not knowingly allow learners to make public posts or publicly reveal personal information through the service.
• If applicable law requires verifiable parental consent before collecting, using, or disclosing child-related personal information, we seek to obtain that consent through a parent-controlled flow before doing so, except where a limited legal exception applies.

8. How we share personal data

We do not sell personal data. We may share personal data with trusted service providers and third parties only where needed to run the service lawfully and securely, including:

• Stripe – payment and subscription processing;
• Supabase – database and data infrastructure;
• MailerLite – email delivery and parent communications;
• Google reCAPTCHA or similar security services – bot and abuse prevention;
• hosting, technical, analytics, or infrastructure providers used to support the website and platform;
• professional advisers, such as legal, accounting, or insurance advisers, where necessary;
• public authorities, regulators, courts, or law enforcement where required by law or where necessary to establish, exercise, or defend legal claims.

9. International transfers

Some of our service providers may process personal data outside the United Kingdom or outside the country where you are located. Where personal data is transferred internationally, we take steps designed to ensure an appropriate level of protection, including reliance on adequacy regulations where available and, where required, appropriate contractual or other safeguards.

10. Cookies and similar technologies

We use cookies and similar technologies to operate the website, remember preferences, support security, and, where applicable, measure performance or improve the service. Where required by law, we request consent before placing non-essential cookies. Please see our Cookies Policy for more information.

11. Data retention

We keep personal data only for as long as needed for the purposes described in this policy, including to provide the service, maintain security, handle disputes, comply with legal obligations, and enforce our agreements.

• Parent account data: kept while the account is active and for 60 days after closure or last activity, unless a longer period is required for legal, tax, security, or dispute reasons.
• Billing and transaction records: kept for 6 years where required for tax, accounting, fraud prevention, or legal claims.
• Avatar learning and progress data: kept while the subscription or account is active and then deleted or anonymised within 60 days, unless longer retention is required for security, dispute handling, or legal compliance.
• Support requests and security logs: kept for 12 months or for as long as reasonably necessary to investigate issues, prevent fraud, or comply with law.
• Marketing preferences: kept until you unsubscribe, withdraw consent, or for 24 months after your last meaningful interaction.

12. Your privacy rights

Depending on the law that applies to your situation, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing, including some processing based on legitimate interests;
• request transfer of certain personal data to you or another provider, where applicable;
• withdraw consent where processing is based on consent;
• complain to the UK Information Commissioner’s Office (ICO), if applicable.

Parents or legal guardians may also contact us to review, correct, or request deletion of child-related data connected to an Avatar profile they control.

To exercise your rights, please contact us at support@quizzynest.com.

13. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. However, no system can be guaranteed to be completely secure. We therefore encourage parents and legal guardians to use strong passwords and keep account access details private.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our service, our processors, legal requirements, or our data practices. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice.

15. Contact and complaints