Privacy Policy

This policy explains what Quizlyne collects, why, who else sees it, and what you can ask us to do about it. Quizlyne is operated by Seratlas Group ("we", "us").

What we collect

Account and organisation data. Name, email, password (stored hashed), the organisation you belong to, your role, and your settings.

Content you upload. Question papers, documents, and images you submit for extraction, along with the question banks, subjects, and knowledge points built from them.

Learning activity. Learner enrolments, attempts, answers, scores, and per-topic progress — the records the product exists to produce.

Billing data. Plan, billing cycle, invoice history, and payment status. Card numbers are handled by Stripe and never reach our servers.

Technical data. IP address, browser and device type, timestamps, and error logs, used to operate and secure the service.

We do not buy personal data, we do not run advertising, and we do not sell personal data.

Why we process it

To provide and secure the service, to authenticate you, to extract questions from what you upload, to produce learner reports, to take payment, to send transactional email, to meet legal obligations, and to fix problems.

Where local or federal law applies, our bases are contract performance (delivering the service), legitimate interests (security, product operation), legal obligation (tax and accounting records), and consent where we ask for it.

AI processing of uploaded content

Turning an uploaded paper into structured questions is done by a third-party AI provider, which means the content of your uploads is transmitted outside our own infrastructure to be processed.

We do not permit our providers to use your content to train their models, and we do not train models on your content ourselves.

Student data

Where a school uses Quizlyne with its students, the school is the controller of student records and we process them on the school's instructions, as its service provider. We do not use student data for our own purposes, do not sell it, do not use it for advertising or profiling, and do not use it to train AI models.

For US schools subject to FERPA, we act as a school official with a legitimate educational interest under the school's direct control, and we handle education records only to deliver the service.

Quizlyne is sold to organisations, not to children, and is not directed at children under 13. Vocational and licensing programs do enrol learners aged 16 and 17: where a school creates accounts for learners under 18, the school is responsible for obtaining any consent its own law and policies require, and for its own COPPA obligations where learners are under 13. We will sign a data protection agreement or a state student-privacy addendum where your district or regulator requires one — ask us.

A learner or parent wanting access to or deletion of records should contact their school, which controls the account. If they contact us directly, we will refer them to the school rather than act unilaterally.

Cookies

We use cookies that are strictly necessary: keeping you signed in, security, and remembering interface preferences such as light or dark mode. We do not use advertising cookies or third-party tracking cookies, so there is no consent banner to click through.

Retention

We keep account, content, and learning records for as long as your account is active. After closure we delete or anonymise them within 90 days, except where we must keep billing and tax records for longer under applicable law. Backups are retained on a rolling basis and expire in the ordinary course.

You can export your question material at any time while your account is active.

Security

Data is encrypted in transit with TLS and at rest by our hosting provider. Access to production systems is restricted to staff who need it, passwords are stored hashed, and organisations are logically separated so one customer cannot read another's data. No system is perfectly secure, and we will notify affected customers and any required regulator without undue delay if a breach affects personal data.

Your rights

Depending on where you live you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, and to complain to a data protection authority. Under US state privacy laws you may have rights to know, delete, correct, and opt out of sale or sharing — we do not sell or share personal data as those laws define it.

Email [email protected] to exercise a right. We will respond within the time your law allows, normally 30 days, and we will not treat you differently for asking. If your data is held in a school's account, see Student data above.

Changes

We will update this policy when our practices change, and we will bump the date below. For material changes affecting personal data we will give notice by email or in the product.

Contact

Seratlas Group [email protected]