1. Information We Collect
We collect information necessary to provide the Service, including: teacher profile metadata (via Google), billing metadata (via Stripe), student account credentials, uploaded educational materials (including texts, PDFs, Web URLs, and YouTube links uploaded for classes or Self-Study), AI learning dialogue logs, and student performance metrics (including scores, answer history, and AI-generated strength/weakness tags).
2. How We Use Information
Your information is used to: generate quizzes, process student grades, facilitate teacher dashboard reports, manage subscriptions, calculate personalized strength/weakness profiles, update student learning path stages, and optimize AI prompting. We never sell, lease, or distribute your personal data to third-party data brokers or advertisers.
3. Generative AI Data Processing
Uploaded documents, vocabulary lists, and quiz/dialogue configurations are sent to third-party AI APIs (such as Google Gemini API) to perform question generation and personalized learning analysis. We ensure these providers operate under strict data security standards. Crucially, your educational data and dialogue history are processed via API endpoints and are not utilized by these providers to train foundation AI models.
4. Hosting & Infrastructure
Our databases and services are hosted on secure cloud infrastructure (Google Kubernetes Engine - GKE) located in highly compliant data centers. We implement firewalls, access controls, and rate-limiting to defend against unauthorized intrusion.
5. Encryption at Rest & in Transit
All data transmitted to and from the Service is encrypted using TLS. Student PII (personally identifiable information, such as full names) is encrypted at rest using AES-256-GCM encryption before database persistence. Encryption keys are managed separately from database storage and are rotated periodically.
6. Cookies & Third-Party Services
We use necessary cookies for session authentication and functional settings. We also implement analytical telemetry (via Google Tag Manager and PostHog) to monitor platform health and stability. You can control cookie preferences through your browser settings.
7. Service Emails & Weekly Activity Summaries
If you are a teacher, we send you a weekly activity summary email (on by default) when students completed your quizzes during the previous week. It contains only factual information about your own account's activity (for example, completions by distribution method, average scores, and flashcard practice activity) and a link to view the results; it contains no advertising. To send it at a sensible local time, we use the time zone selected in your Settings. If none is set, we automatically detect and save one to your account: from your browser when you use your teacher account, or, when a summary is due, from our analytics tool (PostHog), which may use your browser's reported time zone or a time zone inferred from your IP address. You can change the saved time zone at any time in Settings. You can turn the summary off at any time in Settings → Email notifications, or with the one-click link included in every summary email; turning it off does not affect other service emails, such as account and student-completion notifications. We send this summary based on our legitimate interest in keeping you informed about activity on your account, and you may object at any time as described above.
8. Direct Messages & Reports
If you use direct messaging, we store the messages you send and receive and related conversation information (the participants, timestamps, read status, and whether a conversation is archived, blocked, or reported). Message content is encrypted at rest using AES-256-GCM. The other participant sees your display name and profile picture and whether you have read their messages; a teacher does not see a student's email address unless the student accepts that teacher's roster invitation. If you have not read a new message after about 10 minutes, we may email you a notification that includes the sender's name and an excerpt of the message; you can turn these emails off in Settings → Email notifications. To prevent spam, fraud, and abuse, we apply rate limits and automatically check whether a message appears to contain contact details (an email address, phone number, LINE ID, or link); we record only the type of detail found, never the message content, in our analytics tool (PostHog). We do not access conversation content except when a participant reports a conversation or when required by law. A report stores an encrypted copy of up to the 20 most recent messages in that conversation, which only authorized platform administrators can review, and every review is logged. Messages are kept until the conversation is deleted, which happens when either participant's account is permanently deleted, and we may remove messages in response to a report. Report records and the preserved messages are kept for up to 12 months after the report is resolved and then deleted, unless we need them longer to comply with law or to establish or defend legal claims. We process messaging data to provide the feature you choose to use and, for safety measures, based on our legitimate interest in keeping the Service safe.
9. Children's Privacy
Students must be at least 13, or the minimum age required in their country, to create an account. When a student registers, we ask for their date of birth and use it only to confirm eligibility and apply the rules for minors. If it shows the student is below the minimum age, we do not create or keep the account. Students under the age of majority confirm that a parent or guardian has agreed to their use of the Service, including direct messaging. Younger children may answer quizzes shared by their teacher without an account; the teacher or school is responsible for any required parental consent. Only students can start a conversation, students control whether their email address is shared with a teacher, and any participant can block, archive, or report a conversation. Parents or guardians can contact us at [email protected] to review or delete their child's information. 10. International Data Transfers
Our primary databases and servers are hosted in Google Cloud's Taiwan region. Some service providers process data in other countries, including the United States, such as Google (Gemini AI processing), Stripe (payments), and PostHog (product analytics). Your information may therefore be transferred to and processed in countries whose data protection laws differ from those where you live. Where required by law, we rely on appropriate safeguards for these transfers, such as the contractual data protection terms offered by these providers.
11. Data Entered by Teachers & Schools
Teachers and schools decide which student information to enter into the Service (for example, roster names and email addresses, and responses collected through shared quiz links). For that information, the teacher or school is responsible for having a lawful basis and any required consent, and we process it on their behalf to provide the Service. Students who want to access, correct, or delete such information can contact their teacher or school, or contact us and we will assist.
12. Data Retention & Security Incidents
We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete your personal data as described in section 9 of our Terms of Service (within 180 days, with residual backup copies removed as backups expire). Other periods are described in the relevant sections of this policy, such as message reports (12 months after resolution). We may keep limited records longer where required by law or to establish or defend legal claims. If a security incident affects your personal data, we will notify you and the relevant authorities as required by applicable law.
13. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in the Service and ask you to review the updated policy before you continue using the Service. The date at the top of this page shows when it was last updated.
14. Your Rights & Contacts
TechTransLab operates Quizzz and is responsible for the personal data described in this policy, except where a teacher or school is responsible as described in section 11. Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, restrict or object to certain processing, and withdraw consent at any time (which does not affect processing before withdrawal). You can update much of your information in Settings and request account deletion by emailing [email protected]. To exercise any right, contact our privacy team at [email protected]; we may need to verify your identity and will respond within the period required by applicable law. You also have the right to lodge a complaint with your local data protection authority.