Quizproof Privacy Policy
Effective: since this version was published
This policy explains what personal data the Quizproof Shopify app ("Quizproof", "we", "us") processes, why, where and for how long, and the rights people have over it.
1. Who we are
Quizproof is provided by Quizproof Labs. Contact for anything in this policy, including privacy requests: support@quizproof.app.
2. Our two roles
Quizproof is a product-recommendation quiz app that merchants install in their Shopify store.
- Controller for merchant data. For data about the merchants who install Quizproof and their staff (the store's account, staff names and IDs, the store owner's email, support messages), we decide why and how it is processed. This policy is our notice for that data.
- Processor for shopper data. For data about the merchant's customers and visitors ("shoppers") who take a quiz, we process data on the merchant's behalf and on the merchant's instructions. The merchant is the controller. Our Data Processing Addendum governs that processing. Shoppers should read the privacy policy of the store where they took the quiz, and send requests about their data to that store; we help the store answer them.
3. Data about merchants and their staff (Quizproof as controller)
| Data | Where it comes from | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Store details: the shop domain, Shopify shop ID, time zone, installed plan and billing state, app settings | Shopify, when you install and use the app | To provide the app, apply your plan's limits, show your plan page | Contract |
| Store owner's email address | Shopify, at install | Service emails: alerts and digests you configure, usage notices at 80% and 100% of your plan, one optional feedback email after you uninstall | Contract; legitimate interest (one feedback request) |
| Staff: Shopify staff user IDs, names, whether the user is the store owner | Shopify session tokens and token exchange, when staff use the app | To show who changed what (audit log), to enforce the "only the store owner can view and export respondent data" setting, to record access to shopper data | Contract; legitimate interest (accountability and security) |
| Alert recipient email you enter in Settings, and whether mail to it bounces | You | To send the alerts you asked for | Contract |
| Support messages: your message, an optional screenshot, the shop domain, plan, app version, recent error IDs, and the email address of the staff member who wrote it | You, through the support form | To answer you | Contract; legitimate interest |
| Feedback: a cancellation reason you choose when switching to the Free plan, and an optional reason after uninstalling | You | To improve the product | Legitimate interest |
| Admin performance and errors: Web Vitals (load and interaction timings per admin page), the request IDs of failed admin requests, and error reports from the admin and our servers | Your browser and our servers | To keep the app fast and fix bugs | Legitimate interest |
| Catalog, quiz and order data: your products, collections, prices, inventory availability and metafields; your quizzes; orders that came from a quiz (order ID, order number, totals and recommended lines) | Shopify, and what you create in the app | To build and serve your quizzes and report their results | Contract |
We do not receive your payment details: Shopify bills app subscriptions.
4. Data about shoppers (Quizproof as processor for the merchant)
| Data | When | Purpose |
|---|---|---|
| Quiz answers, the market (country, currency, language), the products recommended, and a random session ID | Every quiz session | To compute and show recommendations, resume a quiz after a reload, and give the merchant answers and funnel statistics |
| Email address and phone number | Only if the shopper opts in through a quiz | To create or update the shopper as a customer in the merchant's Shopify store with the consent they gave, and, if the merchant connected Klaviyo, to send them to the merchant's Klaviyo account |
| Consent records: each purpose offered (email marketing, SMS marketing, results by email), whether it was granted, the exact wording version shown, when, and any later withdrawal | With an opt-in | To prove and honour the shopper's choices |
| A one-way hash of the email address (salted per store) and the Shopify customer ID | With an opt-in | To link the opt-in to later withdrawals, deletion requests and data requests without keeping the address itself |
| A one-way hash of the shopper's IP address (salted per store) | When a quiz session starts | To limit abuse and keep bots from using the merchant's allowance; kept for one hour |
| Funnel events (quiz viewed, question reached, completed, added to cart): event type, question ID and timing only | During a session | Statistics for the merchant; no personal data |
| Order attribution: the order ID and number, the quiz session, totals and recommended lines; the app pixel's checkout token | When an order follows a quiz, and only if analytics is allowed (section 6) | To show the merchant revenue from quiz recommendations |
| Customer and order IDs, and the email hash, in Shopify's data and deletion requests | When Shopify forwards a request | To answer data requests and delete data |
Quizproof never asks shoppers for a name, a postal address or payment data. The Shopify customer an opt-in creates is tagged quizproof and with the quiz's handle; answers are saved to the customer (as tags and an app metafield) and to Klaviyo only for questions where the merchant turns "save to customer" on. Quizproof does not sell personal data, does not use it for advertising, does not combine one store's shopper data with another's, and makes no automated decisions with legal or similarly significant effects: it recommends products. Quizproof does not use AI on shopper data.
5. Who receives data
| Recipient | What for | Data | Location |
|---|---|---|---|
| Shopify | The platform the app runs in: install, billing, webhooks, the storefront, customer records the opt-in creates | Everything the app reads from or writes to the store | Per Shopify's own terms |
| Klaviyo, only if the merchant connects their own Klaviyo account | The merchant's instruction: opted-in shoppers' email, phone, saved answers and recommended products go to the merchant's Klaviyo account; deletion requests are forwarded there | Shopper opt-in data | The merchant's Klaviyo account |
| Hetzner Online GmbH | Hosting: the server Quizproof runs on | Everything Quizproof stores, encrypted at rest | EU (Germany) |
| Functional Software, Inc. (Sentry) | Error monitoring for our servers and the admin | Error reports. Email addresses and phone numbers are masked, credentials, cookies and authorization headers removed, no request bodies are sent, and a user is reduced to an ID | EU (Germany) |
| Resend (Plus Five Five, Inc.) | Sending service email to merchants: alerts, digests, usage notices, support messages and replies | Recipient address, message content | EU (Ireland) |
| Backblaze, Inc. (B2) | Off-site copy of our database backups | Backups are encrypted on our server before they leave it; Backblaze cannot read them | EU (Netherlands) |
| Cloudflare, Inc. | DNS for our domains; security proxy and TLS for all traffic to the app; forwarding of mail to support@quizproof.app | Domain lookups; all app traffic passes through Cloudflare in transit; support mail | Global network |
| Google LLC (Gmail) | The mailbox support@quizproof.app forwards to | Support correspondence | Global |
| Google LLC (Gemini API) | AI features the merchant starts: suggesting product attribute values, and drafting a quiz from the merchant's brief | Product data (title, description, product type, vendor, tags, metafields), the store's quiz attributes, and the brief the merchant writes. No shopper data. Under Google's paid-service terms, Google does not use this data to train or improve its products; it keeps prompts and responses for up to 55 days to detect abuse, and authorized Google staff may review flagged content | Global (Google may store data transiently in any country where it has facilities) |
We may also disclose data where the law requires it, or to protect the rights, property or safety of our users, shoppers or the public. If Quizproof is ever sold or merged, data may pass to the new owner under this policy.
6. Cookies and browser storage
- Admin: Quizproof runs inside the Shopify admin and authenticates each request with Shopify session tokens; it sets no cookies. It keeps the IDs of the last 20 errors you saw in your browser's local storage so a support message can include them.
- Storefront quiz: the quiz sets no cookies. It keeps the quiz in progress (session ID, answers, results) in the shopper's session storage (keys beginning
qp:), which the browser clears when the tab closes. - Attribution, only with analytics consent: when Shopify's Customer Privacy API reports that the shopper allows analytics, adding a recommended product to the cart writes a
__qpcart attribute (the quiz session ID and result number, no personal data), publishes quiz events (IDs only) to the store's pixels, and remembers in local storage (quizproof:qp) that this browser wrote the attribute so it can be removed if the shopper later declines. Without that consent, none of this happens; the quiz and its recommendations still work.
7. Where data is stored, and international transfers
Quizproof runs on infrastructure we rent from Hetzner in Germany and operate ourselves, with the database on encrypted storage. Our own backup site in the European Union keeps encrypted backups and can also run the service. Traffic to the app passes through Cloudflare's global network. Some recipients in section 5 are companies based in the United States; where personal data leaves the EU or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or an adequacy decision, as offered by each provider.
8. How long we keep data
| Data | Kept |
|---|---|
| Quiz answers and the link between a session and a person | The store's retention setting: 365 days by default, adjustable from 30 to 730 days. After that the session is anonymised; counts remain |
| Consent records | 3 years after their last change once the session is anonymised, as evidence of consent |
| Opt-in deliveries (the email and phone queued for Shopify or Klaviyo) | 180 days after the delivery ends; the address is cleared earlier on withdrawal or deletion |
| Raw webhook deliveries from Shopify | The content is cleared once processed; the record is deleted after 30 days |
| IP address hashes | 1 hour |
| Pixel checkout hints | 30 days |
| Exports of shopper data | Files are deleted after 24 hours |
| Access log of who viewed or exported shopper data | 1 year |
| Records of data and deletion requests | 1 year after they finish (the customer is no longer identified once a deletion completes) |
| Support requests | 1 year |
| Support email to support@quizproof.app | Deleted 2 years after the conversation ends |
| Admin Web Vitals | 35 days |
| Service emails we sent and their delivery events | 180 days (emails), 90 days (delivery events) |
| Error reports at Sentry | 30 days |
| AI requests at Google (Gemini API) | Up to 55 days, for Google's abuse monitoring; Quizproof keeps the AI results in your store's data |
| Server logs | Application logs contain no email addresses, phone numbers or IP addresses and are rotated by size; our web server's access log keeps a short hash of the IP address and paths (without query strings) for 7 days |
| Backups | Up to 30 days, on our server and off-site in the EU; deletions are re-applied if a backup is ever restored |
| Everything else about a store | Until the store's data is deleted after uninstall (section 9) |
9. Uninstalling, and deletion and data requests
- Uninstall. When a store uninstalls Quizproof, we delete its Shopify access tokens and disconnect its Klaviyo account at once. The store's data is kept for 48 hours so that a quick reinstall loses nothing.
- Store deletion (
shop/redact). Shopify asks us to delete a store's data 48 hours after uninstall. We then delete the store's quizzes, catalog copy, shopper sessions, answers, consents, opt-in data, order attributions, exports, access log, staff names, support requests and settings. We keep only what holds no personal data: a minimal record that the store existed (domain, Shopify shop ID, install count) so a reinstall continues correctly, the current and previous month's completion counts, a record that the deletion happened, and feedback counts per reason and month with no link to the store. Deleted data leaves our backups when they expire, within 30 days. - Customer deletion (
customers/redact). When a shopper asks a store to delete their data, Shopify tells us. We anonymise their quiz sessions, delete their consents, clear their email, phone and hashes from pending and past deliveries, delete exports that contain them, and, if the store connected Klaviyo, ask Klaviyo to delete their profile in the store's Klaviyo account. We complete this well within Shopify's 30-day deadline. - Customer data request (
customers/data_request). We prepare a machine-readable (JSON) export of the shopper's quiz sessions, answers and consents for the store owner under Settings › Privacy, for the store to send to the shopper. - Withdrawal of consent. When a shopper unsubscribes in Shopify, we stop and cancel anything still waiting to be sent for that purpose, and unsubscribe them in the store's connected Klaviyo account.
10. Security
Traffic to Quizproof uses HTTPS only. The database and export files sit on encrypted disks; access tokens and export files are additionally encrypted by the app; backups are encrypted before they leave the server. Only the store owner can be allowed to view and export shopper data (a store setting), every view and export of shopper data is logged and visible to the merchant, and export links expire after 24 hours. Server access is limited to the operator, with key-based login only. Error reports and logs are scrubbed of email addresses, phone numbers and credentials. We follow a written incident response procedure and notify Shopify and affected merchants of personal data breaches.
11. Your rights
If you are in the EU, the UK or a country with similar laws, you can ask us for access to, correction of, deletion of, or a portable copy of personal data we hold about you as controller, and you can object to or ask us to restrict its processing. Write to support@quizproof.app; we answer within one month. You can also complain to a data protection authority, in Portugal the Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority where you live.
Shoppers: your data in Quizproof belongs to the store where you took the quiz. Contact that store; if you contact us, we will pass your request to the store and help it answer.
California residents: we do not sell or share personal information for cross-context behavioural advertising, and we act as a service provider to merchants for shopper data. You may exercise the rights above, including to know and to delete, without discrimination.
12. Children
Quizproof is a service for businesses. It is not directed at children, and we do not knowingly collect children's personal data as controller.
13. Changes to this policy
We will post any change on this page with a new effective date. For a material change, we will tell installed merchants in the app or by email before it takes effect.
14. Contact
Quizproof Labs — support@quizproof.app