Privacy policy

Quiz Granny Digital Solutions Pvt. Ltd. (“Quiz Granny”, “we”, “our”, or “us”) operates the QG Playground platform at qgplayground.com. This Privacy Policy explains what personal data we collect, the purposes for which we process it, the legal bases we rely upon, how we protect it, how long we retain it, and the rights available to you as a data principal or data subject under applicable law.

If you access QG Playground from the European Union or European Economic Area, the United Kingdom, or any other jurisdiction with a comprehensive data protection framework, additional jurisdiction-specific provisions set out in Section 14 apply to you.

1. Data controller / data fiduciary & contact

Quiz Granny Digital Solutions Pvt. Ltd. is a company incorporated under the Companies Act, 2013. QG Playground is the Company’s live interactive quiz and engagement platform, designed for educators, corporate trainers, event organizers, and professional facilitators.

For any privacy-related queries, complaints, or requests to exercise your rights, please write to us at quizgranny@gmail.com. We will respond within the timeframes prescribed by applicable law and, in any event, within thirty (30) calendar days of receipt.

2. Scope & application

This Privacy Policy (“Policy”) applies to all individuals who interact with QG Playground, including:

• visitors to qgplayground.com and associated session-join pages (e.g., qgplayground.com/join);
• registered users who create an account to host quizzes, polls, or other interactive sessions (“Hosts” or “Users”);
• individuals who join a live quiz session using a room code or QR code without registering an account (“Participants”); and
• administrators, organization contacts, and team members associated with business or educational accounts (“Organization Users”).

This Policy does not govern the privacy practices of third-party services, websites, or applications that may be linked from QG Playground. Each such service operates under its own privacy policy, which we encourage you to review independently.

3. Definitions

Unless the context otherwise requires, the following terms bear the meanings ascribed below. Capitalized terms used but not defined here carry the meanings given to them in the QG Playground Terms & Conditions.

4. Categories of personal data collected

The personal data we collect is determined by how you interact with the Platform. We set out below the categories of data collected from each type of user.

4.1 Hosts and registered users

4.2 Participants (audience members)

Participants may join a session without registering an Account. We collect only the minimum data necessary to facilitate participation:

4.3 Organization users and administrators

4.4 Visitors (unauthenticated)

4.5 Data we do not collect

Unless expressly requested by you for a specific, disclosed purpose, we do not collect the following:

• government-issued identification numbers (Aadhaar, PAN, passport);
• biometric data;
• personal data from children under the age of 13 without verifiable parental consent (see Section 12); or
• sensitive personal data such as health information, financial account details, religious or political beliefs, or sexual orientation as part of our core service offering. Where a Host embeds such data within quiz content, the Host assumes full responsibility for compliance with applicable data protection law.

5. Methods of collection

5.1 Data you provide directly

• registration forms and account setup;
• quiz creation interface (questions, answer options, and media uploads);
• billing and subscription forms;
• support requests and communications;
• feedback forms, surveys, and focus group participation; and
• participation in a live quiz session (display name, responses).

5.2 Data collected automatically

• web server and access logs;
• browser cookies and local storage (see Section 15);
• JavaScript-based analytics (page views, event tracking, error reporting); and
• WebSocket connection metadata required to support real-time quiz functionality.

5.3 Data received from third parties

• Authentication providers (Google OAuth): name and email address.
• Payment processors (Razorpay): transaction confirmation and limited card metadata.
• Analytics providers: aggregated behavioural data.
• Marketing and enrichment tools: publicly available professional profile data for B2B marketing, processed on the basis of legitimate interest.
• Resellers and integration partners: contact details provided for account provisioning purposes.

6. Purposes of processing & legal bases

We process personal data solely for the purposes described below. For each purpose, we identify the applicable legal basis under the DPDPA 2023 and, where relevant, the GDPR.

7. Data retention

We retain personal data for no longer than is necessary for the purposes for which it was collected, or as otherwise required or permitted by applicable law. Our standard retention periods are:

You may request the earlier deletion of your personal data in accordance with Section 10. We will comply with all verifiable deletion requests within 30 calendar days, unless a legal basis exists requiring continued retention of the data.

7a. Proctored assessments

Where a Host runs a proctored assessment, additional processing takes place during the attempt. This section describes it in full. It applies only to assessments a Host has explicitly switched proctoring on for, and only for the duration of that attempt.

What runs on your device. Checks for your face being present, a second person in frame, a possible phone in frame, and sustained speech run in your own browser. The video and audio streams themselves are not transmitted to us and are not recorded continuously.

What is saved and sent to the Host. A photo at the start; a photo of an identity document where the Host has asked for one; a small number of photos taken at random points during the attempt; and, when a check flags something, a single small photo, a screenshot of your screen at that moment where screen sharing is enabled, and/or an audio clip of a few seconds including the moments immediately before. Records of tab switches, leaving full screen, losing network, and similar events are also saved.

Screenshots capture whatever is on your screen at that moment, not only the assessment. Close unrelated applications, messages and email before beginning.

Who sees it. Only the Host running that assessment, and our staff where strictly necessary to operate or support the service. It is never shown to other candidates, never sold, and never used to train any model.

No biometric identification. We do not perform facial recognition, face matching or identity verification. Where an identity document is captured, a human being at the Host compares the two images. No biometric template is created, stored or shared.

How long. Seven days after the assessment window closes, after which evidence is purged automatically. A Host may hold one candidate’s evidence for up to sixty days where a dispute is under review. Flag records are kept without the images or audio, so a decision can still be explained.

Automated decisions. Nothing is decided automatically. A flag is a prompt for a human being to look; it never ends an attempt and never determines a result on its own. You may ask the Host to review any flag raised against you, and you may contact us using Section 11 if you cannot resolve it with them.

Accuracy and its limits. These checks are imperfect. Lighting, camera quality and background can all cause a flag where nothing is wrong. That is precisely why they are reviewed by a person and never acted on automatically.

If you are under 18, a parent or guardian must agree before you sit a proctored assessment. See Section 12.

8. Disclosure of personal data

We do not sell your personal data. We share personal data only as set out below.

8.1 Service providers (sub-processors)

We engage trusted third-party service providers (“sub-processors”) who process personal data on our behalf under written data processing agreements that impose obligations equivalent to those we accept under applicable law.

A current and complete list of our sub-processors is maintained at qgplayground.com/subprocessors and is updated each time we add or replace a sub-processor.

8.2 Organizational / business customers

Where you access QG Playground through an organization, school, or institution that has purchased a subscription (“Customer”), the Customer acts as the Controller or Data Fiduciary in respect of its Users’ and Participants’ personal data. We process that data as a Data Processor on behalf of the Customer, pursuant to a Data Processing Agreement.

8.3 Legal and regulatory compliance

We may disclose personal data to courts, regulators, law enforcement agencies, and governmental authorities where required by applicable law, a valid court order, or a binding regulatory mandate. Where legally permitted, we will notify you of any such disclosure request before complying.

8.4 Business transfers

In the event of a merger, acquisition, reorganization, sale of assets, or insolvency proceedings, personal data may be transferred to the acquiring or successor entity. We will provide advance notice via the Platform or by email, and the receiving entity will be required to honour this Policy or offer at least equivalent protections.

8.5 With your consent

We may share personal data with third parties for purposes not described in this Policy where we have obtained your explicit, prior consent to do so.

8.6 Aggregated and de-identified data

We may publish or share anonymized, aggregated data (for example, platform-wide engagement statistics) for research, industry benchmarking, or promotional purposes. Such data does not identify, and cannot reasonably be used to identify, any individual.

9. International transfers of personal data

Quiz Granny is headquartered in India. By using QG Playground, you acknowledge that your personal data may be transferred to and processed in countries other than your country of residence, including India and the United States.

When we transfer personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to countries not recognized as providing an adequate level of data protection, we rely on one or more of the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission (version of 4 June 2021);
• adequacy decisions issued by the European Commission;
• UK International Data Transfer Agreements (IDTAs); or
• Binding Corporate Rules, where applicable.

For cross-border transfers of personal data originating from India, we comply with the transfer restrictions prescribed under the DPDPA 2023 and any applicable notifications issued by the Central Government of India. Copies of the applicable transfer mechanisms are available upon written request to quizgranny@gmail.com.

10. Your rights as a data principal or data subject

Depending on your jurisdiction of residence, you may have the following rights in respect of your personal data:

How to exercise your rights

• email to quizgranny@gmail.com;
• completing the data deletion form at qgplayground.com/deletion; or
• through your in-app account settings (for account deletion and data download).

We will respond to all verifiable requests within 30 calendar days of receipt. For complex or voluminous requests, we may extend this period by a further 30 days and will notify you in advance. We may require you to verify your identity before processing your request. We will not charge a fee for exercising your rights, except where requests are manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply or we may decline to act, in accordance with applicable law.

11. Complaints & grievance redressal

11.1 Internal grievance mechanism (India — DPDPA 2023)

Under the DPDPA 2023, you may raise a grievance with our designated Grievance Officer:

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate your complaint to the Data Protection Board of India, once duly constituted under the DPDPA 2023.

11.2 EU / EEA users — supervisory authority

If you are located in the EU or EEA and believe that we have processed your personal data in violation of the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. A directory of national authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.

11.3 UK users

UK residents may contact the Information Commissioner’s Office (ICO) at ico.org.uk.

12. Children’s privacy

QG Playground is designed for use by individuals aged 13 and above. Our primary users are educators, corporate trainers, and event professionals.

We do not knowingly collect personal data from children under the age of 13 without verifiable parental or guardian consent. Where minors between the ages of 13 and 18 use the Platform as Participants in a school or educational setting, the educational institution (as our Customer) is responsible for obtaining all parental consents required under applicable law.

If we become aware that we have inadvertently collected personal data from a child under 13 without appropriate consent, we will delete such data promptly. To report such an instance, please contact us at quizgranny@gmail.com.

For users located in India, we comply with the DPDPA 2023 provisions on processing personal data of children (defined as individuals under the age of 18), which require verifiable parental consent. Where the Platform is deployed in educational institutions with students under 18, the institution is responsible for ensuring that requisite consents are in place.

13. Security of personal data

We implement technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, alteration, destruction, or disclosure. Our principal security measures include:

Notwithstanding the foregoing, no information system is entirely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the timeframes required by applicable law (72 hours under the GDPR; as prescribed under DPDPA 2023 rules once notified).

You are responsible for maintaining the confidentiality of your Account credentials. Please use a strong, unique password, enable MFA, and do not share your login credentials with any other person.

14. Jurisdiction-specific provisions

14.1 India — Digital Personal Data Protection Act, 2023 (DPDPA)

• Quiz Granny acts as a Data Fiduciary for all processing of personal data of individuals located in India.
• We process personal data on the basis of deemed consent (use of service) and express consent (marketing, AI Features, and optional data collection), as defined under the DPDPA 2023.
• We have appointed a Grievance Officer as required under Section 13 of the DPDPA 2023 (see Section 11.1).
• We comply with all applicable restrictions on processing personal data of children under the DPDPA 2023.
• Cross-border transfers are conducted to jurisdictions notified by the Central Government or under appropriate safeguards.
• This Policy will be updated to reflect any rules and regulations issued under the DPDPA 2023 as they come into force.

14.2 European Union and EEA — GDPR

• For users located in the EU or EEA, Quiz Granny acts as a Data Controller in respect of data processed under this Policy. Where we process personal data on behalf of an EU/EEA-based Customer, we act as a Data Processor.
• Legal bases for processing are as identified in Section 6. Where we rely on legitimate interest, you may object by contacting quizgranny@gmail.com.
• Data transfers outside the EEA are governed by Standard Contractual Clauses or other appropriate safeguards (see Section 9).
• You have the right to lodge a complaint with your national supervisory authority (see Section 11.2).

14.3 United Kingdom

• For users in the UK, we comply with the UK GDPR and the Data Protection Act 2018.
• International transfers from the UK are conducted under UK International Data Transfer Agreements (IDTAs) or addenda to the EU SCCs.
• Complaints may be directed to the Information Commissioner’s Office (ICO) at ico.org.uk.

14.4 California, USA — CCPA / CPRA

• If you are a California resident, you have rights under the CCPA as amended by the CPRA, including the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information.
• We do not sell personal information. We do not share personal information for cross-context behavioural advertising without your consent.
• To exercise your California privacy rights, contact quizgranny@gmail.com or submit a request at qgplayground.com/deletion.

15. Cookies & tracking technologies

We use cookies and similar tracking technologies (including pixels, web beacons, and local storage) on the Platform. The table below summarises the categories of cookies we deploy:

You may manage your cookie preferences at any time by selecting the “Cookie settings” option in the footer of our website. Please note that disabling strictly necessary cookies may impair Platform functionality.

16. Third-party integrations

QG Playground may offer integrations with third-party services including, but not limited to, Slack, Google Classroom, Microsoft Teams, and LMS platforms. By enabling a third-party integration, you:

• authorize us to share relevant data with the third party to the extent necessary to enable and maintain the integration;
• acknowledge that the third party’s own privacy policy governs their use of your data — Quiz Granny is not responsible for third-party privacy practices; and
• are encouraged to review the privacy policy of any third-party service before enabling an integration.

Our sub-processor list at qgplayground.com/subprocessors is updated each time a new integration is added.

17. Marketing communications

We may send you marketing communications about QG Playground’s features, events, and promotional offers, subject to your prior consent. You may:

• opt in to marketing communications during registration or through your account settings;
• opt out at any time by clicking the “Unsubscribe” link in any marketing email; or
• update your communication preferences by contacting quizgranny@gmail.com.

Withdrawing your consent to marketing communications will not affect our ability to send you transactional and service-related communications (including password resets, billing notifications, and session confirmations), which are necessary for the provision of the Service.

18. Links to external websites

Our Platform may contain hyperlinks to third-party websites, resources, or services. Such links are provided solely for your convenience and do not constitute an endorsement by Quiz Granny of the linked websites or their content. We exercise no control over the privacy practices or content of third-party sites and accept no responsibility for them. We encourage you to read the privacy policy of every website you visit.

19. Changes to this Policy

We may update this Privacy Policy periodically to reflect changes in applicable laws and regulations (including new rules under the DPDPA 2023), our Platform features and data-processing practices, or industry standards and best practices.

When we make material changes, we will:

• post the updated Policy on this page with a revised “Last updated” date;
• send an email notification to all registered Hosts if the change materially affects their rights or obligations; and
• display a prominent notice on the Platform login page.

Your continued use of QG Playground following notification of a Policy update constitutes your acceptance of the revised Policy. If you do not agree with the changes, you must cease using the Platform and may request deletion of your account pursuant to Section 10.

20. Governing law & jurisdiction

This Privacy Policy is governed by and shall be construed in accordance with the laws of India, without regard to conflict of laws principles. Any dispute arising out of or in connection with this Policy that cannot be resolved through our internal grievance mechanism shall be subject to the exclusive jurisdiction of the competent courts in Bhopal, India, subject to any mandatory legal provisions to the contrary applicable in your jurisdiction of residence.

21. Contact information

For any privacy-related queries, complaints, or to exercise any right described in this Policy, please contact us:

Quiz Granny Digital Solutions Pvt. Ltd., Bhopal, India. We will respond to all enquiries within 30 calendar days of receipt.