Data agreement for schools

Who decides, who processes

The school decides which students use Quiznova and what is entered about them. For that student data, the school is the controller (or, in the US, the educational agency) and we process it only on the school's documented instructions: to run quizzes, classes, games and results for the school. In the US we act as a “school official” with a legitimate educational interest under FERPA, under the school's direct control for the use and keeping of education records.

Teachers on a school plan

A school's admins invite its teachers by email, and a teacher joins only by accepting. While a teacher is in the school, its admins see a summary for each teacher (classes, number of students, quizzes published and average scores), never the students' names or answers. A teacher can leave at any time and the school can remove them; their own quizzes, classes and results stay with them. Invitations nobody answers are deleted after 30 days.

What we do and never do with student data

• We use it only to provide Quiznova to the school and its students.
• We never sell it, never use it for advertising, and never build profiles of students for anything other than their learning in Quiznova.
• We never send student data to AI services. “Write with AI” uses only the teaching material a teacher gives.

Consent for children

Where a teacher makes logins for children, or students join through the school, the school gives consent on the parents' behalf for use in class (as allowed, for example, under the US COPPA rule for school use). The school confirms it has the authority to do this and will tell parents about Quiznova. Students who make their own accounts below the age of digital consent need a parent's approval by email.

Security and staff

• Data is encrypted in transit and at rest, access is limited by strict database rules, and scores are worked out on our servers.
• Passwords are never stored by us in readable form.
• Only the people who run Quiznova can reach the data, under a duty of confidentiality, and admin actions are recorded in an audit log.
• If a security incident affects the school's data, we tell the school without undue delay, and within 72 hours of becoming aware of it where we can, with what we know and what we are doing about it.

Providers we use (sub-processors)

• Google Cloud / Firebase (United States): hosting, database, sign-in and file storage.
• GoDaddy: the email service of Infoleen's mailbox, for account, invitation and consent emails.
• Paddle: payments for paid plans (no student data).

Each is bound by data protection terms at least as protective as this agreement, including the European Commission's Standard Contractual Clauses (and the UK addendum) for data leaving the EEA, UK or Switzerland. We will update this list before adding a provider that handles student data; a school may object by writing to us.

Help with requests and audits

Teachers can see, correct, export (CSV or Excel) and delete their students' results themselves. For anything else, such as a parent's request to see or delete a child's data, we help the school within 30 days. We give the school the information it reasonably needs to show it is meeting its obligations.

Keeping and deleting

• Guest answers are deleted 7 days after the quiz closes.
• A teacher can delete results, classes and students' logins at any time; a student or parent can delete the student's account.
• When the school stops using Quiznova, it can export what it needs and delete its data, or ask us to delete it. Backups are overwritten within 14 weeks.

Contact

Haider Khan (Haider Zubair), who runs Quiznova: contact@infoleen.in.