Privacy Policy

Last updated: 2026-09-12

This policy explains what personal data we collect, why, and what rights you have. It is written to the standard of the EU General Data Protection Regulation, which we apply to every user of QuizByt.

1. Who is responsible

The controller is QuizByt, B Block, Askari 11, Lahore 54000, Pakistan. Data protection contact: info@quizbyt.com.

Where a school has added its own students, the school is the controller of those students’ data and we act on its instructions. See clause 4 of our Terms.

2. What we collect and why

We do not use your data to make any decision about you by automated means alone that produces a legal or similarly significant effect (GDPR Art. 22). Quiz scoring and level progress are automatic, but they only decide what you are shown next.

3. Children

We know many of our users are children, and we treat that as the central fact of this policy rather than a footnote. We collect the minimum needed to run the service.

• Under 13: an account must be created and consented to by a parent or guardian. This is COPPA’s requirement for children in the United States and we apply it everywhere. A parent may review what we hold, refuse further collection, and have it deleted, by writing to info@quizbyt.com.
• Under 16 in the EU/EEA or UK: where we rely on consent, that consent must be given or authorised by a parent or guardian (GDPR Art. 8).

Verification of parental consent is proportionate to the risk, as COPPA allows: we confirm the parent’s email address, and a change to a parental control PIN is only ever completed from that address, so a child cannot grant themselves permission.

4. Student data: what we will never do

These are commitments, not preferences, and they hold for every student whether or not their country requires it. They match what California’s Student Online Personal Information Protection Act (SOPIPA) requires of a service built for schools:

• We do not sell student personal information. We never have.
• We do not show targeted or behavioural advertising to students, and we do not use anything we learn inside QuizByt to target advertising anywhere else.
• We do not build a profile of a student for any purpose other than their own education on this service.
• We delete student data when a school or parent asks us to.

5. Who we share data with

We use service providers who process data on our behalf under written contracts meeting GDPR Art. 28: our hosting provider, our payment providers (Stripe, JazzCash and EasyPaisa) and our email and messaging providers. Payment providers receive what they need to take a payment; we never see or store your full card details.

If, and only if, you allow the marketing category in the cookie banner, our public pages load the Meta Pixel so we can tell whether our adverts are working. Meta then receives that your browser visited that page. This includes the free lessons and the Kindergarten playground, which are public pages. It is never loaded on any page while you are signed in, so it is never attached to a student account and never sees what a student studies or scores. You can withdraw the permission at any time from Cookie settings, and a Global Privacy Control signal refuses it for you automatically.

We do not sell personal data, and we do not share student data for cross-context behavioural advertising. We disclose data to an authority only where the law obliges us to, and we tell you unless we are forbidden from doing so.

6. Where your data goes

We are established in Pakistan, so data you give us is processed in Pakistan and by the providers named above, some of which are in the EU and the United States.

Whoever you are, your data is protected in transit by encryption, and access to it is limited to the few staff who need it.

We do not currently accept registrations from the UK, the EU or the EEA, and this is why: Pakistan holds an adequacy decision from neither, so personal data cannot lawfully flow to us from those countries on the strength of our good intentions. It needs a formal safeguard, the Commission’s Standard Contractual Clauses (GDPR Art. 46(2)(c)) and the UK International Data Transfer Agreement. Putting those in place is part of the work we are doing before we open there, rather than after.

7. How long we keep it

Account data: while your account exists, then deleted or anonymised within 90 days of closure. Invoices and tax records: 6 years, which is the period Pakistani tax law requires records to be kept for (Income Tax Ordinance 2001 s.174; Sales Tax Act 1990 s.24). Server logs: up to 90 days. Consent records: for as long as the consent is relied on, plus 3 years as evidence that it was given.

8. Your rights

Wherever you live, you have the right to access your data, correct it, have it deleted, restrict or object to how we process it, and receive it in a portable format. Where we rely on consent you may withdraw it at any time, without affecting processing that already happened. Under the GDPR these are Articles 15 to 21.

To exercise any of them, email info@quizbyt.com. We answer within one month, and we do not charge for it. We will ask enough to be sure it is really you, for a child’s data, that the request comes from the parent or guardian on the account.

9. Extra rights in the United States

If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon or another state with a consumer privacy law, that law gives you rights to know what we collect, to delete it, to correct it, to take a copy, and to opt out of the sale of your data, of sharing it for cross-context behavioural advertising, and of profiling. We honour these requests from anyone in the United States, without first checking whether we are large enough to be caught by the statute.

We do not sell or share your personal information, so there is nothing to opt out of,but if you send a Global Privacy Control signal from your browser we treat it as an opt-out of any advertising cookie regardless. We will not discriminate against you for exercising any of these rights, and if we refuse a request you may appeal by replying to our answer; we will respond to the appeal in writing.

For a student at a US school, education records stay under the school’s control and we handle them as a school official under FERPA.

10. How we protect it

The site is served only over HTTPS, passwords are stored hashed and never in readable form, payment details never reach our servers, and access to production data is limited to the people who need it. Sessions expire, and signing out ends them. If a breach ever puts your rights at risk we will tell the relevant supervisory authority within 72 hours and tell you without undue delay, as GDPR Art. 33 and 34 require, and we will apply the same standard to users outside the EU.

11. Cookies

See our Cookie Policy. You can change or withdraw your choice at any time using the Cookie settings link in the footer.

12. Complaints

Tell us first at info@quizbyt.com. If you are not satisfied:

• UK, EU and EEA: we do not offer the service there yet. If we hold your data anyway ,because you moved after registering, for instance. You keep every right described above, and you may complain to the Information Commissioner’s Office in the UK, or to the supervisory authority of the EU country where you live or work.
• United States: your state Attorney General, or the Federal Trade Commission for a complaint about a child’s privacy.
• Pakistan: write to us; there is not yet a data protection authority to escalate to, which is why we hold ourselves to an external standard.