Privacy Policy

This policy explains what data CTX Quiz (“we”) collects, how we use it, the legal bases we rely on, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act). We collect only what we need to run live quizzes and operate your account.

What we collect

Account data — name, email, and (for password accounts) a securely hashed password. If you sign in with Google, we receive your name, email, and profile picture.
Usage data — quizzes you create, sessions you run, and participant nicknames and answers during a session.
Technical data — IP address and basic device info, used for rate limiting, security, and reliability.

How we use it & legal basis

We process data to provide the service, sync live sessions, calculate scores, prevent abuse, process payments, and send transactional emails. Our legal bases are performance of a contract (running the service you signed up for), legitimate interests (security, abuse prevention), consent (where required, e.g. optional cookies), and legal obligation. We do not sell your personal data and do not use it for third-party advertising.

Cookies & storage

We use essential cookies and browser storage to keep you signed in and run live sessions. We do not use advertising or cross-site tracking cookies. You can manage non-essential consent via the banner shown on your first visit.

Your rights

You have the right to access, correct, export (data portability), and delete your personal data, to withdraw consent, and to lodge a complaint. You can export or permanently delete your data yourself from Dashboard → Settings, or contact our Grievance Officer below. We respond to requests within 30 days. EU/UK users may also complain to their local supervisory authority; India users may approach the Data Protection Board of India.

Children's data

CTX Quiz accounts are for users aged 18 and over. Where the platform is used in classrooms or with minors, the organising account holder is responsible for obtaining verifiable parental or guardian consent as required by the DPDP Act and applicable law. Participants join sessions with a nickname only and are not required to create an account.

Data retention

Account data is retained while your account is active. Live-session data (participants, answers) is retained to provide results and analytics and is removed on account/organization deletion. Transient session state is held in cache with a short time-to-live and expires automatically.

Who we share data with (sub-processors)

We use a small number of trusted processors to run the service: MongoDB Atlas (database hosting), Razorpay (payment processing), and Hostinger (transactional email), plus our cloud hosting provider. Each processes data only on our instructions. A current sub-processor list is available on request.

International transfers & security

Where data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses. We protect data in transit with TLS, hash passwords with bcrypt, and isolate each organization's data. In the event of a personal-data breach affecting your rights, we will notify the relevant authority and affected users without undue delay as required by law.

Grievance Officer / Contact

For any privacy request, question, or complaint, contact our Grievance Officer:
PurpleHat Events — Grievance Officer
Email: hello@purplehatevents.in

Changes

We may update this policy; material changes will be communicated through the service.