Privacy policy

AgoraQuiz is an educational platform: teachers create groups and themes, their students suggest questions in them and revise by playing. This policy explains what personal data is processed, why, for how long, and how to exercise your rights. It applies to the agoraquiz.education website, the teacher app and the student app (web, iOS and Android).

In short:

• the data is hosted in France, by Scaleway, in Paris;
• no advertising, no sale of data, no commercial profiling;
• students need neither an email address nor their real name;
• everyone can delete their account at any time, from their profile.

Who is responsible for your data?

AgoraQuiz is published by Gabriel FRANCK, sole trader (SIRET 878 007 343 00014), 182 Chemin de la Garoussière, 30120 Le Vigan, France (legal notice). Contact for any question about your data: contact@agoraquiz.education.

The role of AgoraQuiz depends on the data:

• Controller for teacher accounts, the AgoraQuiz Plus subscription, support, security and the audience measurement of the website.
• Processor for student data. This data is processed on behalf of the school or the teacher who decided to use AgoraQuiz with their students, and according to their instructions. In French state education, the controller is in principle the head of the school (secondary education) or the education authority (primary education); it is the teacher themselves when they use AgoraQuiz on a personal basis (private tutoring, for example). The commitments of AgoraQuiz as a processor are detailed in the data processing agreement appended to the terms of use.

What data is processed?

Teachers

• Account: username, email address, password (stored in an irreversible encrypted form, never readable), date of acceptance of the terms of use, language and display preferences.
• Sign in with Google (if you choose it): email address and name of your Google account. AgoraQuiz receives neither your Google password, nor your contacts, nor your files.
• Content: groups, themes, questions, images, assessments, goals, battles, settings of your classes.
• Profile (questions asked after the creation of the account): situation (teacher, trainer, student…), levels and subjects taught and, if you answer, age range and how you heard about AgoraQuiz, with the details you write for an "Other" answer. Age and how you heard about AgoraQuiz are optional.
• Teacher account verification (if you request it): professional email address (from your school or education authority, for example) and a single-use verification link, valid for 24 hours.
• Subscription: plan, status, dates, identifiers of the subscription, customer and invoices at Stripe (at Lemon Squeezy for a subscription taken out on the former version), billing name and email address, card type and last four digits. The billing address and VAT number are stored at Stripe. Payment data (bank card) is entered at the payment provider and is never sent to AgoraQuiz.
• Exchanges: messages sent to support.

Students

• Account: username, password (stored in an irreversible encrypted form), avatar, groups joined. No email address, no date of birth and no real name are asked for. We recommend that teachers have students choose a username that does not identify them outside the class (a nickname, or a first name followed by an initial, for example).
• Learning activity: questions suggested and their status (validated, rejected and reason), answers given, scores, games played, progress in the game modes, achievements, day streaks, results in assessments and goals.
• Notifications: on phones and tablets, if the student allows them, a technical identifier of the device (notification token).

For their groups, the teacher sees the username, avatar, questions, answers, results and activity of each student. The other students of a group see the username, the avatar and some results (leaderboards, battles).

Visitors and users

• Audience measurement and usage statistics: pages viewed, actions in the apps, referring page, device type, operating system, language, time zone, screen size, random identifier of the browser or device and, in the apps, identifier of the logged-in account. This data is only used to produce statistics for AgoraQuiz (see Cookies and trackers).
• Technical logs: IP address, date and time, requested address and browser, recorded by the servers for their security and proper operation.
• Errors: error reports of the apps (message, page, device type).

Why, and on what legal basis?

• Providing the service (accounts, groups, games, learning statistics, notifications): performance of the contract with the teacher (article 6.1.b GDPR). For students, the legal basis is chosen by the controller: usually the school's public interest task of education (article 6.1.e).
• Tailoring AgoraQuiz to your situation (your levels and subjects offered first) and better knowing its users (overall statistics on their profile and how they heard about AgoraQuiz): legitimate interest of AgoraQuiz in improving the service. These answers are used neither for advertising nor for commercial profiling. You can object and have them changed or deleted at any time.
• Verifying that an account belongs to a teacher, to give it the larger limits of the free plan: performance of the contract, at your request.
• Managing the subscription and billing: performance of the contract, and legal accounting and tax obligations (article 6.1.c).
• Sending the service emails (password reset, account and subscription information): performance of the contract.
• Sending you emails about your classes (tips to get started, your students' questions to validate, a summary of your groups' activity): AgoraQuiz's legitimate interest in helping you use the service. They are only sent once your address is confirmed, and can be turned off at any time in your preferences or with the link in each email.
• Sending notifications on phones: consent given through the system permission, which can be withdrawn at any time in the settings of the device or app.
• Measuring the audience and improving AgoraQuiz: legitimate interest of AgoraQuiz in understanding how the service is used in order to improve it, under the conditions of the CNIL (French data protection authority) that exempt these trackers from consent. You can object at any time.
• Ensuring security and preventing abuse (logs, account protection, moderation): legitimate interest, and legal obligations.
• Answering your requests: legitimate interest, or performance of the contract.

AgoraQuiz makes no automated decision producing legal effects on you, does no commercial profiling and does not use student data for advertising or commercial purposes.

Who receives the data?

The data is never sold or rented. It is accessible to the publisher and, within the limits of their tasks, to the following service providers (processors):

• Scaleway SAS (France): hosting of the website, apps, databases, files and backups, in data centers located in the Paris region, and sending of the service's emails (mail.agoraquiz.education domain, Transactional Email).
• OVH SAS (France): sending of the service emails.
• Stripe Payments Europe, Limited (Ireland): payment of AgoraQuiz Plus subscriptions, VAT calculation and issuing of invoices. Stripe is also the controller of some of the data it collects, in particular for fraud prevention and its legal obligations (Stripe privacy policy). Only concerns teachers who subscribe.
• Lemon Squeezy, LLC (United States, a Stripe company): sale and payment of subscriptions taken out on the former version of AgoraQuiz, as reseller ("merchant of record"), until they end. Lemon Squeezy is the controller of the payment and billing data it collects (Lemon Squeezy privacy policy).
• Google Ireland Limited (Ireland): only if a teacher chooses to sign in with Google.
• Expo (650 Industries, Inc.) (United States), Apple and Google: delivery of notifications on phones and tablets, if the student has allowed them. Only the device token and the text of the notification are sent to them.

The data may also be disclosed to the authorities when required by law.

Transfers outside the European Union

The data is hosted in France. Stripe may transfer payment data to Stripe, Inc. (United States); Lemon Squeezy (former subscriptions only) and Expo (notifications only) are established in the United States: transfers to these providers are governed by the EU–US Data Privacy Framework when the provider is certified, or otherwise by the standard contractual clauses of the European Commission.

For how long?

• Account and content: as long as the account is used. An account with no login for 3 years is deleted; teachers are notified by email before the deletion.
• Profile and professional address: deleted with the account. A professional address whose verification link was never opened is deleted within the hour after the link expires (24 hours).
• Account deletion: for a teacher, or for a student in no group, the data is deleted immediately from the database, then disappears from the backups at most 30 days later. The account of a student in groups is closed: nobody can log in with it anymore and its username can be taken by another student, but its data remains visible to their teachers, so that they know who wrote each question and can act on inappropriate content. It is deleted with the last of their groups, when the teacher deletes their account.
• Student data: deleted with the student's account (once closed, with the last of their groups: see above), or with the teacher's groups when the teacher deletes their account. The controller (school or teacher) can ask for its deletion at any time.
• Billing: invoices are kept for 10 years (article L123-22 of the French Commercial Code), in Stripe, and at Lemon Squeezy, which issued them, for the subscriptions of the former version.
• Emails: the list of automatic emails sent and your preferences are deleted with the account. An address to which emails cannot be delivered (address that does not exist, emails marked as spam) is kept as a fingerprint, without the address itself, so as not to write to it again.
• Audience measurement: the identifier of the browser or device is renewed after 13 months at most; statistics are kept for 25 months at most.
• Technical logs: 12 months at most.
• Exchanges with support: 3 years after the last exchange.

Security

The data is protected by appropriate measures: encrypted connections (HTTPS), passwords stored in an irreversible encrypted form, access to servers and databases restricted to the publisher, regular backups, hosting in secure data centers in France. In the event of a data breach presenting a risk to you, the CNIL and, where applicable, the persons concerned or the controller are notified within the time limits set by the GDPR.

Minors

The student app is meant to be used in an educational setting, at the initiative of a teacher. It asks for no identity data, shows no advertising and offers no purchases to students. It is up to the school or the teacher, as controller, to inform the students and their legal guardians of the use of AgoraQuiz. A student or their legal guardians can exercise the student's rights with the school, the teacher or directly with AgoraQuiz.

Cookies and trackers

AgoraQuiz uses no advertising cookies, no social network trackers and no third-party audience measurement tool. The trackers used (cookies and local storage of the browser or device) are:

• Session cookie (connect.sid): keeps you logged in, 30 days at most. Strictly necessary.
• Preferences (light or dark theme, language, display settings): stored on your device. Strictly necessary.
• Audience measurement (agoraquiz_analytics_visitor_id, agoraquiz_analytics_session_id and, in the apps, agoraquiz_analytics_user_id): random identifier renewed after 13 months at most, visit identifier, and identifier of the logged-in account. The statistics are produced by AgoraQuiz's own tool, hosted in France, are only used by AgoraQuiz, are neither shared nor combined with other processing, and cannot be used to follow you on other websites.

In accordance with the CNIL guidelines, these trackers are exempt from consent. You can object to the audience measurement on this website with the button below, or in the apps by writing to contact@agoraquiz.education. You can also clear cookies and site data in your browser settings.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object, as well as the right to withdraw your consent at any time and to give instructions about what happens to your data after your death.

• Delete your account: at any time, from your profile ("My account" section), in both the teacher app and the student app.
• Any other request: write to contact@agoraquiz.education, or by post to the address in the legal notice. You will receive an answer within one month. Proof of identity may be requested in case of reasonable doubt.
• Student data: requests can be sent to the school or the teacher, as controller; AgoraQuiz helps them answer and forwards to them the requests it receives directly.

If you consider that your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr), or with the data protection authority of your country.

Changes

This policy may change, for example when a feature or a service provider is added. The date of the last update is shown at the top of the page. In the event of a significant change, teachers are notified by email or in the app.