Security and Privacy

1.Who this policy covers

Quiz Maker is a registered business name of My Plaza Pty Ltd (ABN 58 110 054 245), an Australian company at Suite 1, Ground Floor, Enterprise 1, Innovation Campus UOW, Squires Way, North Wollongong NSW 2500, Australia. In this policy, "we", "us" and "our" mean My Plaza Pty Ltd.

This policy explains how we handle information across quiz-maker.com, take.quiz-maker.com, learn.quiz-maker.com, our other sites and subdomains, our apps, and the quiz and survey widgets you embed in your own site. Together we call these the Services.

It applies to three groups of people:

• Creators, who hold an account and build quizzes.
• Respondents, who open or answer a quiz someone else made.
• Visitors, who browse our sites without doing either.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy forms part of our Terms of Service, and the words defined there have the same meaning here.

2.Two kinds of data, two different roles

This distinction drives everything else in this policy, so it is worth getting straight.

If you need a written data processing agreement, standard contractual clauses, or a current list of the providers who touch respondent data, ask through our contact page and we will provide them.

3.What we collect

Account information

When you register we collect your name, email address and a password. You can also register through a supported third party sign-in provider, in which case that provider tells us your name and email address and confirms you own the account. We never receive your password from them.

What you create

Your quizzes, questions, answers, outcomes, images, branding, imported files, settings, and the prompts you give our AI features.

Respondent information

The answers submitted to your quiz, together with the technical records we attach to a response so you can report on it and so we can stop abuse: IP address, approximate location derived from it, browser and operating system, device type and screen size, referring page, and the time and duration of the response. If your quiz asks a respondent for their name or email address, we collect that too, because you asked for it.

Payment information

Card payments are handled entirely by Stripe. We receive a record of the transaction, the last four digits, the card type and the expiry, and the billing details you enter. We never see or store your full card number.

Technical and usage information

Each visit creates a session identifier. We log account creation, sign in, sign out, quiz creation, publishing, updates, archiving, responses received, and plan upgrades and downgrades, along with the IP address, browser and device fingerprint attached to each event. These logs are how we investigate abuse, debug faults and detect fraudulent sign-ups. They are never made public.

Support messages

What you send us through the contact forms, and our replies.

4.Why we use it

We only use personal information for the purposes below. We do not use it for anything unrelated without asking you first.

Where the law where you live requires a legal basis for processing, we rely on performing our contract with you, our legitimate interests in running and securing the platform, your consent where we ask for it, and compliance with legal obligations.

Marketing

We send you service messages you cannot opt out of while you hold an account, such as billing notices, security alerts and notice of changes to these documents. Anything promotional is separate, and every promotional email carries an unsubscribe link that works. We do not sell or rent your email address, and we do not add your respondents to any mailing list.

AI features

When you use an AI feature we send your prompt and the material you point it at to a third party AI provider so it can generate a response. We contract with those providers on terms that do not permit them to use your input or output to train their general purpose models. We do not use your content or your respondents' answers to train our own general purpose models. Short lived logs are kept to detect abuse and debug failures.

5.Cookies, sessions and analytics

We use cookies and similar storage for three things:

• Keeping you signed in and the site working. A session identifier, your sign-in state, and your preferences. The Services do not work without these.
• Preventing repeat and fraudulent responses. Markers that let a quiz recognise a device that has already answered, where the creator has turned that on.
• Understanding how the site is used. We use Google Analytics to see which pages are visited, how people arrive, and where they get stuck. Google sets its own cookies and receives your IP address and browsing activity on our sites, subject to Google's own privacy policy.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using the browser add-on Google publishes for that purpose. Blocking essential cookies will stop you from signing in or saving a quiz.

We do not currently show a cookie consent banner. If you are in a place where the law requires one before non-essential cookies are set, and you embed our widget on your own site, you are responsible for the consent notice shown on that site. See section 14.

6.Advertising on free quizzes

Quizzes published on free accounts may carry advertising. That is how we keep the free tier free, and it is described on our pricing page. Where ads are shown, the ad provider may set its own cookies and collect device and browsing information from the person viewing the quiz, under its own privacy policy.

We do not pass your account details, your quiz content or your respondents' answers to any advertiser. Upgrading to a paid plan removes advertising from your quizzes.

7.Who we share it with

We also disclose information in three other situations:

1. When the law requires it. A court order, subpoena, regulator or law enforcement request that we are legally obliged to answer. Where we are permitted to tell you, we will.
2. To protect people. Where we reasonably believe disclosure is necessary to prevent serious harm, fraud or a crime, or to enforce our Terms of Service.
3. If our business changes hands. If My Plaza Pty Ltd is sold or merged, information may transfer to the buyer, who would be bound by this policy until it gives you notice of any change.

Inside our own business, access to customer information is restricted to the few staff who need it to do their job, and only when they need it. Staff who access data they were not authorised to access face disciplinary action up to dismissal.

8.Sending information overseas

We are an Australian company, but our servers are in the United States. Using the Services means your information and your respondents' answers are stored in and accessed from the United States, and pass through the countries where Cloudflare operates its network. Our AI providers may also process prompts outside Australia.

Before we disclose personal information to an overseas recipient we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, including through the contracts we hold with them. If you need to keep data inside a particular country, tell us through our contact page before you start, because the standard platform cannot do that.

9.How long we keep it, and deleting it

We keep information for as long as your account is open and you need it, and then only for as long as we have a reason to.

• Quizzes and responses stay until you delete them or delete your account.
• Closed or lapsed accounts. You have at least 30 days from the day an account closes to sign in and export your data before we may delete it permanently.
• Backups. Deleted data can persist in encrypted backups until those backups cycle out in the normal course.
• Billing records are kept for as long as Australian tax and corporations law requires.
• Security and audit logs are kept for a limited period so we can investigate incidents.

Deleting your account yourself

You do not need to ask us. Deleting your account removes the information we hold about you and your respondents, and it cannot be undone.

1. Sign in and open your Dashboard.
2. Choose Account from the left side menu.
3. If you have an active subscription, click Cancel on the right side of the page first.
4. With no active subscription you will see a Delete button. Click it to delete the account.

10.How we secure the platform

Security is not a feature we bolted on. The platform has carried customer and citizen data since 2003, and the controls below are the ones that matter most.

Accounts and authentication

Every management and reporting feature requires an authenticated account over an encrypted connection. Passwords are hashed before storage and no plain text password is ever stored, so nobody at Quiz Maker can read yours. Repeated invalid sign-in attempts lock the account, and access is restored by email verification.

We accept whatever password you choose rather than forcing a format, which means the strength of your password is genuinely up to you. Please use at least eight characters mixing upper case, lower case, numbers and symbols, and never reuse a password from another site.

Access control

A sign-in gives access to one account and one account only. No user, and no member of our staff, can reach multiple customer accounts from a single login. Standard and premium accounts have a single role with full edit and reporting rights. Enterprise accounts separate Administrator from Report, so you can give someone results without giving them billing or the ability to change a quiz.

Encryption in transit

Quiz responses and all management traffic are transmitted over TLS using current cipher suites, which we review and update as recommendations change. Our embed code is served over an encrypted connection. If your own website is served over plain HTTP, the connection between your visitor and your site is not encrypted and that is outside our control, so we recommend serving your site over HTTPS.

What the embed does and does not do

Each embedded snippet is unique to your account and to one quiz, and it updates only when you save that project. At no point does our embed code collect information about your website's visitors beyond the quiz they interact with, and it does not read or modify the rest of your page.

Audit logging

We log account creation, sign in, sign out, quiz creation, publishing, updating and archiving, responses received, and plan changes. Logs are retained for investigation and are never published.

Secure development

Security requirements are set before a feature is built, not after. Every change goes through threat modelling, peer code review, automated vulnerability scanning and testing on a separate platform before it reaches production. We engage third parties to assess our security from time to time.

Responsible disclosure

We welcome security testing, and we ask you to tell us before you start so we do not mistake you for an attacker. Report anything you find through our contact page. We will work with you, we will not pursue researchers who act in good faith and give us a reasonable chance to fix the issue, and we ask that you do not access, modify or delete anyone else's data while testing.

11.Our infrastructure

We run dedicated servers rented from Liquid Web, co-located in data centres in Michigan and Arizona in the United States. Those facilities provide 24 hour hardware support, on-site security staff, monitored cameras, redundant power and redundant network capacity. Content delivery and security sit in front of them through Cloudflare.

Code and data are backed up daily and stored offsite. Servers are patched and reviewed on a regular cycle.

Availability is checked by an independent third party service every 15 seconds, and our staff receive automatic alerts for outages and security events so we can respond quickly at any hour. We monitor continuously and we have a long operating record, but we do not promise uninterrupted service, and section 15 of our Terms of Service sets out what we do and do not commit to.

12.If something goes wrong

If a data breach occurs that is likely to result in serious harm, we will assess it promptly and notify the affected individuals and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) requires.

Where you are the controller of the affected respondent data, we will notify you without undue delay and give you the information you reasonably need to meet your own notification obligations, so that you can tell your respondents.

13.Your choices and your rights

You can do most of this yourself from your Dashboard, and we will help with anything you cannot.

• See what we hold. Most of it is visible in your Dashboard. Ask us for the rest.
• Correct it. Update your account details in the Dashboard, or ask us.
• Export it. Download your quizzes and results at any time from the Dashboard.
• Delete it. Delete individual quizzes and responses, or the whole account, as described in section 9.
• Stop promotional email. Use the unsubscribe link in any promotional message.
• Ask us a question about any of it. Through our contact page.

We respond to privacy requests within a reasonable period and normally within 30 days. We may need to verify your identity first, which protects you against someone else asking for your data. We do not charge for a request unless it is repetitive or manifestly excessive, and we will tell you before any charge applies.

Depending on where you live you may have further rights under local law, including the right to object to or restrict certain processing, and the right to receive your data in a portable format. Tell us what you need and we will meet the obligations that apply.

14.If you answered someone else's quiz

If you filled in a quiz and want your answers changed or removed, the person or organisation that made the quiz controls that data, not us. Go to them first. Their identity is usually shown on the quiz, in the branding, or on the site where you found it.

If you cannot identify or reach them, contact us through our contact page with the link to the quiz and we will pass your request on to the account holder and help where we reasonably can.

If a quiz is unlawful, deceptive, impersonating someone, or otherwise breaches our rules, report it through the report malicious content form. We review reports and can remove content or close accounts. Section 11 of our Terms of Service explains how that process works.

15.Children and young people

Accounts are for people aged 18 and over. Anyone younger may use the Services only through an account held and supervised by a parent, guardian, teacher or school.

Quizzes are widely used in classrooms, so respondents are often children. If you publish a quiz that children are likely to answer, you are responsible for any parental or school consent the law requires, for explaining what you collect in language they can understand, and for collecting the minimum you actually need. Section 4 of our Terms of Service sets this out in full.

We do not knowingly hold accounts for people under 18. If you believe a child has registered one, tell us through our contact page and we will close it and delete the information.

16.Complaints, changes and contact

If you think we have mishandled your information

Tell us through our contact page and set out what happened. We will acknowledge your complaint, investigate it, and write back to you with our findings and what we intend to do. Most matters are resolved this way.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au, which regulates privacy in Australia, or to the privacy regulator where you live if that is somewhere else.

Changes to this policy

We update this policy when our practices, our providers or the law change. If a change materially affects how we handle your personal information, we will give you at least 30 days notice by email or in the product before it takes effect. The date at the top of this page shows when it was last updated, and earlier versions are available on request.