Privacy Policy

ShellRick Tech Pty (Ltd) ("we", "our", "us") operates the website at https://www.quizbru.co.za (the "Service"). We are based in South Africa and are subject to the Protection of Personal Information Act 4 of 2013 (POPIA).

Questions about this policy can be directed to legal@quizbru.co.za.

• Account data: your email address, collected when you register. Your password is never stored on our own servers — it is created, verified and stored directly by AWS Cognito (see section 6).
• Quiz content: quiz titles, descriptions, questions and answers you create.
• Live session data: player nicknames and answers submitted during live quiz sessions. This data is linked to the session code, not to a registered account.
• Usage data: IP addresses, browser type, pages visited and referring URLs, collected automatically by our hosting provider (Vercel).
• Advertising data:Google AdSense may set cookies and collect device identifiers to serve personalised ads. See Google's Privacy Policy for details.

• To create and manage your account.
• To provide the quiz creation and live-session features.
• To display relevant advertisements via Google AdSense.
• To analyse site usage and improve the Service.
• To respond to support queries.

We do not sell your personal information to third parties.

We process your personal information on the following grounds:

• Contract performance: processing necessary to provide the Service you signed up for.
• Consent: for advertising cookies, where you have accepted our cookie notice.
• Legitimate interest: for security, fraud prevention and service improvement.

We use the following types of cookies:

• Strictly necessary: session authentication cookie set by NextAuth. Cannot be disabled without breaking login.
• Advertising: Google AdSense cookies to serve and measure personalised ads (only set after consent).

You can withdraw consent at any time by clearing your browser cookies and declining on the next visit.

To learn more about how Google uses data collected through our site, see How Google uses data when you use our partners' sites or apps.

We share personal information only with:

• Amazon Web Services, Inc. (AWS Cognito) — manages your account credentials (email and password) and authenticates you when you sign in.
• Vercel Inc. — hosting and edge network.
• Neon Technologies Inc. — database hosting for your quizzes, questions and live session data.
• Google LLC — AdSense advertising.

All processors are contractually bound to handle data in accordance with applicable privacy law.

International transfers:your account credentials are processed and stored by AWS Cognito in the af-south-1 region (Cape Town, South Africa), so this data does not leave South Africa. Our database (Neon, on AWS infrastructure) and application servers (Vercel serverless functions) run in Frankfurt, Germany — the closest available region to South Africa for both providers — and host your quiz content and live session data. Google's AdSense infrastructure operates globally and may process data outside South Africa as well. Germany and the European Union are subject to the General Data Protection Regulation (GDPR), which the Information Regulator recognises as providing a level of protection substantially similar to POPIA. These transfers are therefore permitted under section 72(1)(a) of POPIA.

Account data is retained for as long as your account is active. You may delete your account at any time from your Account settings page, or by emailing legal@quizbru.co.za. Deleting your account also deletes your credentials from AWS Cognito. Live session data (player nicknames and answers) is retained for 90 days and then purged automatically by a scheduled process.

You have the right to:

• Access the personal information we hold about you — visit your Account settings or email us.
• Export a copy of your data in portable JSON format from your Account settings.
• Delete your account and all associated data from your Account settings. Deletion is immediate and irreversible.
• Correct inaccurate information — email us at legal@quizbru.co.za.
• Object to processing based on legitimate interest.
• Lodge a complaint with the Information Regulator of South Africa.

For requests we cannot fulfil self-service, email legal@quizbru.co.za. We will respond within 30 days.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Regulator and affected individuals without unreasonable delay, as required by section 22 of POPIA. Notification will be sent to the email address associated with your account.

We do not store your password ourselves — it is created, verified and stored directly by AWS Cognito, which applies its own industry-standard encryption and security controls. All data in transit is encrypted via HTTPS. We apply industry-standard security controls throughout the rest of the Service, but no transmission over the internet is 100% secure.

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have done so, please contact us and we will delete the data promptly.

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision. Continued use of the Service after changes constitutes acceptance.