Privacy policy

💡 Template — have this reviewed by a lawyer before launch.

PubquizTV is built to need as little data as possible. Guests do not create an account, we use no analytics or advertising cookies, and we never sell data. This policy explains what we do process, why, and what your rights are.

1. Who is responsible

[Company name] ([Street 1, 1234 AB City, Netherlands], Chamber of Commerce number [KvK number]) is responsible for the processing described here. For all privacy questions, email hello@pubquiztv.app.

There are two roles, and we want to be clear about them:

• •For account, payment and security data we are the controller: we decide why and how this data is processed.
• •For the content of a party — questions, photos, audio, and the team names and answers of guests — the host decides what goes in. We store and show this content only to run the party for the host, as a service provider (comparable to a processor). The host is responsible for what they add, for example photos of guests.

Most parties are private, and privacy law then usually does not apply to the host personally. If you use PubquizTV for work or for an organisation and need a data processing agreement, contact us.

2. What we process and why

Hosts (account holders)

• •Account: email address, optional name and language. Purpose: logging in, providing the service and sending service emails (such as login codes and payment confirmations). Legal basis: performance of the contract (art. 6(1)(b) GDPR).
• •Newsletter: your email address, only if you opt in. You can unsubscribe at any time via the link in every newsletter. Legal basis: consent (art. 6(1)(a) GDPR).
• •Parties: titles, questions, uploaded photos and audio, team names, answers and scores. Purpose: building and playing your party. Legal basis: performance of the contract.
• •Payments: amount, date, product and Stripe reference numbers. We never see your card details. Purpose: handling payments and bookkeeping. Legal basis: performance of the contract and a legal obligation under tax law (art. 6(1)(c) GDPR).
• •AI question writer (optional): if you use it, the facts you type in the interview are sent to Anthropic to generate questions. Only enter information you are comfortable sharing for this purpose. Legal basis: performance of the contract.

Guests

Guests do not need an account and do not give an email address. We only process:

• •the team name and emoji they choose;
• •a random team ID, stored in their browser (localStorage and a first-party cookie) for up to one year, so they stay in their team when they reload the page;
• •their answers and scores in the party.

Legal basis: the legitimate interest of the host and of us in running the quiz the guests join (art. 6(1)(f) GDPR). Team names and answers are visible to the host and on the big screen. Tip for guests: choose a team name that does not reveal more about you than you want.

Everyone

• •Security: IP addresses are processed briefly to protect PubquizTV against abuse and overload (rate limiting). We store them only in hashed form and for no more than about 24 hours. Legal basis: our legitimate interest in a secure service (art. 6(1)(f) GDPR).

We do not use your data for advertising, we do not sell it and we do not build profiles.

3. Who receives data

We use a small number of service providers (processors) who process data only on our instructions:

• •Vercel Inc. — hosting of the website and app, and file storage for uploads (Vercel Blob).
• •Upstash — database (Redis). We choose an EU region where available.
• •Stripe Payments Europe Ltd. — payments and invoices. For some payment data (for example to prevent fraud and to meet financial legal obligations) Stripe is an independent controller, and Stripe's own privacy policy applies.
• •Resend — sending transactional emails, such as login codes and payment confirmations.
• •Anthropic — only if you use the optional AI question writer: the facts you type in the interview are sent to generate questions. By default, Anthropic does not use data sent through its API to train its models.

We do not share data with anyone else, unless the law requires us to, for example at the request of a competent authority.

4. Transfers outside the EU

Some of our service providers are US companies, so personal data may be processed in the United States. We only allow this on the basis of the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, which ensure an adequate level of protection.

5. How long we keep data

• •Account: until you delete it. You can delete your account yourself on your account page; your account and all parties you own are then deleted immediately (except payment records, see below). Copies in our backups are overwritten within 30 days.
• •Unlocked parties: editable during the paid access period. After that, the party is read-only and downloadable for 90 days, and then deleted, including questions, uploads, teams and answers.
• •Drafts that were never unlocked: deleted after 12 months of inactivity.
• •Guest team ID in the browser: up to one year. Guests can remove it themselves by clearing their browser data.
• •Newsletter: until you unsubscribe.
• •Payment records: 7 years, because Dutch tax law requires it (fiscale bewaarplicht). We keep no more personal data than needed for that.
• •Hashed IP addresses: at most about 24 hours.

6. Security

We take appropriate technical and organisational measures to protect data, such as encrypted connections, login without passwords, a secure (httpOnly) session cookie, hashing of IP addresses and access only for people who need it. If a data breach occurs that poses a risk to you, we inform you and the supervisory authority as the law requires.

7. Your rights

You have the right to:

• •access the data we hold about you;
• •rectification of incorrect data;
• •erasure of your data — you can also delete your account yourself at any time;
• •restriction of processing;
• •data portability — you can download a backup of your parties;
• •object to processing based on legitimate interest;
• •withdraw your consent at any time, for example for the newsletter. This does not affect processing that took place before.

To use your rights, email hello@pubquiztv.app. We respond within one month. We may ask you to confirm your identity. Guests can contact the host of the party or email us.

Not happy with how we handle your data? Please tell us first, so we can try to put it right. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If you live in Belgium, you can also turn to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données); elsewhere in the EU, to the supervisory authority of your country.

8. No automated decision-making

We do not make decisions about you based solely on automated processing, and we do not use profiling.

9. Children

Accounts are not intended for children under 16. Guests can be any age, because they only enter a team name. Hosts: please do not add children's full names or photos without their parents' consent.

10. Cookies

We only use functional cookies and no analytics or advertising cookies. Read more in our cookie policy.

11. Changes

We update this policy when our service or the law changes. We inform account holders of material changes by email. The date of the latest version is shown on this page.

12. Language

This privacy policy is available in Dutch, English, French and German. In case of differences the Dutch version prevails.

Contact

Questions about privacy? Email us at hello@pubquiztv.app.