Quizly - Privacy Policy

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Jürgen Malinowski
Grüner Jäger 1
38159 Vechelde
Germany

2. Hosting

The frontend of this website is hosted by ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. As part of the hosting service, technically necessary connection and log data may be processed, including the IP address, time of access, requested content, and technical information about the browser used. This processing is necessary to provide and secure the website.

The backend of the application is operated on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. In particular, user accounts, authentication data, and stored quiz data are processed there. Data processing agreements pursuant to Art. 28 GDPR are in place with the hosting providers.

3. Registration and User Account

During registration, a username, email address, and password are processed. The password is not stored in plain text. The data is required to provide the user account and enable the use of Quizly's features.

The legal basis is Art. 6(1)(b) GDPR.

4. Login and Technically Necessary Cookies

Quizly uses technically necessary authentication cookies for login. An access token and a refresh token are stored as HttpOnly cookies. These cookies are used exclusively for login and authentication and are not used for advertising or analytics purposes.

The storage is necessary to provide the digital service explicitly requested by the user. It is based on Section 25(2)(2) TDDDG and Art. 6(1)(b) GDPR.

5. Creation and Storage of Quizzes

To create a quiz, the user provides a YouTube URL. The backend temporarily downloads the audio data required for processing. The downloaded audio file is deleted after the quiz has been created.

The audio file is transcribed using Whisper directly on the backend server. The resulting transcript is then transmitted to Google's Gemini API to generate the quiz questions.

The completed quiz, including its title, description, original YouTube URL, questions, answer options, and correct answers, is assigned to the respective user account and stored on the backend server.

6. Google Gemini API

Quizly uses the paid Gemini API to automatically generate quiz questions. The contractual partner for Gemini API Paid Services in the European Economic Area is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.

The transcript generated from the selected video is transmitted to Google. According to the applicable Gemini API terms, Google does not use prompts and generated responses from Paid Services to improve its products. Google may, however, log this data for a limited period for the detection and prevention of misuse, the security of its services, and required legal or regulatory disclosures.

Google states that such data may temporarily be stored or cached in countries in which Google or its service providers maintain facilities. Where data is transferred to third countries, Google's applicable data protection and transfer mechanisms apply.

The legal basis for processing in connection with the quiz creation requested by the user is Art. 6(1)(b) GDPR.

7. Embedded YouTube Videos

Quizly can display the YouTube video from which a quiz was created. The YouTube player is not loaded automatically when the quiz overview page is opened. It is loaded only after the user actively selects the "Load YouTube video" button.

The embedded player uses YouTube's privacy-enhanced mode via the youtube-nocookie.com domain. According to YouTube, views made through this mode are not used to personalize the user's browsing experience on YouTube or to personalize advertising outside the website.

When the player is activated, the browser establishes a connection to Google services. In this context, technical data such as the IP address, browser and device information, date and time of the request, and referrer information may be transmitted to Google. Google may also use cookies or similar technologies in connection with YouTube, depending on the user's settings and the functions used.

For users in the European Economic Area, Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The YouTube player is activated only after the user's voluntary action. Where consent is required for the processing of personal data or for storing or accessing information on the user's device, the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

8. Server and Security Logs

When accessing and using the application, technically necessary log data may be processed. This may include the IP address, time of access, requested resource, HTTP status, and technical connection information. The processing serves the secure and reliable operation of the application as well as the detection of misuse and attacks.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable operation of the application.

9. Storage Duration

User account and quiz data are generally stored for as long as they are required to provide the application. Individual quizzes can be deleted. Deletion of a user account and the associated personal data can be requested via the contact address stated above, unless statutory retention obligations require continued storage.

Temporarily downloaded audio files are deleted after quiz creation has been completed. Technical log data is stored only for as long as necessary for operation, security, and error analysis.

10. Recipients of Personal Data

In connection with the operation of Quizly, personal data may in particular be processed by ALL-INKL.COM as the frontend hosting provider, Hetzner Online GmbH as the backend hosting provider, Google Cloud EMEA Limited in connection with the Gemini API, and Google Ireland Limited when a YouTube video is actively loaded.

11. Rights of Data Subjects

Subject to the applicable legal requirements, you have in particular the right to obtain information about your personal data, to have inaccurate data corrected, to request deletion or restriction of processing, to data portability, and to object to processing based on legitimate interests.

Where processing is based on your consent, you may withdraw your consent at any time with effect for the future.

To exercise your rights, you can contact web@juergen-malinowski.de.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

13. Automated Decision-Making

Automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning users or similarly significantly affects them does not take place.

14. Version of this Privacy Policy

Last updated: August 2026