QuizLift Privacy Policy

1. Scope and Processing Roles

This policy applies to information processed through QuizLift's Shopify app, merchant-facing features, published quizzes, integrations, and related support and operational services.

For shopper quiz submissions, the Shopify merchant generally decides why and how information is collected. The merchant generally acts as the controller or business, and QuizLift generally processes the information on the merchant's behalf as a processor or service provider. QuizLift may act as an independent controller for limited information used for merchant accounts, support, security, billing, fraud prevention, and legal compliance.

2. Information QuizLift Processes

Merchant and shop information

When a merchant installs or uses QuizLift, the app may process:

• Shopify store domain and shop identifiers
• App installation, authentication, and authorization information
• Subscription, plan, billing, and usage-limit status
• Quiz configurations, versions, draft content, and design settings
• Shopify product references selected for recommendations
• Integration settings and operational application activity
• Merchant support communications and related contact information

Shopper quiz and lead information

Standard quizzes can operate without collecting a shopper's email address. When a merchant adds QuizLift's native email-capture block, or when a shopper otherwise interacts with a published quiz, QuizLift may process and store:

• Email address, when submitted by the shopper
• The shopper's marketing-consent choice
• Quiz, quiz-version, node, block, session, and submission identifiers
• Quiz questions viewed and answers selected
• Quiz progress, completion, result, and product-recommendation context
• Quiz event, interaction, submission, session, and capture timestamps

Merchant AI inputs

If a merchant uses optional AI quiz-generation or refinement features, QuizLift may process merchant prompts, recent AI conversation messages, existing or compact quiz structure, quiz draft content, design configuration, and merchant-attached reference images. These are merchant-provided AI inputs, not shopper quiz submissions.

3. Shopify Access and Customer Synchronization

QuizLift uses Shopify's Admin GraphQL API and currently requests the following Shopify access scopes:

• read_products, to read product information used in quiz results and recommendations
• write_app_proxy, to serve QuizLift functionality through the merchant's storefront
• write_customers, to create or update a Shopify Customer when a shopper submits an email through a native QuizLift email-capture block

Creating or updating a Shopify Customer does not itself grant email-marketing consent. Information held by Shopify is also subject to the merchant's Shopify configuration and Shopify's applicable privacy terms.

4. How Information Is Used

QuizLift processes information for documented purposes that include:

• Operating, securing, maintaining, and supporting QuizLift
• Saving, previewing, and publishing merchant-created quizzes
• Applying deterministic quiz routing and conditional logic
• Producing product recommendations from quiz answers
• Capturing leads when configured by the merchant
• Creating or updating Shopify Customers from submitted emails
• Providing quiz and funnel analytics to the relevant merchant
• Operating merchant-authorized Klaviyo synchronization
• Generating or refining merchant quiz drafts through optional AI features
• Enforcing subscriptions and usage limits and processing Shopify billing
• Preventing fraud, troubleshooting problems, and complying with law

QuizLift does not sell merchant or shopper personal information and does not use shopper information for cross-context behavioral advertising.

5. Email Capture and Marketing Consent

Email capture and email-marketing consent are separate. QuizLift records whether a shopper explicitly selected the consent checkbox configured by the merchant. If the merchant makes consent mandatory, the form cannot be submitted until that checkbox is selected.

A submission without marketing consent may still be stored as a QuizLift lead, used to create or update a Shopify Customer, and synchronized as a Klaviyo profile when the merchant has enabled that integration. It must not be treated as a marketing subscription. A shopper is subscribed to the merchant-selected Klaviyo list only when the shopper has given explicit marketing consent.

Merchants are responsible for presenting appropriate consent language, identifying their lawful basis for marketing, and honoring withdrawals or other consent choices. Shoppers can withdraw marketing consent by contacting the relevant merchant or using any unsubscribe method supplied by that merchant or its messaging provider.

6. Optional Klaviyo Integration

Klaviyo is an optional integration controlled by the merchant. When enabled, QuizLift may send Klaviyo the shopper's email address, consent status, quiz and session identifiers, quiz name, question-and-answer data, quiz result and recommendation context, capture timestamp, and related profile or custom properties.

QuizLift creates or updates a Klaviyo profile and subscribes that profile to the merchant-selected list only when explicit marketing consent exists. The merchant decides whether synchronization is enabled and which Klaviyo list is used.

QuizLift stores the OAuth connection credentials or tokens and integration metadata needed to operate the merchant-authorized Klaviyo connection.

Data already delivered to Klaviyo is controlled by the merchant in Klaviyo and is not automatically erased merely because the merchant disables or disconnects the QuizLift integration. The merchant is responsible for managing deletion and retention in its Klaviyo account.

7. Optional AI Functionality

QuizLift offers merchant-facing AI features that can generate or refine quiz drafts. When a merchant uses these features, QuizLift may send the configured AI provider, currently DeepSeek, merchant prompts, recent AI conversation messages, an existing or compact quiz structure, quiz draft content, and design configuration needed to respond to the merchant's request.

When a merchant explicitly attaches reference images to an AI generation or refinement request, QuizLift may temporarily store those images in Amazon Web Services S3 and transmit them to DeepSeek together with the merchant's prompt and relevant quiz draft context.

QuizLift does not intentionally send shopper email addresses, QuizLift lead records, or other shopper personal data to the AI provider for quiz generation or refinement. Merchants should not place shopper personal data in AI prompts, quiz drafts, or reference materials.

8. Quiz Analytics and Recommendations

QuizLift uses random or pseudonymous session identifiers to measure quiz use. A session is counted when a shopper starts or interacts with a quiz; merely loading a page containing a QuizLift quiz does not by itself count as a quiz session.

Analytics may include starts, completions, node progression, result views, product clicks, add-to-cart events, and similar quiz interactions. These analytics are made available to the merchant whose quiz the shopper used.

Shopper recommendations use answers and deterministic routing configured by the merchant. AI helps merchants generate or refine quiz drafts; it is not used with shopper personal data to make decisions that produce legal or similarly significant effects. QuizLift therefore does not currently perform legally significant automated decision-making about shoppers.

9. Service Providers and Disclosures

QuizLift shares information only as needed for the purposes described in this policy, at the merchant's direction, or where required by law. Recipients may include:

• Shopify, for app installation, Admin GraphQL API access, customer synchronization, storefront app-proxy functionality, and billing
• Render, for QuizLift application hosting
• PostgreSQL database infrastructure, for QuizLift application, merchant, quiz, lead, and analytics data
• Amazon Web Services S3, for merchant-uploaded images and supported assets
• Klaviyo, only when the merchant connects and enables the integration, for profile and consent-aware list synchronization
• DeepSeek, when the merchant uses optional AI quiz-generation or refinement features
• Legal or regulatory authorities when disclosure is required by law, or parties necessary to protect the security, rights, or integrity of QuizLift and its users

10. Data Retention and Deletion

• Raw quiz analytics events and sessions: retained for 90 days.
• Shopper leads: email addresses, consent records, and answer snapshots are retained for 365 days from collection, unless deleted earlier through a valid request or shop deletion.
• Temporary Shopify customer-data request exports: retained for 30 days and then expired.
• Protected-customer-data access audit records: retained for 365 days.
• Klaviyo connections: OAuth credentials and integration metadata are retained until disconnection, authorization revocation, or shop deletion.
• Merchant-uploaded assets: retained until removed by the merchant or deleted during shop redaction.

Narrow records may be retained when required for legal, billing, accounting, fraud-prevention, or security purposes. Encrypted provider backups follow the relevant infrastructure provider's controlled backup and deletion lifecycle; QuizLift does not state a fixed backup-retention period here.

11. Privacy Rights

Depending on applicable law, a shopper or merchant may have rights to request access, correction, deletion, restriction of or objection to certain processing, and a portable copy of applicable personal information. Shoppers may also withdraw marketing consent.

Because the merchant generally controls the quiz and determines its purpose, shoppers should normally contact that merchant first. Merchants and shoppers may also contact QuizLift using the address in the Contact section. QuizLift will take reasonable steps to verify and process requests with the relevant merchant and Shopify as required.

12. Shopify Privacy Requests

QuizLift supports verified privacy and data-protection requests received through Shopify or the published privacy contact:

• customers/data_request creates a tenant-scoped JSON export that is available only to an authenticated merchant administrator and expires after 30 days.
• customers/redact deletes matching QuizLift leads, consent data, answer snapshots, associated delivery records, and temporary privacy exports.
• shop/redact deletes the shop's uploaded Amazon S3 assets and tenant database records.

Information already transferred to merchant-controlled systems such as Klaviyo is not necessarily deleted by QuizLift's webhook processing and may require deletion by the merchant in that system.

13. Security

QuizLift uses safeguards designed to protect information from unauthorized access, alteration, disclosure, or destruction. These safeguards include HTTPS/TLS for data in transit, encryption at rest provided by managed infrastructure, application-level encryption for Klaviyo OAuth credentials, tenant-scoped authorization, protected-data access auditing, automated retention cleanup, least-privilege access policies, data-loss-prevention procedures, and incident-response procedures.

QuizLift does not claim that its safeguards eliminate all risk and does not claim any security certification through this policy. No method of transmission or storage can be guaranteed to be completely secure.

14. International Processing

QuizLift and its service providers may process information in countries other than the country where a merchant or shopper is located. Where applicable law requires safeguards for an international transfer, QuizLift will use appropriate safeguards.

15. Children's Privacy

QuizLift is provided to Shopify merchants, and merchants control the audience, content, and placement of their quizzes. QuizLift does not knowingly use its standard quiz functionality to collect personal information from children in violation of applicable law.

A parent, guardian, merchant, or other authorized person who believes a child's information was submitted improperly can contact the relevant merchant or QuizLift to request review and removal.

16. Merchant Data Processing Terms

For shopper information processed through merchant-configured quizzes, the merchant generally acts as the controller or business and QuizLift generally acts as the processor or service provider. QuizLift processes that information according to the merchant's instructions.

By installing or using QuizLift, the merchant instructs QuizLift to perform the processing required for the merchant-configured features described in this policy. QuizLift limits that processing to providing, securing, supporting, and legally operating the service.

QuizLift uses Shopify, Render, PostgreSQL infrastructure, Amazon Web Services S3, Klaviyo when enabled by the merchant, and DeepSeek when optional AI features are used as subprocessors or service providers for the purposes described in this policy.

QuizLift assists with access and deletion requests through Shopify's mandatory privacy webhooks and applies the documented retention, deletion, confidentiality, access-control, and security measures described in this policy.

Merchants remain responsible for appropriate notices and consent language, lawful marketing activity, responding to shoppers where required, and their configurations and downstream data in Shopify and Klaviyo.

These published Merchant Data Processing Terms form part of the data-processing terms governing a merchant's use of QuizLift. They do not state or imply that QuizLift and the merchant have signed a separate data processing agreement.

17. Changes to This Policy

QuizLift may update this Privacy Policy to reflect changes to the service, providers, legal requirements, or business practices. The revised policy will be published on this page with an updated date.

18. Contact

For privacy questions, verified requests, consent concerns, or children's-data removal requests, contact: