Quizgecko

GDPR overview

GDPR implementation is documented rather than merely asserted. Version Zero Limited, of 86-90 Paul Street, London EC2A 4NE (company number 13849704), states compliance with the GDPR, the UK GDPR and the CCPA. Its privacy policy, effective 17 December 2025, sets out rights of access, rectification, erasure, portability, objection, restriction and withdrawal of consent, all exercised through legal@quizgecko.com. A public Data Processing Addendum casts Quizgecko as processor, names twelve subprocessors with a link to each one's own agreement, and commits to breach notification without undue delay, audit rights and assistance with impact assessments. International transfers rely on the European Commission's 2021 Standard Contractual Clauses together with the UK International Data Transfer Addendum. Two gaps stand out: no Article 27 EU representative is named anywhere, although the company is established outside the European Union, and no data protection officer is designated.

Who owns the data?

Under the terms of service you keep full ownership of everything you create or upload: quizzes, questions, uploaded documents and teaching material. In exchange, Version Zero Limited takes a non-exclusive, worldwide, royalty-free licence to host, store, use, display, reproduce, modify, adapt, edit, publish and distribute that content in order to operate and improve the service. Paid subscribers keep their work private unless they deliberately switch sharing on; on free accounts, uploaded content may be made available to other users of the platform. Every account, paid or free, can delete its content at any time. Personal data collected is limited to name and email address, with billing addresses handled by Stripe rather than retained by Quizgecko.

Reuse rights

You may reuse anything you generate without asking permission. The quizzes, flashcards, notes and podcasts you produce stay yours: you can rewrite them, print them as worksheets, embed them on your own website, share them by direct link, invite students into a classroom or export them to a learning management system such as Kahoot or Canvas. What the terms restrict is not reuse of your own output but abuse of the platform, so commercial exploitation of the site itself requires Quizgecko's approval, and scripted extraction, data mining and bulk retrieval are forbidden outside the business API. In the opposite direction, what Quizgecko may do with your content depends on your plan: paid subscribers are told their material will not be used to train the AI models, whereas free accounts are told it may be. Be aware that the homepage FAQ states without qualification that user data is never used for model training, a claim broader than what the terms of service actually undertake.

Data retention & training

Hosting summary

Quizgecko names Hetzner as its primary hosting provider and describes it as ISO 27001 certified, with Cloudflare handling content delivery and DDoS protection, Google Cloud supplying cloud infrastructure and AI services, OpenAI providing AI services and SolarWinds Papertrail managing logs. The country in which data physically sits is never stated anywhere on the site, so the hosting location itself remains undisclosed. What is committed contractually is a perimeter rather than a place: the data processing addendum undertakes not to transfer personal data outside the United Kingdom or the European Economic Area except to countries recognised as offering adequate protection, under appropriate safeguards such as Standard Contractual Clauses, or with the customer's prior written consent. For transfers to the United States, subprocessors are expected to be certified under the EU-U.S. Data Privacy Framework where applicable, with additional Schrems II measures. On the technical side, data in transit is encrypted with TLS 1.2 or higher, passwords are hashed with bcrypt, access is restricted by role-based controls with two-factor authentication, and systems are monitored around the clock.