Data processing agreement
Last changed 2 November 2026
Draft: this text is being reviewed and may change before it applies.
Who this is for
This agreement (the "DPA") is for a company, school, club or other organisation (you, the controller) that runs quiz nights on Kvisso for its own people. When your hosts run a game, we (Kvisso, the processor) process personal data on your behalf: the players' nicknames, answers and scores, and anything personal your hosts put in a quiz. The GDPR (art. 28) asks for an agreement like this one, and here it is.
It is part of our terms for organisation and education accounts and takes effect when you make or use such an account. Where this DPA and the terms disagree about personal data, this DPA wins.
If you need a signed copy, write to login@kvisso.com.
For the host's own account (their name, email, plan and payments) we are the controller ourselves; the privacy notice covers that.
What we process, and why
| What | Details |
|---|---|
| Purpose | Running your quiz games: showing questions on the TV, taking answers from phones, marking, scores and results for your hosts |
| People | Players who join your games; anyone your hosts name or show in a quiz (for example in a picture) |
| Personal data | Nickname and emoji, team, answers, scores, chat lines (if the host turns chat on), a selfie (only if the player takes one); pictures and sounds your hosts upload |
| Special categories | None asked for. Don't put health, religion or similar data in quizzes; safe mode (on for school accounts) keeps names and chat in check |
| How long | While the game is kept: until your host deletes it or the account. Selfies live only in the server's memory while the game runs |
| Where | In the EU/EEA; see the subprocessors below for the few exceptions and how they are covered |
Players never make an account with us, and we never ask them for an email, a phone number or their full name.
What we promise
We will:
- Process the data only to run the service for you, as the terms and your hosts' use of it instruct, and tell you if we think an instruction breaks data protection law.
- Keep it confidential: only people who need to (today, the founder) can reach production data, and they are bound to confidentiality.
- Keep it secure (art. 32), as listed under Security.
- Use only the subprocessors listed below. We tell you at least 30 days before adding or replacing one (on this page and by email to the account), and you may object; if we can't meet the objection, you can end the agreement and get a refund of what you paid for the time left.
- Help you answer the people whose data it is: your hosts can download (My account → Your data) and delete games and quizzes themselves, and we help with anything they can't.
- Tell you without undue delay, and at the latest within 48 hours of learning of it, about a personal data breach that touches your data, with what we know and what we are doing about it.
- Help you with impact assessments and questions from a data protection authority, where they concern our service.
- When the agreement ends, delete your data: deleting the account erases it after a 14-day grace period (or at once, if you choose), and copies in our backups are gone within 30 days after that. Download what you want to keep first.
- Give you the information you need to check that we keep this agreement, and answer reasonable written questions. An on-site audit, if you need one, is at your cost and with 30 days' notice.
Security
- Everything travels over HTTPS (TLS); passwords are stored only as Argon2 hashes.
- Only people in a game can reach it: players with that game's code and seat, the TV with that game's key, and the host who owns it. Each host sees only their own quizzes, files and games.
- Pictures and sounds are stored under long random names and handed only to the host and that game's screens.
- Backups are encrypted and kept for at most 30 days; a restore is tested regularly.
- Login and join attempts are rate-limited; error reports leave out passwords and links that carry tokens.
- Dependencies are kept up to date, and changes are tested and reviewed before they are released.
Moving data out of the EU/EEA
We keep data in the EU/EEA where we can. Where a subprocessor is an American company or may reach data from the USA, the transfer is covered by the EU–US Data Privacy Framework and/or the EU's standard contractual clauses, as listed below.
Subprocessors
| Who | What for | Where the data is | Covered by |
|---|---|---|---|
| Fly.io, Inc. | Runs the app, its database and uploaded files | EU (machines and volumes in an EU region) | Fly.io's DPA; standard contractual clauses |
| Cloudflare, Inc. | Holds the backups (R2); DNS | EU (R2 with EU jurisdiction) | Cloudflare's DPA; Data Privacy Framework; standard clauses |
| Functional Software, Inc. (Sentry) | Error reports, so we can fix faults | EU (Frankfurt) | Sentry's DPA; Data Privacy Framework; standard clauses |
| PostHog, Inc. | Counting visits and sign-up steps, without cookies | EU (Frankfurt) | PostHog's DPA; standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Sending account emails to hosts | USA | Resend's DPA; Data Privacy Framework; standard clauses |
| Stripe Payments Europe, Ltd. | Taking payments from hosts | EU, with Stripe's group companies | Stripe's DPA; standard contractual clauses |
Players' data reaches only the first three: the app with its database and files, the backups, and (rarely) an error report about a game. Resend and Stripe see only the host's own account details.
Liability and how long this lasts
This DPA lasts as long as you use Kvisso and until your data is deleted as described above. Liability follows the terms. Norwegian law applies, and disputes go to the Norwegian courts.
Contact
Kvisso
- Email: login@kvisso.com