Privacy Policy

YogiQuiz is the data controller for your personal data. For any questions regarding your personal data, you can contact us via the contact form available on the Platform.

We collect the following data: **2.1. Registration Data** • Email address • Username (optional) • Password (encrypted) **2.2. Usage Data** • Quiz results (score, answers, date) • Earned badges • Category progress • Completed quiz history • Daily quiz streaks **2.3. Contact Data** • Name and email (contact form) • Subject and message • Submission date and time **2.4. Technical Data** • IP address (for security and anti-spam) • Browser type and operating system • Pages visited and visit duration • Cookies (see dedicated section) **2.5. Correction Suggestions** • Suggestion content • Related question • Submission date

**3.1. Contract Performance (art. 6.1.b GDPR)** • Account creation and management • Quiz service provision • Progress tracking **3.2. Consent (art. 6.1.a GDPR)** • Non-essential cookies • Marketing communications (if consented) **3.3. Legitimate Interest (art. 6.1.f GDPR)** • Platform improvement • Fraud prevention and security • Anonymized statistical analysis **3.4. Legal Obligation (art. 6.1.c GDPR)** • Connection data retention (French law)

Your personal data is accessible only to: • Our technical team (limited and secure access) • Supabase (database hosting - AWS eu-west-1, Ireland, EU) • Vercel (web application hosting - GDPR guarantees via Standard Contractual Clauses) We do not sell, rent, or share your data with third parties for commercial purposes.

• **Account data**: Until account deletion + 30 days • **Quiz results**: Until account deletion • **Contact messages**: 3 years from last interaction • **Connection logs**: 12 months (legal obligation) • **Cookies**: See cookies section

Under GDPR, you have the following rights: **6.1. Right of Access (art. 15)** You can request a copy of your personal data. **6.2. Right to Rectification (art. 16)** You can correct inaccurate data from your profile. **6.3. Right to Erasure (art. 17)** You can delete your account and data at any time. **6.4. Right to Restriction (art. 18)** You can restrict data processing in certain cases. **6.5. Right to Portability (art. 20)** You can receive your data in a structured format. **6.6. Right to Object (art. 21)** You can object to data processing for certain purposes. **6.7. Right to Withdraw Consent** You can withdraw consent at any time. **To exercise your rights**, contact us via the contact form.

**7.1. Essential Cookies (mandatory)** • User session (authentication) • Language preferences • CSRF security These cookies are necessary for Platform operation. **7.2. Analytics Cookies (with consent)** • Anonymized visit statistics • User experience improvement **7.3. Cookie Management** You can manage cookie preferences through your browser settings.

We implement technical and organizational security measures: • SSL/TLS encryption for all communications • Encrypted passwords (bcrypt) • Secure authentication via Supabase Auth • Restricted data access (least privilege principle) • Regular backups • Attack protection (rate limiting, honeypot) • Suspicious access monitoring

Your personal data (profiles, quiz results, badges) is hosted in a Supabase database located within the European Union (AWS eu-west-1, Ireland). The web application is hosted on Vercel (distributed infrastructure). In compliance with GDPR, Vercel has implemented appropriate safeguards via Standard Contractual Clauses from the European Commission. No transfer of your personal data outside the EU is performed without GDPR guarantees.

Our service is accessible to users aged 13 and above. Minors under 18 must obtain parental consent before creating an account. We do not knowingly collect data from children under 13. If you believe a child has provided us with data, contact us immediately.

We may modify this Privacy Policy at any time. Significant changes will be notified by email or via Platform notification. The last update date is shown at the top of this page.

If you believe your rights are not respected, you can file a complaint with the CNIL (French Data Protection Authority): **CNIL** 3 Place de Fontenoy TSA 80715 75334 PARIS CEDEX 07 Phone: +33 1 53 73 22 22 Website: www.cnil.fr

For any questions regarding protection of your personal data, contact us via the contact form available on the Platform. We commit to responding to your requests within 30 days.