What we do with data — and how to check it

Platform

The application and database run on Supabase (managed PostgreSQL, auth, storage, edge functions) on AWS infrastructure. The website and frontend are delivered through Cloudflare Pages, which holds the program files only — no content and no participant data.

Region

eu-central-1, Frankfurt, Germany. There is no second region and no replication outside the EU.

Database

PostgreSQL 17.6. Encrypted at rest through the provider's storage encryption.

Files

Three buckets in use: the media library, customer logos and the audio files for the help videos. Uploaded PDFs go into none of them — the text is read out by pdfjs-dist in your browser and the file is never transferred at all.

Server logic

35 edge functions in the same region. They carry the access checks, the plan limits and the billing and LTI flows.

In transit

HTTPS only. Realtime connections run over secure WebSockets.

Supabase

Database, authentication, file storage, server logic. Frankfurt region. The primary processor.

Cloudflare

Delivers the website and frontend over the content delivery network. It sees the connection data of every page view (IP address, address, timestamp) but no content and no participant data — those live in the database in Frankfurt.

Mistral AI

When you use the AI features and in the support chat. Only text is sent: a PDF is parsed in the browser and never leaves your device. European infrastructure.

Stripe

Payments and invoicing. Receives name, email and billing details of paying customers.

Resend

Transactional email: team invitations, trial notices, session reports. Receives the recipient address and the message.

Sentry

Frontend error monitoring, EU region. Runs in production builds only. Personal data collection is switched off; email addresses are stripped from messages before they are sent, the user context is reduced to an internal ID, query strings are cut from every URL and console output is discarded.

Google Analytics 4

Only after explicit consent. All consent signals default to denied and the IP address is truncated. Without consent no cookies are set and no analytics identifiers are stored; the gtag script is still loaded from Google on page view, so Google sees the (truncated) IP address.

ElevenLabs

Internal only: the voice-over for the help videos. The function is restricted to a cron secret or a superadmin, processes only text we wrote ourselves, and receives no customer or participant data.

Derived from the outbound hosts in the source code. There are no others — no ad networks, no session recorders, no heatmap tools.

Stored

A self-chosen display name, the score, the correct-answer streak, and per question the answer given, whether it was correct, the points earned and the response time in milliseconds. Free-text and word-cloud answers are stored verbatim.

Not stored

No email address, no password, no user account, no IP address in the participant record, no device fingerprint. Participants create nothing that would later have to be managed.

Joining

Through a six-digit session PIN or a QR code. The PIN belongs to the session, not to a person, and is deleted with the session.

Anonymous mode

Optional for surveys: people take part without a name and reports show pseudonyms only.

Live sessions (Free)

Deleted automatically 48 hours after the session is created. A database job runs hourly for this.

Live sessions (paid)

Set per quiz. The editor accepts 1 to 30 days; with nothing set, 15 days applies. The server-side job accepts values up to a maximum of 90 days.

Asynchronous surveys

The run time is set per survey — the editor accepts 1 to 30 days, with nothing set it is 7 days. The same hourly job deletes the survey when it expires.

Lesson and course sessions

Deleted 120 days after the session's end date — by the same hourly job. Participant progress, answers and free-text assessments belong to the session and go with it.

Participants and answers

They belong to the session. When a session is deleted — by the job, by hand, or with the account — participants and answers go with it through a database cascade. Deleting a quiz, lesson or course does the same to every session created from it.

Account deletion

Self-service from inside the account. It removes the profile, quizzes, questions, lessons, courses, flashcards and sessions, every associated participant and answer, and the files you uploaded to the media library.

Row-level security

Enabled on all 53 tables in the public schema. Access is decided in the database, not only in the application.

Roles

Held in a dedicated table rather than on the profile row, so a user cannot raise their own role through a profile update.

Privileged functions

170 of the 179 database functions run with elevated rights; every one of them with a fixed search path. Execute permission on the admin functions is revoked for unauthenticated access.

PIN protection

A global failed-attempt counter prevents guessing session PINs. Joining is additionally rate limited per plan, so hundreds of simultaneous QR scans work while automated requests do not.

Input handling

Rich text is sanitised with DOMPurify before rendering. SVG files are rejected both by the application's upload paths and by the storage bucket rule itself, because they can carry scripts.

LMS integration

LTI 1.3 with single-use nonces, signature verification against the platform's key set, rate limiting and signed grade tokens. Scores are derived server-side rather than taken from the client.

Deletion

You can delete the account yourself at any time; all associated content, participant data and uploaded files go with it.

Export

Summaries, raw answers and question analyses as CSV, reports also as PDF — in the product from the Solo plan upward. No export fee and no waiting period.

Data processing agreement

An agreement under Article 28 GDPR is provided on request.

Who answers

The person who built it. There is no ticket queue and no hand-off to an agency.