QuestBox does not sell personal data, show behavioural advertising, or use third-party advertising trackers. Learners do not need accounts. We process the information needed to create, deliver, grade, and improve assessments, and we provide processes to review, export, and delete organization data.
01
Scope and our role
This Privacy Policy applies to QuestBox websites, web applications, mobile applications, support channels, and related services (together, the Services). In this policy, “QuestBox,” “we,” “us,” and “our” refer to the individual operator of this unincorporated online service, based in Singapore. QuestBox’s Singapore data-protection business contact is listed in section 15.
For account, website, billing, security, and product-administration data, QuestBox generally decides why and how the data is used and acts as a controller, business, or data fiduciary under applicable law. When a school, tutoring organization, teacher, or parent uses QuestBox to manage learners and assessment records, that organization or adult usually decides the purpose of that processing. QuestBox then acts as its processor, service provider, or operator and follows its documented instructions.
If an organization gave us your information, direct questions about its educational decisions to that organization first. We will support it in responding to lawful requests.
02
Data we collect
We collect data directly from account holders and learners, automatically from devices, from an organization that administers an account or assessment, and from service providers such as payment and app-store platforms.
| Category | Examples | Source |
|---|---|---|
| Account and organization | Email address, optional name, password hash, organization name, role, invitations, preferences, and verification status. | You and your organization |
| Educational content | Uploaded documents and photos, transcripts, questions, rubrics, classes, topics, learner display names, responses, marks, feedback, mastery data, and teacher corrections. | Teachers, organizations, learners, and generated results |
| AI operations | Source excerpts, prompts, generated questions or feedback, provider/model selection, token and credit counts, quality flags, and run status. Bring-your-own-key credentials are encrypted and are never returned in plaintext. | Your use of AI features |
| Payments and plans | Plan, subscription status, billing customer and transaction identifiers, price, currency, and invoice status. Payment-card details are collected by the payment provider, not stored by QuestBox. | You, Stripe, Apple, or Google, as applicable |
| Device and technical | IP address, browser/app version, device type, timestamps, session and refresh tokens, security events, crash or diagnostic information, rate-limit records, and mobile push token. | Your device and our systems |
| Camera and photos | Pages or QR codes you choose to scan and images you select for upload. QuestBox does not use camera access in the background and does not request microphone, contacts, or precise location access. | Your device, with permission |
| Communications | Contact-form messages, support requests, feedback, and related correspondence. | You |
Please do not upload sensitive personal data, confidential records, or material you are not authorized to use. Educational content can contain personal data even when a real name is not included.
03
How and why we use data
Depending on your location and our relationship with you, we rely on performance of a contract, legitimate interests, consent, compliance with law, protection of vital interests, or another lawful basis available under local law.
| Purpose | Typical data | Typical lawful basis |
|---|---|---|
| Provide and administer the Services | Account, organization, educational content, device, and plan data | Contract; instructions from the organization |
| Create, transcribe, grade, review, export, and analyze assessments | Educational content and AI-operation data | Contract; legitimate interests; organization instructions |
| Authenticate users and prevent abuse, fraud, or security incidents | Account, IP, device, session, and audit data | Contract; legitimate interests; legal obligation |
| Process payments and manage subscriptions | Account, organization, plan, and transaction data | Contract; legal obligation |
| Send service messages and requested push notifications | Email, account events, device push token | Contract; consent where required |
| Support users and improve reliability and accessibility | Communications, diagnostics, aggregate usage, and feature interactions | Legitimate interests; consent where required |
| Comply with law and enforce our terms | Relevant account, content, payment, audit, and technical data | Legal obligation; legitimate interests |
We do not use personal data for targeted advertising, data-broker profiling, or sale. We may create aggregated or de-identified statistics that cannot reasonably identify an individual and use them to understand and improve the Services.
04
AI and automated processing
QuestBox uses artificial intelligence to transcribe source material, suggest titles or topics, generate questions, help grade written answers, provide feedback, and identify patterns in results. Relevant source content, learner answers, or instructions may be sent to the AI provider selected by the organization. Available providers may include Anthropic, OpenAI, Google, and DeepSeek.
AI output can be incomplete, inaccurate, or inappropriate. Teachers and responsible adults must review questions, answer keys, feedback, and grading before relying on them. QuestBox is designed for practice and ordinary classroom assessment, not high-stakes examinations or decisions producing legal or similarly significant effects. Subjective or uncertain grading is reviewable and may be corrected by an authorized human.
When an organization supplies its own provider key, QuestBox encrypts that key and uses it only to route the requested operation to that provider. The provider’s own terms and privacy practices also apply to its processing. We do not use customer educational content to train QuestBox-owned general-purpose AI models.
07
International transfers
QuestBox and its providers may process data in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we rely on adequacy decisions, standard contractual clauses, the UK International Data Transfer Addendum or Agreement, contractual safeguards, consent, or another lawful transfer mechanism. You may contact us for information about safeguards relevant to your data.
08
Retention and deletion
We retain personal data only as long as reasonably necessary for the purposes described here, an organization’s instructions, the selected plan, and legal, accounting, security, and dispute-resolution requirements. Current operational rules include:
- Account holders can permanently delete their account from the mobile app or signed-in web settings. QuestBox immediately disables and anonymizes the identity and removes memberships, sessions, verification records, and mobile push tokens. See the account-deletion instructions.
- Account and workspace records are kept while the workspace is active. An owner-requested organization deletion has a 30-day cancellation period before the organization’s database records, stored files, live-cache keys, and encrypted provider keys are permanently purged.
- Teachers can delete source documents, question sets, and completed submissions. They disappear from ordinary use immediately and remain subject to the applicable recovery, retention, and purge process.
- Original source files and derived page images may be permanently pruned after 12 months without genuine access, unless held or still active. Transcripts, citations, and retained educational records may remain until separately deleted or the workspace is purged.
- Generated exports are temporary and expire automatically. Authentication, verification, invitation, join, and share credentials expire or are revoked according to their security purpose.
- Billing, audit, security, support, and backup records may remain longer where necessary to meet law, prevent fraud, resolve disputes, or preserve system integrity. Backups are isolated from normal use and age out on a controlled schedule.
Deletion may be limited where retention is required by law, where data is needed to establish or defend legal claims, or where the requester is not authorized to direct deletion of organization-controlled records. We will explain any applicable limitation.
09
Security
QuestBox uses administrative, technical, and organizational safeguards designed for the nature of the data processed. These include encrypted connections, hashed passwords, encrypted provider keys, role-based access, tenant isolation, private object storage, short-lived signed links, audit trails, rate limiting, file validation, and restricted support access. No system is perfectly secure, so we cannot guarantee absolute security.
Account holders must protect their credentials, use secure devices, limit access to authorized people, and notify us promptly at hello@questbox.in if they suspect unauthorized access.
10
Your choices and rights
Depending on your location and our role, you may have rights to:
- know whether and how we process your data and obtain a copy;
- correct inaccurate or incomplete data;
- delete data, restrict or object to processing, or withdraw consent;
- receive certain data in a portable format;
- opt out of sale, targeted advertising, or certain profiling;
- request review of certain automated decisions;
- appeal a decision about a request; and
- complain to your local privacy, data-protection, education, or consumer authority without retaliation.
Account holders can update some data in the Services. Organization owners may request a workspace export or deletion through available controls or by contacting us. Account holders may permanently delete their account using the documented in-app or web process. Anyone may submit a request to hello@questbox.in. We may need to verify identity and authority, and an authorized agent may be asked for proof of authorization. We do not discriminate against anyone for exercising a privacy right.
If a school or other organization controls your educational record, send the request to it first. Parents or guardians seeking a child’s data should identify the organization and assessment involved without emailing additional sensitive data.
11
Regional disclosures
Singapore
QuestBox is operated from Singapore and handles personal data in accordance with the Personal Data Protection Act 2012 (PDPA). You may ask for access to or correction of personal data, withdraw consent where processing depends on consent, or raise a complaint using the contact details in section 15. Withdrawal may affect our ability to provide features that require the relevant data. We retain data only while it serves a legal or business purpose and use contractual or other safeguards intended to provide comparable protection when data is transferred outside Singapore.
EEA, United Kingdom, and Switzerland
The lawful bases described in section 3 apply. You may contact us about our legitimate-interest assessment or transfer safeguards. You may complain to the supervisory authority where you live, work, or believe a violation occurred. QuestBox does not currently target or maintain an establishment or representative in the EEA or United Kingdom. If a representative becomes legally required before a targeted offering begins, the representative’s details will be added here.
United States
The data-category, source, purpose, retention, and recipient tables above are our notice at collection. During the preceding 12 months, we may have collected and disclosed the categories described in section 2 for the business purposes in sections 3 and 6. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics. Where state law applies, residents may request access, correction, deletion, portability, opt-out, appeal, or use an authorized agent. Mandatory rights and exceptions under state law remain unaffected.
Brazil
Where Brazil’s LGPD applies, you may request confirmation, access, correction, anonymization, blocking or deletion where applicable, portability, information about sharing, withdrawal of consent, opposition, and review of certain automated decisions. You may petition the ANPD after first contacting us.
India
Where India’s Digital Personal Data Protection Act and rules apply, you may request access to information about processing, correction, completion, updating, erasure, grievance redressal, and nomination as provided by law. QuestBox’s contact email below is the business contact for privacy questions and grievances unless a separate contact is shown for your organization.
Canada, Australia, New Zealand, and other jurisdictions
You may request access and correction and raise a complaint with us. Additional rights, response periods, cross-border rules, and regulator contacts apply according to local law. Nothing in this policy limits a non-waivable right available where you live.
12
Children and students
QuestBox is used by adults to prepare and administer learning activities for learners aged 8 and older. Children do not create QuestBox accounts. A teacher, school, parent, or guardian controls the assessment and is responsible for providing notices and obtaining any consent or other lawful authorization required for the child’s participation.
Learners may be asked for a display name and may submit answers that become educational records. They should use a nickname or classroom identifier, not a full legal name, email address, home address, school name, or other unnecessary personal information. QuestBox does not knowingly collect children’s data for advertising, track children across services, or create commercial profiles about them.
In Singapore, participation by a learner under 13 requires consent from the learner’s parent or guardian. Learners aged 13 to 17 may consent only where the notice is readily understandable and they have sufficient understanding of the consequences; QuestBox still expects a responsible adult or organization to supervise their use. In the United States, schools may consent on a parent’s behalf only where law permits and only for an educational purpose. Higher local consent ages continue to apply. If you believe a child provided personal data without required authorization, contact us so we can work with the controlling organization to review and, where appropriate, delete it.
13
Schools and organizations
Schools and other institutional customers are responsible for determining the lawful basis for educational processing, configuring access, giving required notices, responding to learners and parents, and using QuestBox consistently with applicable education and student-privacy laws. Where FERPA applies, QuestBox processes education records as a school official or contractor only under the school’s direct control and for the legitimate educational interest defined by the school.
A data processing agreement or school-specific privacy addendum may be required before institutional deployment. Contact hello@questbox.in to request one. Contract-specific terms prevail over this general policy to the extent of a conflict.
14
Changes to this policy
We may update this policy as the Services, providers, or laws change. We will post the revised policy with a new effective date and, when required, give additional notice or obtain consent. Material changes do not apply retroactively where prohibited by law.
15
Contact us
For privacy questions, rights requests, parental inquiries, or complaints, email hello@questbox.in or call +65 8150 1206. These are the public business contact details for QuestBox’s Singapore data-protection contact. Please include your country, your relationship to QuestBox or the relevant organization, and enough detail to locate the record. Do not send passwords, provider keys, learner answers, identity documents, or other sensitive material unless we specifically request it through a secure channel.