Privacy Policy

Quiliver is an online assessment platform that lets organizations build, deliver and analyze quizzes, tests and assessments. This Privacy Policy is issued by Quiliver, a company based in Lagos, Nigeria (“Quiliver”, “we”, “us”), which operates the website at quiliver.com and the Quiliver service (the “Service”).

We are committed to protecting personal data in line with the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation (together, the “NDPA/NDPR”), and, where applicable, other data-protection laws.

Quiliver plays two different roles depending on whose data is involved:

• As a data controller, for the account and profile data of the organizations and staff who sign up for Quiliver, for billing, and for operating and securing the Service. This policy governs that data.
• As a data processor, for the assessment content and participant data that an organization creates or collects using Quiliver (for example, the candidates it invites and the answers they submit). Here, the organization is the controller and decides why and how that data is used; we process it on the organization’s behalf under our agreement with them. If you are a candidate or participant, please direct data requests to the organization that invited you; we will support them in responding.

Depending on how you use Quiliver, we collect:

• Account & profile data, your name, email address, phone number (optional), a securely hashed password, and organization details such as name, logo and brand color.
• Assessment content, the quizzes, questions, images, templates and settings you create or upload.
• Participation data, attempts, submitted answers, scores and outcomes, time spent, and the display name a participant enters (including guests who take a quiz anonymously with only a name), plus certificates issued.
• Payment data, subscription plan and billing status. Card payments are processed by our third-party payment provider; we do not store full card numbers.
• Technical & usage data, IP address, browser/device information (user agent), and activity logs. Where an organization enables proctoring or integrity monitoring for an exam, we also record integrity events for that attempt.
• Communications, transactional emails we send you (such as verification, password reset, results and summary emails) and any messages you send us for support.
• Google sign-in, if you choose “Continue with Google”, we receive your name, email address and basic profile information from Google, according to the permissions you approve. We do not receive your Google password.

We use personal data to:

• Provide, operate and maintain the Service, including creating and delivering assessments and scoring results.
• Authenticate users, keep accounts secure, and prevent fraud, abuse and cheating.
• Process payments and manage subscriptions.
• Send you service and transactional messages, and (for organization owners/admins) optional summary emails you can turn off in settings.
• Provide support and respond to your requests.
• Understand and improve the Service, and maintain audit and security logs.
• Comply with legal obligations and enforce our terms.

Under the NDPA/NDPR, our lawful bases for processing include: performance of a contract with you or your organization; our legitimate interests in securing and improving the Service; your consent where required (which you may withdraw); and compliance with a legal obligation.

Quiliver uses a small number of strictly necessary cookies and tokens to make the Service work, for example, to keep you signed in, remember your active organization, and let a guest resume the exact quiz attempt they started. These are stored securely (session cookies are HTTP-only where possible).

We do not use third-party advertising cookies or sell data to advertisers. Because these cookies are essential to providing the Service, disabling them may prevent parts of Quiliver from working.

We do not sell personal data. We share it only with trusted service providers who process it on our behalf, under contract, to run the Service:

• Cloud infrastructure providers, for database, authentication, file storage, application hosting and content delivery.
• A payment processor, to handle payments securely.
• An email service provider, to deliver transactional emails.
• Authentication providers, where you choose to sign in with a third-party account (such as Google).

We may also disclose data where required by law, to enforce our agreements, or in connection with a merger, acquisition or sale of assets (in which case we will notify affected organizations).

Some of our service providers store or process data on servers located outside Nigeria. Where personal data is transferred internationally, we take steps to ensure it remains protected in accordance with the NDPA/NDPR, including using providers that offer an adequate level of protection and appropriate contractual safeguards.

We keep personal data for as long as needed to provide the Service and for the purposes described in this policy, for example, while an account or organization is active. Assessment and participant data is retained for as long as the controlling organization requires it, subject to our agreement with them. When data is no longer needed, we delete or anonymize it, unless we are required to keep it to comply with a legal obligation or resolve disputes. Organizations can request deletion of their workspace and its data.

Security is built into Quiliver’s foundation. Among other measures, we encrypt data in transit, store passwords and secrets only in hashed form, isolate every organization’s data at the database level using PostgreSQL Row-Level Security, score assessments on the server so answer keys never reach participant devices, and maintain audit logs.

You can read more on our Security page. No system can be guaranteed 100% secure, but we work continuously to protect the data entrusted to us.

Subject to the NDPA/NDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data (the “right to be forgotten”).
• Restrict or object to certain processing.
• Request portability of data you provided to us.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise these rights, email us at support@quiliver.com. If your data is controlled by an organization that uses Quiliver (for example, the school or employer that invited you), please contact that organization directly, and we will assist them.

Quiliver is designed for use by organizations, including schools that may assess students who are minors. Where an organization uses Quiliver with minors, that organization is responsible for obtaining any necessary consents (for example, from a parent, guardian or institution) and for the lawful basis of collecting that data. We do not knowingly collect personal data directly from children without the involvement of a responsible organization or guardian. If you believe a child’s data has been collected improperly, contact us and we will take appropriate action.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of Quiliver after an update means you accept the revised policy.

If you have questions about this policy or how we handle personal data, contact us at:

Quiliver
Lagos, Nigeria
Email: support@quiliver.com