Last updated: August 16, 2026
This Privacy Policy explains how Danil Soroka, an individual entrepreneur (autónomo) registered in Spain, NIF Z2657671A, business address Avenida de l'Oeste 39, 46001 Valencia, Spain ("HatQuiz," "we"), processes personal data when you use https://hatquiz.com (the "Service"). We are the data controller for the processing described here.
Contact: hatquizz@gmail.com
As we are established in Spain, our lead supervisory authority is the Spanish Data Protection Agency (AEPD, https://www.aepd.es). No EU representative is required;
| Category | Source | Where stored | Retention |
|---|---|---|---|
| Account data: email, display name, avatar URL, Google account identifier, Clerk user ID | You / Google, via Clerk sign-up | Clerk (US) and our database (Hetzner, EU) | While your account exists |
| Quiz answers and results | You | Our database (Hetzner, EU) | While your account exists |
| Photos (your face; your pet for the pet quiz; each couples-quiz participant uploads their own photo) | You | Our file storage (Hetzner, EU); transmitted to OpenAI (US) for generation | Draft uploads: auto-deleted within 1 hour if no generation is completed. Photos tied to a completed generation: while the generation/your account exists, or until you delete them |
| Generated AI cards (contain a stylized portrait) | Created by the Service | Our file storage (Hetzner, EU) | While your account exists, or until you delete them |
| Country (ISO code, from geo header or your selection) | Your request / choice | Our database | As quiz answers |
| Payment data (card details) | You → Stripe | Stripe only. We receive only subscription status, amounts, and identifiers | Per Stripe's policies |
| Server logs (IP address, user agent, request metadata) | Automatic | Our servers (Hetzner, EU) | |
| Support correspondence | You | 24 months |
We do not intentionally collect any special categories of data other than photos as described below. Quiz answers are entertainment content, not psychological assessments.
Photos of faces deserve special care, so here is exactly what happens:
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: accounts, quizzes, results | Account data, quiz answers, country | Contract (Art. 6(1)(b)) |
| Generate AI cards from your photo | Photos, quiz answers | Consent (Art. 6(1)(a); Art. 9(2)(a) to the extent applicable). You can withdraw consent at any time by deleting the photo/generation or your account |
| Process subscriptions and payments | Payment status data | Contract; legal obligations (accounting/tax) |
| Security, abuse and fraud prevention, rate limiting | Logs, account data | Legitimate interests (Art. 6(1)(f)) |
| Support and communications about the Service | Account data, correspondence | Contract; legitimate interests |
| Legal compliance (tax, accounting, lawful requests) | Relevant records | Legal obligation (Art. 6(1)(c)) |
| Marketing use of example cards | Only with your separate explicit consent; de-identified where possible | Consent |
We do not use your personal data for automated decisions with legal or similarly significant effects, and we do not sell or share personal data for advertising.
We share personal data only with service providers acting on our instructions:
| Provider | Role | Location |
|---|---|---|
| Clerk, Inc. | Authentication (credentials, sessions) | US |
| Stripe, Inc. | Payment processing, fraud prevention | US |
| OpenAI, L.L.C. | AI image generation (receives your photo and prompt) | US |
| Hetzner Online GmbH | Hosting (servers and file storage) | EU (Germany/Finland) |
| Umami Software, Inc. | Cookieless website analytics (aggregated usage statistics) | US |
| Namecheap, Inc. | Domain/DNS | US |
We may also disclose data if required by law, or in connection with a corporate transaction (with notice where required).
We are hosted in the EU (Hetzner). Where data is transferred to providers in the United States (Clerk, Stripe, OpenAI, Namecheap), we rely on appropriate safeguards: the EU–US Data Privacy Framework where the provider is certified, and/or the European Commission's Standard Contractual Clauses with supplementary measures.
See the tables in Sections 2 and 3. In general: data lives as long as your account does; you can delete content or the whole account earlier; residual copies in encrypted backups are purged on regular backup rotation; billing records are kept as long as tax and accounting law requires.
Depending on where you live (including under GDPR and US state privacy laws), you may have rights to: access and receive a copy of your data; correct it; delete it; port it; restrict or object to processing; withdraw consent at any time (without affecting prior processing); and not be discriminated against for exercising rights.
How to exercise them: email hatquizz@gmail.com from your account email. We will verify your identity and respond within the legally required period (in most cases 30 days, extendable where the law allows). We aim to complete account/data deletion within 30 days.
You may also complain to your local data-protection authority (for EU/UK users) or, for US state-law rights, appeal a refusal by replying to our decision.
US state disclosures (California and other applicable states): we do not "sell" or "share" personal information as defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a "Limit Use" option. Categories collected are listed in Section 2. Illinois: photo-upload and AI-card features are not available to Illinois residents; users attest to this before uploading a photo.
The Service is for adults 18+. We do not knowingly collect data from anyone under 18, and uploading photos of minors is prohibited. If we learn that we hold data of a minor, we will delete it. Parents/guardians can contact hatquizz@gmail.com.
We currently use only strictly necessary cookies: Clerk (session/authentication) and Stripe (payment security and fraud prevention). We do not use advertising cookies.
For audience measurement we use Umami, a privacy-focused analytics service. Umami sets no cookies and creates no persistent identifier on your device, does not track you across other websites, and is not used for advertising or profiling. It records aggregated, non-identifying data: the page visited, the referring site, country, browser and device type, and a small set of in-product actions (starting and completing a quiz, adding a photo, signing up, viewing the paywall, starting and completing a purchase, and the plan and payment method chosen). Your IP address is processed transiently to derive the country and to generate a daily-rotating, salted hash that groups requests into a visit; the IP address itself is not stored, and the hash cannot be linked back to you. Because this measurement is limited to our own site, sets no identifiers and does not build profiles, we rely on our legitimate interest in understanding how the Service is used (Article 6(1)(f) GDPR) rather than on consent. If we later introduce analytics that require cookies or cross-site tracking, we will update this Policy and request consent first.
We use encryption in transit (TLS), access controls, isolation of production systems, and the security programs of our providers (Clerk, Stripe, OpenAI, Hetzner). No system is perfectly secure; we will notify you and regulators of data breaches where the law requires.
We will post updates here and, for material changes (especially anything affecting photo processing), notify you and re-request consent where required. The "Last updated" date shows the current version.
Danil Soroka (autónomo), NIF Z2657671A, Avenida de l'Oeste 39, 46001 Valencia, Spain Email: hatquizz@gmail.com