Participants join with a nickname. ZappyQ processes only that nickname, their answers and their scores; we do not ask for email addresses or names. Every game is deleted automatically 24 hours after it is created.
Hosts have an account with an email address and a hashed password. Host Plan payments go through Stripe; card numbers never reach our servers.
ZappyQ is operated by Expi AB in Sweden under GDPR. The application servers run on Vercel in Stockholm, and quiz and game data are stored in Upstash. When you use the AI generator, only your prompt is sent to OpenAI (processed in the United States under standard contractual clauses); participant data never goes to an AI service. Transactional email goes through Resend.
We do not hold a SOC 2 report or an ISO 27001 certificate and do not claim one. If your security team needs to review the data flows, the privacy policy lists every sub-processor; write to support@zappyq.com for anything it does not answer.
If you download a CSV, that file lives on your systems and your organisation is the controller for it. Coming from Kahoot!? The Kahoot! alternative page compares plans and limits, and the teachers page covers the same tool in a classroom. Back to the ZappyQ home page.