Legal notice, privacy and terms
Version 2 · 3 August 2026
This document has three parts: what we do with personal data, which cookies we use, and the terms QusAP is used under. It is written to be read, not to look good: if something is unclear, write to us and we will rewrite it.
1. Privacy
Who processes the data, and in what role
Service provider: [LEGAL ENTITY], tax ID [TAX ID], registered at [ADDRESS]. Contact: [CORREU DE CONTACTE]. Data protection officer: [DPO OR “none appointed”]. Who decides about your data depends on how you got here, and that changes who you should complain to: · If your institution has contracted QusAP for its courses, the CONTROLLER is the institution and QusAP is only a PROCESSOR (art. 28 GDPR): we do what the institution instructs and nothing else. Exercise your rights with the institution; if you write to us, we pass it on and tell you. · If you opened an account yourself and created your own courses, we are the controller. In both cases, this text describes what the platform actually does.
What is stored
Only what the service needs: · Account: email, name, language, picture if you add one, sign-up date and last seen. · Courses: which ones you belong to, in what role (student or teacher) and in which group. · Learning activity: every question served to you and every answer, with the time it was presented and answered, the outcome, and the specific values you were given. · IP address: for each question served and each answer submitted. · Grades: computed automatically and entered by teachers, plus whether an answer was marked by hand. · Communications: course messages and consultations, with their content. · Official class list: name and photograph imported by teachers from the institution's system, where applicable. · Notifications: if you enable them, the technical identifier of your browser. · Payment: if you subscribe, the Stripe customer identifier and the subscription status. Card details never pass through QusAP and we never see them. We neither ask for nor want special categories of data (health, beliefs, etc.). We do not record your screen, camera or microphone, and we install nothing on your computer.
What we use it for
· Running the service: serving questions, marking them, computing grades and letting teachers and students communicate. · Assessment integrity: checking that exams are taken from the classroom. That, and only that, is why the IP address is stored. · Billing and support, where a paid plan exists. · Security: technical logs to detect errors and abuse. There is no advertising, no commercial profiling, we neither sell nor share data with third parties for their own purposes, and we do NOT train artificial-intelligence models on the content or the answers.
On what legal basis
· Running the service and managing the account: performance of the contract (art. 6(1)(b) GDPR) with you or with your institution; where the institution is the controller, also its public-interest educational task (art. 6(1)(e)) as it has determined. · IP address and copy detection: legitimate interest (art. 6(1)(f)) in assessment integrity, ours and the institution's. We have assessed that this interest does not override your rights because the data is minimal, is used for nothing else, is not cross-referenced between courses, and the outcome is always reviewed by a person. You may object (see “Your rights”). · Billing: legal obligation (art. 6(1)(c)) and performance of the contract. · Push notifications: consent (art. 6(1)(a)), which you can withdraw at any time from your profile or your browser, without affecting what was done before.
Automated marking and copy detection
We have to be explicit about this, because it is automated decision-making (arts. 13(2)(f) and 22 GDPR): · AUTOMATED MARKING. Answers are marked automatically: numeric ones by comparing your number against the margin the teacher defined; multiple-choice ones against the options marked correct. That produces each topic's grade and, weighted, the module and course grades. · THE LOGIC, in one sentence: a topic's grade is 10 × points answered correctly / (points answered wrongly + the greater of the points required and the points correct). The teacher decides how many points each topic requires. · IT IS NOT THE LAST WORD. Teachers can void any answer, mark it by hand, and change or replace a module grade; grades are not visible until published. You always have the right to human intervention, to an explanation and to contest the outcome: talk to your teacher, and if that does not settle it, to the institution. · COPY DETECTION. Teachers have an experimental indicator that flags unusual patterns (very fast correct answers, an IP address shared between students). It is an AID TO HUMAN JUDGEMENT and accuses no one: it neither gives nor takes grades by itself, and no academic consequence follows from it without a person reviewing it. You can ask whether such a signal influenced a decision about you.
Transfers outside the European Union
Data is stored on servers in the European Union ([SPECIFIC REGION: e.g. Supabase eu-central-1, Vercel fra1]). Some of these providers are United States companies and, for support or backups, access from outside the EU may occur. Those transfers rely on the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. You may request a copy of the safeguards at [CORREU DE CONTACTE].
For how long
· For as long as the account is active and the course is live. · Where an institution is the controller, the periods are set by the institution, which usually must keep academic records for years. We delete nothing on our own initiative before it says so. · When you delete your account, answers, grades, messages and consultations are deleted. Courses you created must be handed over or deleted first, because they would take their students' work with them: while you own any, deletion cannot complete, and we tell you which they are. · Billing data is kept for the mandatory tax and accounting periods (6 years, art. 30 of the Spanish Commercial Code). · Content-sharing codes expire and are deleted automatically 7 days after being revoked. · Backups are overwritten on rotation: deleted data may survive there for a few days until the backup expires, and during that time it is not used for anything.
Your rights
You have the right to access your data, rectify it, erase it, restrict its processing, object, and take a copy; and, where processing is based on your consent, to withdraw it at any time. Two things you can do yourself, right now and without asking, from your profile: · download a copy of your data as a file; · delete your account. For anything else, or if your institution is the controller: write to the institution, or to [CORREU DE CONTACTE] and we pass it on. We answer within a month (extendable to three for complex cases, telling you so). If you believe we have not respected your rights, you may complain to the Catalan Data Protection Authority (apdcat.gencat.cat) or the Spanish Data Protection Agency (aepd.es). Before that, if you like, write to us: it is usually faster.
Age
QusAP is designed for university teaching and adult training. To open an account yourself you must be 14 or older (art. 7 LOPDGDD). If an institution uses it with children under 14, it is the institution that must have the legal basis and, where applicable, the consent of the holder of parental responsibility, and that must inform them; this must be recorded in the processing agreement.
Security
What we actually do: · Who can see each piece of data is decided by the database itself (row level security), not only by the application: even if a bug in the program asked for someone else's data, the database would not hand it over. · Question solutions never leave the server. Statements and their images are delivered only when it is your turn to answer them, through signed, time-limited links. · Class-list photographs are not public: they are delivered only through a signed link to the course's teachers. · All traffic is encrypted, and passwords are never stored in the clear. · Invited teachers' permissions are separated by task, so that whoever should not touch something cannot touch it. If a security breach occurs: where an institution is the controller, we will inform it without undue delay so that it can meet its deadlines; where we are the controller, we will notify the authority within 72 hours and, if there is a high risk to your rights, tell you as well (arts. 33 and 34 GDPR).
2. Cookies
3. Terms of use
Who provides the service
[LEGAL ENTITY], tax ID [TAX ID], registered at [ADDRESS], email [CORREU DE CONTACTE] and, where applicable, entered in the Commercial Registry of [REGISTRY, VOLUME, FOLIO, SHEET]. This information is published under article 10 of Spanish Law 34/2002 (LSSI-CE). These terms govern the use of qusap.com. Using the service means accepting them. If we change them materially, we will tell you with reasonable notice and you may stop using the service or cancel your plan.
What the service is
QusAP is a tool for teachers to build syllabus and assessments, and for students to practise and be assessed. Course content (statements, solutions, images) belongs to whoever created it: we claim no ownership. You authorise us only to host and display it in order to provide the service. QusAP's software, brand and design are ours. The service is offered with the availability our providers allow. We may take it down for maintenance and, where foreseeable, give notice.
Honest use
QusAP must be used in good faith. Specifically, do not: · try to reach exam content before it is served to you, by any technical means; · answer on someone else's behalf or let someone answer for you; · automate answers or use programs to solve them; · fake your location or network to bypass classroom checks; · try to reach other people's data. Teachers may void answers and grades obtained that way, and the institution may open whatever disciplinary procedure it has. If we detect use that endangers the service or other people's data, we may suspend the account; we will tell you and you may respond.
Paid plans
Prices, duration and what each plan includes are those shown on the billing page at the time of purchase. Prices are shown with applicable taxes itemised. · Subscriptions renew automatically for the same period until you cancel. You can cancel at any time from the billing page; cancellation takes effect at the end of the period already paid for, and you keep the service until then. · The course pass is a one-off payment for the duration stated at purchase. · Payments are handled by Stripe. If a payment fails we tell you, and the service may drop to the free tier until it is resolved. · We send the invoice by email.
Right of withdrawal
If you buy as a CONSUMER (a natural person, outside a professional activity), you have 14 calendar days to withdraw without giving any reason (arts. 102 ff. TRLGDCU). Because the service is supplied digitally and immediately, at purchase we ask you to confirm that you want it to start at once and that you understand that, once we have given you full access, you lose the right of withdrawal (art. 103(m) TRLGDCU). If you do not confirm, the service does not start until the 14 days have passed. To withdraw, simply write to [CORREU DE CONTACTE] saying so before the deadline. We refund what you paid within 14 days, by the same means of payment. If you buy on behalf of a company or an institution, this right does not apply: what you signed governs.
Liability
We are liable for damage we cause by breaching these terms, on the terms the law establishes. We neither exclude nor limit our liability where the law does not allow it: wilful misconduct, gross negligence, personal injury, or the rights that consumer legislation grants mandatorily. We are not liable for unavailability caused by events reasonably beyond our control, nor for the content teachers publish in their courses, nor for the institution's academic decisions. We recommend teachers keep their own copy of important syllabus: we take backups, but a copy of your own is a copy of your own.
Governing law and complaints
These terms are governed by Spanish law. If you are a consumer, you may bring proceedings before the courts of your domicile and you waive no right granted to you by the law of your country of residence in the European Union. You may also use the European online dispute resolution platform. In all other cases, the parties submit to the courts of [CITY]. Before going anywhere else, write to us at [CORREU DE CONTACTE]: most things are settled in one email.
For anything about this document, your data or the service: [CORREU DE CONTACTE]. If your institution is the controller, address it as well.