Privacy and terms
Last updated: 2 August 2026
Who processes the data
The data controller is [LEGAL ENTITY], registered at [ADDRESS], tax ID [TAX ID]. Contact: [EMAIL]. Data protection officer: [DPO OR “none appointed”]. When an educational institution contracts QusAP for its courses, the institution is the controller and QusAP acts as a processor under the agreement signed with it.
What is stored
· Account: email, name, language, profile picture if you add one, sign-up date and last seen. · Courses: which courses you belong to, with which role and in which group. · Learning activity: every question served and every answer, with the time, the outcome and the IP address it was answered from. · Grades: both computed and entered by teachers. · Communications: course messages and consultations. · Official class list: name and photograph imported by teachers from the institution's system, where applicable. · Payment: if you subscribe, the Stripe customer identifier and the subscription status. Card details never pass through QusAP.
What for
To run the service: serve questions, mark them, compute grades, let teachers communicate with students, and check that exams are taken from the classroom. The IP address is stored for that last purpose and nothing else. There is no commercial profiling, no data is sold, and no models are trained on the content.
Legal basis
Performance of the contract with the institution or with you, and the legitimate interest in assessment integrity. Where consent is required (push notifications, for instance) it is requested and can be withdrawn at any time.
Who it is shared with
With the providers needed to run the service: Supabase (database and storage), Vercel (hosting), Resend (email) and Stripe (payments). All act under a processing agreement and handle the data within the European Union or under equivalent safeguards. Within a course, teachers see their students' activity and grades; students see their coursemates' names, and never their grades or answers.
For how long
For as long as the account is active. Deleting the account deletes answers, grades, messages and consultations. Courses you created must be handed over or deleted first, because they would take their students' work with them. Content-sharing codes expire and are deleted automatically 7 days after being revoked.
Your rights
Access, rectification, erasure, restriction, objection and portability. From your profile you can download a copy of your data and delete your account yourself, without asking anyone. If you believe they have not been respected, you may complain to the Catalan Data Protection Authority (apdcat.gencat.cat).
Cookies
Only the essential ones: the session cookie (to keep you signed in), the language cookie and the teacher test-mode cookie. There are no advertising or third-party tracking cookies. Vercel Analytics is also used; it counts visits in aggregate, without cookies or browser fingerprinting.
Security
Access to each piece of data is decided by the database itself (row level security), not only by the application. Question solutions never leave the server, statement images and class-list photos are delivered through signed, time-limited links, and all traffic is encrypted. Should a breach affecting your rights occur, you will be informed and the authority notified within the legal deadline.
Terms of use
QusAP is a tool for learning and assessment. It must be used in good faith: no trying to reach exam content early, no answering on someone else's behalf, no automating answers. Teachers may void answers and grades obtained that way. The service is provided as is, with the availability its providers allow. Prices, duration and refunds for paid plans are those shown on the billing page at the time of purchase.
Contact
For anything about this text or about your data: [CONTACT EMAIL].