Privacy Policy

Lotus River AI ("we", "us", or "our") operates InnQuizzitive (innquizzitive.com). This Privacy Policy explains how we collect, use, and protect personal data when you use our Service.

We are committed to handling personal data in line with Singapore's Personal Data Protection Act (PDPA), and, where applicable, the EU/UK General Data Protection Regulation (GDPR) and South Africa's Protection of Personal Information Act (POPIA).

1. Who We Are

For the personal data of our account holders, we act as the data controller. For information that our customers upload about their own staff or job candidates, our customers are the controller and we act as a data processor on their behalf.

2. Information We Collect

Account information: name, email address, business name, and password (stored in hashed form).

Billing information: processed by our payment provider, Stripe. We do not store your full card details. We receive limited billing data such as your name, billing country, and subscription status.

Customer Data: menus, quizzes, questions, and information our customers enter about their staff or job candidates, which may include names, contact details, and quiz responses.

Staff and candidate contact data: where a staff member or candidate is added (by their venue or by signing up themselves), we store their name and, where provided, their WhatsApp phone number together with a record of whether they consented to receive quiz links by message, and when that consent was given.

For staff data, we hold the staff member's name, phone number (where provided), quiz responses, and quiz scores. The venue is the data controller and Lotus River AI is its data processor. This data can be exported or deleted on request through the venue or by contacting us.

Candidate CVs and screening documents:where a venue uses our hiring-screening feature, a job candidate may upload a CV or résumé. These documents can contain additional personal information (such as address, employment history, education and, where the candidate chooses to include it, a photo). We store them in private storage accessible only to the venue that requested the screening, alongside the candidate's screening answers and score. The venue is the data controller; these documents can be deleted on request through the venue or by contacting us.

Usage data: log data, device and browser information, IP address, and how you interact with the Service.

Cookies: see our Cookie Policy.

3. How We Use Your Information

• To provide, maintain, and improve the Service;
• To process payments and manage subscriptions;
• To generate and deliver quizzes and results;
• To communicate with you about your account, updates, and support;
• To detect, prevent, and address security issues or abuse;
• To comply with legal obligations.

4. Legal Bases for Processing (where GDPR applies)

We process personal data on the basis of: performance of a contract (to provide the Service), legitimate interests (to operate and secure the Service), consent (e.g. for certain cookies or marketing), and legal obligation.

5. Third-Party Service Providers

We share personal data only with providers that help us run the Service, under appropriate data protection terms:

• Stripe — payment processing
• Supabase — database hosting and authentication
• Resend — transactional email delivery
• Anthropic— AI content generation (powers automatic quiz creation and menu reading). Data sent to Anthropic's API is not used to train their models.
• Vercel — application hosting
• Upstash — rate limiting / abuse prevention (processes IP addresses)
• Sentry — error monitoring and diagnostics (where enabled)
• Twilio — WhatsApp message delivery (where WhatsApp quiz reminders are enabled)
• Meta Platforms (WhatsApp) — transport of WhatsApp messages (where enabled)
• GoDaddy — domain registration

We do not sell your personal data.

6. International Data Transfers

Our providers may process data outside your country, including in the United States and the European Union. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. After account closure, we delete or anonymise personal data within a reasonable period, unless we are required to keep it for legal, accounting, or security reasons. Customers can request deletion of their Customer Data at any time.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data;
• Object to or restrict certain processing;
• Withdraw consent;
• Request a copy of your data in a portable format;
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at support@innquizzitive.com. If your request concerns staff or candidate data uploaded by one of our customers, we will refer you to that customer as the controller.

9. Security

We use industry-standard measures to protect personal data, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect their personal data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify you directly.

12. Contact

Lotus River AI — support@innquizzitive.com.