Privacy policy

Buzzly is run by Query Logic Solutions Limited, P.O. Box 254716555564-00100, G.P.O. Nairobi, Kenya. Where this policy says “we” or “us”, it means Query Logic Solutions Limited.

This policy covers the Buzzly website, the dashboard organisers use, and the page participants use to join sessions.

Organisers are the people and organisations with an Buzzly account. They decide what to ask their audience and what to do with the answers.

For information about participants, the organiser who runs the session is responsible for it (the “controller”), and we handle it on their behalf and on their instructions (as a “processor”). For organisers' own account information, we are the controller.

If you took part in a session and have a question about your answers, the organiser who ran it is usually the best first contact. You can also contact us.

• Account details: your name, your email address and a password, which we store only as a secure hash. If you sign in with Google, Google tells us your name and email address instead, and we don't receive your Google password.
• Your organisation: its name, its members and their roles.
• What you create: decks, questions, themes, logos, saved brands and the images you upload.
• Sign-in records: the IP address and browser used when you sign in, to keep your account secure.
• Billing: your plan, payments and receipts, a billing email, and a masked card or phone number (such as “Visa •••• 4081”). Card numbers and M-Pesa PINs go to our payment provider, Paystack, and never reach us.

• The name you enter, if the session asks for one. Many sessions let you leave it blank.
• Your answers, how long each one took, and the points they scored.
• The questions you ask in Q&A, and the questions you vote for.
• A token saved in your browser, so that reloading the page or unlocking your phone rejoins you as the same participant. You can remove it by clearing this site's data in your browser.

Participants don't need an account. We don't ask for an email address or a phone number to join a session.

• Your IP address, briefly, to limit repeated attempts to join sessions. These counts expire within ten minutes.
• Your browser's preferred language, to show the service in it.
• Technical logs kept by our servers and hosting providers, such as the time of a request and the address it came from, used for security and to fix problems.

We use a cookie to keep organisers signed in. We don't use advertising, analytics or tracking cookies, and we don't show ads.

• To run the service: showing questions and results, counting votes, scoring quizzes and keeping leaderboards.
• To keep accounts and sessions secure, and to prevent abuse.
• To take payments and renew plans.
• To answer you when you contact us.
• To keep the service working well, for example by finding and fixing errors.

We don't sell personal information, we don't use it for advertising, and we don't use your content or your participants' answers to train AI models.

We use organisers' information to provide the service they signed up for (performing our contract with them), and to keep it secure and working well (our legitimate interests). We keep payment records because tax and accounting laws require us to.

Participant information is used on the organiser's behalf. The organiser is responsible for having a lawful basis for collecting it, including any consent the law requires.

• The organiser of a session sees everything participants send in it, and can download answers, scores and questions as spreadsheets or a printable report.
• Everyone in the room sees what the organiser puts on the big screen: results, the leaderboard with participants' names, and approved questions with the name the asker gave, if any.
• Paystack processes payments.
• Google signs you in, if you choose to use your Google account.
• Hosting and storage providers run our servers and store information on our behalf, under contracts that require them to protect it.
• Authorities, when the law requires us to.
• A buyer or successor, if Query Logic Solutions Limited is involved in a merger or sale, who would remain bound by this policy.

Images you add to slides are resized in your browser before they are uploaded, which also removes the information cameras attach to photos, such as location.

An uploaded image is stored under an address that cannot be guessed. Anyone who has that exact address can view it, which is how screens and phones in a session show it. It is kept after you remove it from a deck, because sessions already run from that deck may still show it.

Everything else you create is visible only to members of your organisation, and to your audience when you present it.

• Account and organisation information: while the account is open.
• Decks, sessions, results and participant information: in the organiser's account until the organiser asks us to delete them or closes the account.
• Join-attempt counts: a few minutes.
• Payment records: as long as tax and accounting laws require.

When an account is closed, we delete its information, except what the law requires us to keep.

We encrypt information in transit, store passwords only as secure hashes, keep each organisation's information separated in our database, and limit access to the people who need it to run the service.

No system is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.

Our providers may store and process information in countries other than yours. When they do, we make sure it is protected as the law requires.

Depending on where you live, you can ask us to:

• tell you what information we hold about you, and give you a copy;
• correct information that is wrong;
• delete your information;
• stop or limit how we use it, or object to a use;
• give you your information in a form you can take elsewhere.

Contact us by email at privacy@goretail.co.ke. We may need to confirm who you are first, and we will answer within the time the law allows. If you were a participant, we may pass your request to the organiser who ran the session, since they decide what happens to that information.

You can also complain to your data protection authority — in Kenya, the Office of the Data Protection Commissioner.

Organisers must be adults. Participants can include students, and an organiser who runs sessions with children is responsible for any consent the law requires. We recommend letting children join under a first name or a nickname. We never ask participants for contact details.

When we change this policy, we will update it here and change the date at the top. If a change is significant, we will tell account holders before it takes effect.

For questions about this policy or your information, contact Query Logic Solutions Limited by email at privacy@goretail.co.ke.