Privacy Policy — DTCQuiz

DTCQuiz (“we,” “us”) operates the quiz-funnel platform at dtcquiz.com and the per-tenant subdomains and custom domains thereunder. This policy explains what we collect, why, and how we handle it. The platform is currently in private beta; brand operators reach us via the channels they were onboarded on.

Who controls your data

When you take a quiz on a tenant subdomain (for example, brand.dtcquiz.com), the brand is the data controllerand DTCQuiz is a data processor acting on their behalf. Reach out to the brand directly for questions about how they use your information. We hold the data on their behalf and act only on their documented instructions.

What we collect

Quiz responses. The options you select on each step. We do not collect free-text answers in the current product.
Email address + optional first name and phone, only when a quiz includes the lead-capture step and you submit it.
Visit metadata. An anonymous visit ID stored in a first-party cookie (dtcquiz_visit_*), the time you started the quiz, which steps you completed, whether you clicked through to the brand's store.
Soft audit data on lead-capture submissions: IP address and user-agent string, retained to detect abuse and prove consent.
Storefront events(page views, add to cart, checkout started) where the brand has installed our Shopify Custom Pixel. These flow through Shopify's pixel sandbox.

What we do NOT collect

Government IDs or payment-card data.
Health records or medical diagnoses (quiz answers about symptoms are not medical records).
Tracking across other websites — no third-party cookies, no advertising IDs from us.

Who we share it with

The data we collect on a brand's behalf can be shared with:

The brand itself (the data controller). They see leads, quiz responses, conversion events, and aggregate stats in their dashboard.
Klaviyo, when the brand configures it. We send the captured email + first name + phone + quiz result metadata to their Klaviyo account.
Shopify, when the brand connects their store. We pass the visit ID as a cart attribute so the brand can attribute orders to the quiz.
Sentry, for error monitoring. Stack traces and request metadata may include the URL path and a redacted query string.
OpenAI, when a brand operator uses the AI authoring agent to edit their quiz. Quiz content (questions, options, copy) is sent to OpenAI for the duration of the request. Quiz-taker PII is never sent.
Cloudflare (DNS + R2 storage for encrypted backups) and Hostinger (VPS hosting) as sub-processors.

We do not sell your data. We do not share it with advertisers. We do not pool data across brands.

How long we keep it

Quiz responses + events:for the lifetime of the tenant relationship. Used for the brand's dashboard analytics.
Leads: until the brand asks us to delete them, or the tenant relationship ends.
Encrypted backups: 7 daily + 4 weekly + 6 monthly snapshots, then automatically pruned.
Visit cookies: 30 days from the last visit.

Your rights

You can request access to, correction of, or deletion of the personal data we hold about you. Because we are a processor for the brand you interacted with, the fastest path is to contact the brand directly. We will route requests we receive to the brand (controller) and act on their instruction. We aim to respond within 14 days.

Security

Data sits in a Postgres database with row-level security enforcing per-tenant isolation. Backups are encrypted client-side (restic AES-256) before leaving our infrastructure. Application access is gated by authentication and per-tenant role-based access control.

Children

DTCQuiz is intended for use by adults aged 18 and over. We do not knowingly collect data from anyone under 13. If you believe we have, contact the brand you took the quiz on and we will delete it on their instruction.

Changes

We may update this policy as the product evolves. The “last updated” date at the top reflects the most recent change. Material changes will be communicated to active brand operators directly.