Privacy policy

Last updated 5 October 2026 · Effective for all use of QDevine

This notice explains what personal data QDevine collects, why, how long we keep it and what you can do about it. It is written to satisfy India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and follows GDPR conventions for visitors from elsewhere.

1. Who we are and which role we play

QDevine is operated by Cloud TruCost (OPC) Private Limited, Mumbai, Maharashtra, India ("we", "us"). Contact for anything in this notice, including grievances: hello@qdevine.com.

  • Dashboard users (exhibitors, organisers, their staff). We are the Data Fiduciary (controller). We decide why and how your account data is processed.
  • Quiz players (visitors at a stall). The exhibitor who runs the event is the Data Fiduciary for your entry: they choose which fields to ask, write the consent line you tick, and own the resulting leads. We are their Data Processor and act only on their instructions and these terms. Requests about your entry can go to the exhibitor or to us; we will pass them on within 3 working days.

2. What we collect and why

From players

  • Registration fields chosen by the exhibitor — typically name, work email and company, sometimes mobile number, team, job title or a multiple-choice field — to identify your attempt, enforce one attempt per person, and give the exhibitor the lead you agreed to share. A mobile number is used by the exhibitor to contact you on WhatsApp; we never message you ourselves. Where the exhibitor pre-loaded an attendee list, your name, company and team may come from that list rather than from you.
  • Consent record: the exact wording you ticked, its version, the time, the language you chose, a one-way hash of your IP address and a shortened browser identifier — so the exhibitor can show that you consented and to what. This record is kept, without your name or email, even after you ask for erasure.
  • Consent records: the text you ticked and the time you ticked it, separately for taking part and (if offered) for marketing contact — to prove consent and honour its scope.
  • Quiz data: answers, score, time per question, rank — to run the game and the leaderboard.
  • Survey answers, if the exhibitor asks a question after the quiz — passed to the exhibitor with your lead.
  • Technical data: IP address and request logs for 30 days — rate limiting, abuse prevention and debugging.

Your name (in the display form the exhibitor chose: full, first name, or initials) and company may appear on the public leaderboard screen at the stall and on the result page. Email addresses never appear on any public screen.

From dashboard users

  • Account: email address, password hash and sign-in records held by Amazon Cognito; organisation name, contact email, time zone, logo and colours — to provide the service and email you about your account.
  • Billing: plan, payment status, invoice references. Card and UPI details are entered on Razorpay's pages and never reach our servers — to charge for paid plans and issue GST invoices.
  • Usage: events created, players per month, feature use — to enforce plan limits and improve the product. We look at this in aggregate.
  • Support: emails and WhatsApp messages you send us — to help you.

We do not collect data from children knowingly; the service is for business use and players should be adults or using it with an adult. We do not use personal data for advertising and we do not sell it.

3. Legal basis and consent

Players: consent, given by the tick on the registration form; the participation line is necessary to take part, the marketing line is optional and unticked by default. Dashboard users: performance of the contract you accept at sign-up, and our legitimate interest in keeping the service secure and improving it. Emails to dashboard users about their account (verification, usage warnings, event summaries, the three onboarding tips) are part of the service; the tips can be stopped from the link in each one.

4. How long we keep it

  • Player entries: until the exhibitor deletes the event or the entry, or 12 months after the event was stopped, whichever is first; the exhibitor can set a shorter period. Entries on our public demo are deleted within 24 hours.
  • Exhibitor accounts: for the life of the account plus 30 days after closure, so an accidental closure can be reversed. Billing records: 8 years, as Indian tax law requires.
  • Logs: 30 days. Email bounce/complaint records: until you ask us to remove them.
  • Backups: point-in-time backups of our database roll over within 35 days.

5. Where it goes

Data is stored in Amazon Web Services, Asia Pacific (Mumbai) region, encrypted at rest and in transit. Processors we rely on:

  • Amazon Web Services (Mumbai; TLS certificates and content delivery via CloudFront edge locations worldwide) — hosting, database, email delivery (SES), sign-in (Cognito).
  • Razorpay Software Pvt Ltd (Bengaluru) — payments and invoices for dashboard users.
  • Hostinger — our own mailbox for support email.

Exhibitors receive the data of players at their events, by design. We share data with no one else, except when the law requires it. If we ever need to transfer data outside India, we will do so only to countries not restricted by the Central Government under the DPDP Act, and with contractual protections.

6. Your rights

Under the DPDP Act (and the GDPR where it applies) you may: access a summary of your personal data and how it is processed; correct or complete it; ask for it to be erased once its purpose is served; withdraw consent as easily as you gave it; nominate a person to exercise these rights for you; and raise a grievance. Dashboard users can do most of this directly: edit your organisation in Settings, delete leads and events in Live Ops, close your account by writing to us. Players: write to the exhibitor or to hello@qdevine.com. We respond within 30 days; grievances are acknowledged within 3 working days. If you are not satisfied you may approach the Data Protection Board of India.

5a. "Just a name" events

An organiser may run an event in "just a name" mode. Players then type only a display name; no email address, phone number, company or consent is requested or stored. A random identifier kept in the player's browser prevents a second attempt on the same device and identifies nobody. Nothing from such an event is exported as personal data.

6a. Customers outside India (GDPR, UK GDPR and similar laws)

If you are an exhibitor established in the EEA, the UK or another jurisdiction with a general data-protection law, you are the controller of your players' data and we are your processor. We will sign our standard Data Processing Addendum (with the EU Standard Contractual Clauses for the transfer to India) on request — write to the address in section 9. All data is stored and processed on Amazon Web Services in the Asia Pacific (Mumbai) region; sub-processors are AWS (hosting, email), Razorpay (payments) and, when you use the AI question builder, Anthropic (the model receives the material you upload and the questions it writes, never your players' data). Players in those jurisdictions have the rights listed in section 6 and may also lodge a complaint with their supervisory authority.

7. Security

Encryption in transit (TLS 1.2+) and at rest; AWS-managed keys; sign-in via Amazon Cognito (two-factor authentication available on request); server-side scoring so quiz answers never leave our servers; least-privilege access with audit logs; automated backups. No system is perfectly secure; if a breach affects your data we will notify you and the Data Protection Board as the DPDP Rules require.

8. Cookies and local storage

We do not use advertising cookies. The dashboard keeps your sign-in session in your browser's local storage; the player page keeps your attempt in memory only; neither carries any analytics. The marketing site (https://qdevine.com) uses Google Analytics to count visits and see which pages and buttons are used; for that Google sets first-party cookies (named _ga) in your browser. You can block them in your browser settings or with Google's opt-out add-on and the site works the same.

9. Changes and contact

We will post changes here with a new date and, for material changes affecting dashboard users, email you at least 14 days before they take effect. Questions, requests and grievances: hello@qdevine.com, or Cloud TruCost (OPC) Private Limited, Mumbai, Maharashtra, India. Grievance officer: Pawan Tiwari.

Free to try · ₹9,999 per showStart free