Privacy Notice
Pre-launch version for review by a qualified lawyer. It describes how the Wimzi software actually handles data today. Items marked [to confirm] (legal entity, contact details, hosting provider and location) must be completed before public launch.
Who we are
Wimzi is provided by [to confirm: legal entity name, registration number and address] ("Wimzi", "we"). Privacy contact: [to confirm: privacy@ email address]. Data Protection Officer: [to confirm: name or contact, if one is appointed or required].
Who this covers, and our role
- Participants who join a live session, self-paced challenge or practice quiz with a code. They don't need an account. The company running the session is the controller of Participants' names and answers, and decides what to collect and why. Wimzi processes that data on the company's behalf, as its processor. If you're a Participant, the company's own privacy information applies, and you should send requests to it first.
- Workspace members: trainers, admins and others who sign in. Your company controls the content of its workspace. Wimzi is the controller for the account data we need to run and secure your sign-in.
- Website visitors and people who request a demo, for whom Wimzi is the controller.
What we collect, why, and our legal basis
| Data | From | Why | Legal basis |
|---|---|---|---|
| Name, work email, company name, password (stored only as a salted scrypt hash) | Members | To create and secure your account and workspace. | Contract |
| Sign-in session records (a hash of a random token, workspace, timestamps) | Members | To keep you signed in. Sessions expire after 14 days without use. | Contract |
| Record of the terms version accepted, and audit log of actions such as role changes, deletions and exports | Members | Accountability, security and proof of agreement. | Legitimate interests; legal obligation |
| Quizzes, brand kits, logos, images | Members | To provide the service. | Contract (processed for your company) |
| Nickname or name, team, answers, scores and timings | Participants in named sessions | To run the session and produce the report the host asked for. | Decided by the company running the session |
| Answers only, with no name | Participants in anonymous sessions | Names aren't requested or stored. Reports show combined results, and open answers are shuffled. Free-text answers could still identify someone if they include personal details. | Decided by the company running the session |
| Emails we generate (invitations, password-reset links) | Members | To let you join a workspace or reset your password. These messages, including the link, are stored in our database so they can be delivered. [to confirm: email provider, once chosen] | Contract |
| Payment records: plan, amount, currency, payment method type, provider reference and dates. Card and PayPal details are entered on the provider's page and never reach Wimzi. | Workspace owners who pay online | To apply the plan you bought, send receipts, and keep financial records. | Contract; legal obligation (tax and accounting records) |
| Demo requests: name, work email, company, role, company size and what you'd like to use Wimzi for | People who use the contact form | To reply to your request. | Consent (you tick the box), which you can withdraw at any time |
| Product usage events, such as "signed up" or "session started", with small counts and codes | Members and visitors | To understand which features are used. Stored on our own server. Events never include answers, names, emails, report content or credentials, and no analytics cookies or device IDs are used. | Legitimate interests |
| Topic text or notes typed into the AI question drafter (up to 20,000 characters) | Members who use the feature | To generate draft questions. See "AI features" below. | Contract (processed for your company) |
| IP address | Everyone | Held briefly in memory to limit abuse (rate limiting). Wimzi doesn't write it to its database, but our hosting and font providers receive it when your browser connects (see below). | Legitimate interests (security) |
We don't knowingly collect special-category data (such as health, religion or ethnicity). Companies are told not to ask for it unless it's necessary and lawful.
Cookies and browser storage
- One cookie: a strictly necessary sign-in cookie for Members (HttpOnly, SameSite). It isn't used for tracking and doesn't need consent.
- Browser storage: your browser's local and session storage keep things like an unsaved quiz draft, your sound setting and your place in a live game so you can reconnect. This stays on your device.
- No advertising or third-party analytics cookies.
Who we share data with
We don't sell personal data or use it for advertising. We share it only with these service providers, to run Wimzi, and when the law requires it:
| Provider | What they receive | Where |
|---|---|---|
| [to confirm: hosting provider] | All data stored in Wimzi, and server logs | [to confirm] |
| Google Fonts (Google LLC) | Your IP address and browser details, when pages and branded sessions load fonts. No account data or answers. [planned: fonts to be served from Wimzi's own server] | United States and other Google locations |
| cdnjs (Cloudflare, Inc.) | Members' IP address and browser details, when workspace and host pages load the QR-code library | Global network |
| Paystack Payments Ltd (a Stripe company) | The paying owner's email, the amount and a payment reference, when paying by card or bank. Card details are collected by Paystack directly. | Nigeria and other Paystack/Stripe locations |
| PayPal | The amount, a description of the plan and a payment reference, when paying with PayPal. Your PayPal or card details are collected by PayPal directly. | Global (PayPal locations) |
| Anthropic, PBC | Only the topic or notes a Member types into the AI question drafter, if that feature is switched on | United States |
We may also disclose data if required by law, a court order or a regulator, to protect people's safety or our rights, or to a buyer in a merger or acquisition (who must honour this notice). We'll give at least 30 days' notice to companies before adding a provider that processes their workspace content.
AI features
If a workspace uses the optional AI question drafter, the topic or notes a Member enters are sent to Anthropic to generate draft questions. Participants' answers, names and reports are never sent. Under Anthropic's commercial terms, API inputs and outputs aren't used to train its models, and are kept only for a limited period for safety and abuse monitoring under its data-retention policy. Don't paste personal data or confidential material into the drafter.
Transfers outside your country
Some providers above are in other countries, including the United States. Where Data Protection Law requires it, we rely on adequacy decisions, standard contractual clauses or another lawful transfer mechanism, and our contracts with providers require them to protect the data. [to confirm with counsel for each provider]
How long we keep it
- Reports: workspace Owners and Admins choose: forever, or 30, 90, 180, 365 or 730 days. Older reports and closed challenges are deleted automatically.
- Workspaces, quizzes and accounts: until you delete them, or 30 days after your agreement ends (see the terms). Deleting removes data from the live database straight away. Backup copies are overwritten within [to confirm: e.g. 35 days].
- Sign-in sessions: 14 days after last use. Password-reset links expire after 60 minutes, and invitations after 7 days.
- Demo requests: up to 24 months after our last contact, unless you become a customer. [to confirm]
- Usage events and stored outgoing emails: up to 24 months. [to confirm]
- Audit log: for the life of the workspace.
How we protect it
Workspace isolation and roles are checked on the server for every request, passwords are hashed, sign-in tokens are stored only as hashes, traffic is encrypted with HTTPS in production, and logs strip passwords, tokens and cookies. The security page explains what we have and haven't done, including that we haven't had an independent security audit yet. If a breach affects your personal data, we'll notify the company concerned without undue delay, and the relevant regulator and affected people where the law requires it.
Your rights
Depending on where you live (for example under the Nigeria Data Protection Act 2023, or the EU or UK GDPR), you may have the right to:
- be told how your data is used, and get a copy of it;
- correct inaccurate data, or have it deleted;
- restrict or object to processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- not be subject to decisions based solely on automated processing that significantly affect you (Wimzi doesn't make such decisions);
- complain to a data protection authority, such as the Nigeria Data Protection Commission (ndpc.gov.ng), or the authority where you live or work.
How to use them: Members can update details and delete their account in Account settings, and Owners can export or delete the whole workspace in Settings. Participants should contact the company that ran the session, which can view and delete its reports; we'll help that company respond. For anything else, contact [to confirm: privacy email]. We'll reply within the time the law allows (normally 30 days) and may need to confirm your identity first.
Children
Wimzi is made for workplace training and isn't directed at children. Companies must not use it with people under 18 without a lawful basis and, where needed, parental or guardian consent. If you think a child's data has been given to us without that, contact us and we'll help the company concerned delete it.
Changes to this notice
We'll post any changes here and update the date below. For significant changes, we'll also tell workspace Owners by email or in the app before they take effect.
Contact
[to confirm: legal entity, address and privacy contact email]. Until then, use the contact form.
Version: 20 October 2026.