Trust & compliance

A premium video quiz, GDPR-compliant by design

You sell high-ticket: your prospects trust you with personal data and, for the video, their first name and sometimes their voice. Quiz Funnel was built for GDPR compliance from day one — encrypted data, hosted in Europe, explicit consent and full transparency about AI. You stay in control of your data, at every step.

  • EU hosting
  • Encryption in transit & at rest
  • DPA provided
  • Explicit AI consent
Data hosted in the European Union
100% EUData hosted in the European Union
Default retention, configurable
30 dDefault retention, configurable
Encryption of data at rest
AES-256Encryption of data at rest
Public access to the database
0Public access to the database

GDPR

Who is responsible for what: the roles are clear

The GDPR distinguishes the controller (who decides why and how data is processed) from the processor (who processes data on the controller's behalf). At Quiz Funnel, the split is clear-cut and written in plain language in our data processing agreement.

You

Data controller

As the merchant, you are the one collecting your visitors' answers for your commercial purposes. You define the objective, you own the customer relationship, you decide how long data is kept.

  • You choose the questions and the purposes
  • You inform your visitors and collect their consent
  • You decide the retention period
  • You remain 100% the owner of your data
Quiz Funnel

Data processor

We process data solely on your instructions, to run the quiz and generate the personalized video. We never reuse your data for our own purposes, nor to train models.

  • Processing strictly limited to the service you enable
  • No resale, no profiling for our purposes
  • No model training on your data
  • Sub-processors are framed and listed in the DPA

Your GDPR guarantees, in practice

Visitor consent

The quiz can display your privacy notice and collect clear, traceable consent before any collection. The visitor knows what they're sharing, and why.

Right to erasure

A deletion request? A contact's data can be erased on demand, permanently, with no hidden residual copy. You respond to your visitors with confidence.

Configurable retention

By default we keep data for 30 days, then it is purged automatically. You can shorten or extend this period to match your retention policy.

Portability & access

Export answers and contacts at any time in a reusable format, to respond to an access request or migrate to your CRM.

Data minimization

You collect only what you need: every field is optional by default, and you enable only the ones that serve your purposes.

Traceability

Consent timestamps and access logging: you have the evidence to demonstrate your compliance in case of an audit.

Technical security

Your data is protected at every layer

Compliance without security is worthless. Our architecture isolates your data, encrypts it and locks access down at the lowest level — not just in the interface.

Isolation through RLS

Row-Level Security guarantees that one account can never read another's data. Isolation is enforced by the database itself, not just by application code.

Encryption in transit

Everything travels over HTTPS (TLS). Data at rest is encrypted with AES-256. Your answers never move or sit in plain text.

No public database access

The database is never exposed directly to the internet. Access goes through authenticated layers and least-privilege keys — never an admin key in the browser.

Compartmentalized secrets

API keys, tokens and credentials live in a server-side secrets vault, never in code shipped to the browser nor in a versioned repository.

Backups & continuity

Regular backups and tested restores: a mishandling or an incident won't cost you your data or your leads.

Least privilege

Each service only has access to what it strictly needs. The attack surface is reduced, and a compromised component does not open the whole system.

Image & voice rights

A cloned voice only exists with explicit consent

This is what makes Quiz Funnel unique: the video says the visitor's first name and quotes their answers. That power demands responsibility — the responsibility of voice and image. We handle this topic with absolute rigor.

  • Explicit consent for voice cloning

    Cloning a voice requires the clear, informed agreement of the person concerned. No pre-ticked box, no implied consent: the person whose voice is used knows exactly what they're authorizing, and can withdraw their agreement.

  • AI transparency, owned

    The videos are AI-generated, and we own that. You can tell your visitors: personalization doesn't rely on deception, but on genuine attention to every answer.

  • The first name and answers, not a third party's identity

    The video addresses the visitor with their own data (first name, answers) — information they freely shared with you. It does not impersonate someone else.

  • You stay in control of the voices used

    You decide which voice carries your videos. No voice is added to your account unless you've chosen it and the corresponding consent is in place.

What we will never do

  • Clone a person's voice without their explicit consent
  • Produce a deepfake meant to deceive or impersonate
  • Reuse your data or voices to train our models
  • Sell, rent or share your data with third parties for marketing
Hosting & sovereignty

Your data stays in Europe

Hosting matters as much as encryption. Our data infrastructure is located in the European Union, under the GDPR, to spare you risky international transfers and simplify your compliance.

  • Database and storage hosted in the European Union
  • Subject to the GDPR, with no unframed transfer outside the EU
  • Professional-grade infrastructure, continuously monitored
  • Availability and performance tracked so your campaigns aren't penalized

A Data Processing Agreement (DPA) at your disposal

To formalize the controller / processor relationship, we provide a Data Processing Agreement (DPA) compliant with Article 28 of the GDPR. It lists our commitments, our security measures and any sub-processors.

  • Compliant with Article 28 of the GDPR
  • List of sub-processors and their safeguards
  • Detailed technical and organizational measures
  • Signable before or during your trial period

Frequently asked security questions

Clear answers to the questions legal and compliance teams ask before choosing a quiz tool.

Is Quiz Funnel GDPR-compliant?

Yes. Quiz Funnel acts as a processor under the GDPR, you remain the controller, and a Data Processing Agreement (DPA) compliant with Article 28 frames our relationship. Data is encrypted, hosted in Europe, and we provide visitor consent, the right to erasure and configurable retention.

Who is responsible for the data collected by the quiz?

You, the merchant, are the controller: you define the purposes, inform your visitors and decide the retention period. Quiz Funnel is the processor: we process data only on your instructions to run the service, never reusing it for our own purposes.

Where is the data hosted?

In the European Union. Our database and storage are located in Europe, under the GDPR, to avoid unframed international transfers and simplify your compliance.

How long is data retained?

30 days by default, after which it is automatically purged. This retention period is configurable to match your retention policy, and a contact can be erased at any time on request.

Is the cloned voice legal and ethical?

Voice cloning is only enabled with the explicit consent of the person whose voice is used — no pre-ticked box, no implied consent. We do not produce any deepfake meant to deceive or impersonate, and the AI nature of the videos is transparent.

Is my data used to train your AI?

No. Your data and the voices on your account are never used to train models, nor sold, nor shared with third parties for marketing. They are used solely to run the service you enable.

How do my visitors give consent?

The quiz can display your privacy notice and collect clear, traceable consent before any collection. Consent is timestamped, giving you the evidence to demonstrate your compliance in case of an audit.

Can another account see my data?

No. Row-Level Security (RLS) is enforced by the database: one account can technically never read another's data. Isolation does not rely on application code alone.

Sell with confidence, no compromise on compliance

Launch a personalized video quiz that converts, while keeping full control of your data and your prospects'. Free trial, no credit card required.

Security & GDPR · Quiz Funnel