Privacy Policy

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is: Pascal Jeising, c/o MDC#753, Welserstrasse 3, 87463 Dietmannsried, Germany. Email: support@questify.tv

We process the following personal data that you provide during registration or that is collected automatically during your use of Questify:

• •Account data: email address, password, display name, username, first name, last name, gender (optional), date of birth (optional), postal code (optional)
• •Session data: an encrypted session cookie, valid for 7 days, used exclusively for authentication. No tracking or analytics cookies are set.
• •Technical fraud-prevention data: IP address (current and history with timestamps), country of origin (determined via a local database, no data sent to third parties), browser and system information, anonymised device fingerprint, device type, timestamp of last activity
• •Platform data: Gems balance, level, quest progress, conversion history (offer ID, provider, event, payout amount, click IP, timestamp)
• •Referral data: referral code, referrer ID, referral history and earnings
• •Payout data: payout method (PayPal or bank transfer), PayPal email address or IBAN, requested Gems and dollar amount, payout status
• •Fraud-prevention logs: records of IP and device changes with previous and current values
• •Visitor data: IP address, country, and visit timestamps of non-authenticated visitors (not linked to any identifiable individual)

• •Art. 6(1)(b) GDPR (Contract performance): account creation and management, offer brokering and processing, payout processing, sending transactional emails (email verification, password reset)
• •Art. 6(1)(f) GDPR (Legitimate interests): fraud detection and platform security, detection of duplicate accounts and VPN/bot abuse, IP and device logging to protect the offer system
• •Art. 6(1)(c) GDPR (Legal obligation): retention of payout records under German commercial and tax law (10 years)

We share personal data only to the extent necessary to provide our services. The following third-party providers receive data:

• •Ayet Studios GmbH (ayetstudios.com, Germany): Your user ID is transmitted via tracking links for offer brokering. Ayet Studios sends us conversion confirmations (offer ID, event type, amount). Legal basis: Art. 6(1)(b) GDPR.
• •CPX Research GmbH (cpx-research.com, Germany): For the survey wall, your user ID and an anonymised token for session validation are transmitted. Legal basis: Art. 6(1)(b) GDPR.
• •Email service provider (SMTP): Your email address and name are used solely to send transactional emails. Legal basis: Art. 6(1)(b) GDPR.
• •MaxMind GeoLite2: We use the GeoLite2 Country database exclusively locally on our server. No data is transmitted to MaxMind.
• •PayPal / banking institutions: For payout requests, your payment details (PayPal email or IBAN) are used solely for manual processing by the operator.

• •Account data: until account deletion, at minimum until all outstanding payout requests are resolved
• •Payout records: 10 years under German commercial and tax law retention obligations
• •IP and device history (fraud prevention): 12 months
• •Fraud-detection logs: 12 months
• •Visitor logs (IP, country, timestamps of non-authenticated visitors): 30 days
• •Temporary tokens (email verification: 24 hours; password reset: 1 hour): automatically deleted upon expiry

Under the GDPR you have the following rights. To exercise them, contact support@questify.tv:

• •Access (Art. 15 GDPR): right to receive a copy of your stored personal data
• •Rectification (Art. 16 GDPR): right to correct inaccurate or incomplete data
• •Erasure (Art. 17 GDPR): right to have your data deleted, subject to any legal retention obligations
• •Restriction of processing (Art. 18 GDPR): right to restrict processing under certain conditions
• •Data portability (Art. 20 GDPR): right to receive your data in a machine-readable format
• •Objection (Art. 21 GDPR): right to object to processing based on legitimate interests

You have the right to lodge a complaint with a data protection supervisory authority. As Questify is operated from Bavaria, Germany, the competent authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Website: www.lda.bayern.de

We implement appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect your data. Passwords are stored as irreversible cryptographic hashes and are never readable in plain text. All data transmissions are encrypted. Sessions are secured against unauthorised access. An automated monitoring system detects unusual access patterns to prevent fraud.

We reserve the right to update this Privacy Policy to reflect changes to our services or legal requirements. Material changes will be announced 14 days in advance by email or on the platform. The date of the last update is shown above.