Privacy policy

1. Who is responsible

Front Space SHPK, a company registered in the Republic of Albania, is the controller of personal data processed through MindQuest, except where you take an assessment for an organization: for the results shared with that organization, the organization is responsible for its own use of them. For any question about your data, write to mindquest@frontspace.io.

We process personal data in accordance with Law No. 124/2024 “On Personal Data Protection” of the Republic of Albania and, where it applies, the EU General Data Protection Regulation (GDPR).

2. What we collect

Data you give us:

• Account: email address, and a password (held by our sign-in provider in hashed form — we never see or store it in plain text). If you sign in with Google, we receive your name, email address and Google profile picture from Google.
• Profile: name, surname, date of birth, age group, school or organization name, nationality, chosen avatar and preferred language.
• Children’s profiles added by a parent: the child’s name and date of birth, and the child’s results.
• Organization participation: the organization’s access code, your name and age as shown to the organization, and the codes you tried to enter.

Data created when you use MindQuest: the questions you were shown, the answers you gave, the time taken, your scores, percentiles and the strength of each skill area, whether a sitting was official or practice, which questions you have already seen (so they are not repeated), and your Daily Zip results and streak.

Technical data: when you use the service, our hosting and database providers record technical information such as IP address, browser type and the time of the request, for security and to keep the service running. Your browser stores your sign-in session and a few preferences (language, theme) in its own storage on your device. We do not use advertising or analytics cookies.

3. Google sign-in and Google user data

You can sign in to MindQuest with your Google account. This section describes exactly what we receive from Google and what we do with it.

• What we access: when you choose “Continue with Google”, Google shares only your basic profile — your name, your email address and whether it is verified, and your profile picture — through Google’s standard sign-in scopes (openid, email, profile). We do not ask for, and cannot see, your Google password, contacts, Gmail messages, Drive files, calendar or any other Google data.
• How we use it: to create your MindQuest account or sign you in to the one you already have; to fill in your name on your profile (which you can change); and to send you the emails that are part of the service, such as account confirmations. MindQuest does not display or otherwise use your Google profile picture.
• Who we share it with: nobody, except the service providers that run MindQuest for us — our sign-in and database provider Supabase, which stores your account record — and only to provide the service. We do not sell Google user data, do not use it for advertising, and do not transfer it to anyone for any other purpose.
• How we protect it: it is sent over encrypted connections (HTTPS), stored by our sign-in provider in an access-controlled database, and readable only by your own account and by a small number of authorised Front Space staff.
• How long we keep it, and how to delete it: for as long as your MindQuest account exists. To delete your account and the Google data with it, use Account → Delete account (you confirm with Google first), or write to mindquest@frontspace.io from that email address. You can also stop MindQuest’s access at any time in your Google Account, under Security → Your connections to third-party apps & services.

MindQuest’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If we ever change how we use Google user data, we will update this policy and tell you before the change applies.

4. Why we use it, and on what legal basis

• To provide the service — your account, choosing the right assessment for your age, scoring it, keeping your history and your Daily Zip progress: because it is necessary to provide the service you asked for (contract).
• To share results with an organization you joined with its code: necessary to provide that service, and the organization’s own lawful basis for asking you to take part.
• To keep MindQuest secure and fair — preventing abuse, guessing of access codes and tampering with scores: our legitimate interest in a secure and reliable service.
• To improve the assessment — studying how questions perform and calibrating scores, using results without names: our legitimate interest in an accurate test.
• To send emails that are part of the service, such as confirming your email address or resetting your password: necessary to provide the service.
• Children’s profiles: on the instruction and with the consent of the parent or guardian who adds them.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means that have legal or similarly significant effects.

5. Who we share it with

We share personal data only with:

• Supabase — our database, sign-in and server provider, which stores the data and runs the scoring.
• Vercel — which hosts the website.
• Resend — which delivers the emails sent by the sign-in system.
• Google — only if you choose to sign in with Google.
• An organization — only if you joined it with its access code, and only your name, age, results and answers for that organization.
• Authorities — if the law requires it.

Our providers process data on our instructions and under data protection agreements. Some of them may process data outside Albania and the European Economic Area; where they do, the transfer is protected by safeguards recognised by data protection law, such as standard contractual clauses.

6. Children

Accounts are for people aged 13 and over. A child under 13 can use MindQuest only as a profile on a parent’s or guardian’s account. The parent adds the child’s name and date of birth, can see the child’s results, and can remove the child’s profile and results at any time. Areas meant for parents are protected by a question a young child is unlikely to answer.

We collect from children only what the assessment needs, never show them advertising, and never share their data with an organization unless their parent or the organization’s code was used to join it.

7. How long we keep it

• Your account, profiles and results: for as long as your account exists. When you delete your account, its profiles, results and history are deleted.
• Results shared with an organization: for as long as the organization keeps its MindQuest account, unless you ask us to delete them. Deleting your account deletes these results too; the organization keeps only your entry on its participant list (the name, age and age group you joined with).
• Records of attempts to enter access codes: kept for security, and deleted with your account.
• Technical logs kept by our providers: for the short periods their services require.
• Anonymous statistics about how questions perform may be kept after the data they came from is deleted, because they no longer identify anyone.

8. How we protect it

Data travels over encrypted connections (HTTPS). The database only lets each account read its own rows, and scores are calculated and written by our server so they cannot be changed from a browser. Passwords are held in hashed form by the sign-in provider. Only a small number of authorised Front Space staff can access the administration console. No system is perfectly secure, but we take reasonable steps to protect your data and will tell you, and the authorities where required, if a breach puts you at risk.

9. Your rights

You have the right to:

• see the personal data we hold about you and get a copy of it;
• have inaccurate data corrected — including a wrong date of birth;
• have your data deleted;
• restrict or object to how we use your data;
• receive your data in a portable format;
• withdraw consent where we rely on it, such as for a child’s profile.

To use any of these rights, write to mindquest@frontspace.io from the email address on your account. We will answer within one month. You can also complain to the data protection authority — in Albania, the Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) — or to the authority in the country where you live.

10. Changes to this policy

We will update this policy when what we do with data changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it applies.

11. Contact

Front Space SHPK — MindQuest. Email: mindquest@frontspace.io.