Privacy Policy

SnapSprint AI Pvt Ltd (operating as “Questly”) (“Questly,” “we,” “us,” or “our”) operates the Questly platform — an AI-powered interactive learning service for real-world skills. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and Service.

Questly uses artificial intelligence to generate interactive learning content. This policy specifically addresses how AI processes your data.

By using Questly, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

SnapSprint AI Pvt Ltd
712, Mahagun Maestro, Sector 50, Noida 201301, Uttar Pradesh, India

a) Account Information

When you create an account, we collect your name and email address through our authentication provider, Clerk. You may also provide an optional profile photo and phone number. Authentication credentials are managed by Clerk.

b) Profile & Preferences

You may provide additional profile information including your pronouns (he/him, she/her, they/them, or custom), country of residence, AI voice preference (nova, sage, spark, echo), skill interests (e.g., negotiation, conflict resolution, feedback), and onboarding progress.

c) Scenario Data

When you create a Quest, you describe real-life situations you want to practice. These may contain sensitive personal details about your relationships, workplace, or other aspects of your life. We treat scenario data with the highest level of care and confidentiality.

d) AI Interaction Data

We store the following AI-related data:

• AI-generated scenario designs (characters, locations, teaching plans)
• Learning context narratives
• Turn-by-turn conversation history (your messages and AI character responses)
• Your choices at each decision point
• AI-generated feedback on your choices (with tone analysis)
• Post-game reflection, coaching insights, and pattern recognition results

e) Payment Data

Payment information is processed securely by Stripe. Questly does not store your credit card numbers, bank account details, or other financial information on our servers. We retain only transaction IDs, subscription status, and your Stripe Customer ID (stored in authentication metadata).

f) Device & Usage Data

We collect device type, browser, operating system, IP address, pages visited, features used, and session duration. This data is collected via PostHog (product analytics), Google Analytics (website analytics), Vercel Analytics (performance), and Sentry (error tracking).

We also record anonymized session replays for approximately 10% of sessions. In replays, all text content is automatically masked and all media (images, videos) is blocked.

We use your information to:

• Deliver and operate the Service, including generating personalized AI scenarios
• Personalize your learning experience based on your scenario history and preferences
• Process payments and manage your subscription
• Analyze usage patterns to improve the Service and develop new features
• Ensure the security and integrity of the Service
• Respond to support requests and communicate service updates
• Generate personalized AI voice narration for scenarios (via ElevenLabs)
• Send transactional emails (account confirmations, subscription updates) via Resend
• Deliver in-app notifications about quest progress and account activity (via Knock)
• Protect the Service from abuse, bots, and DDoS attacks (via Arcjet)
• Enforce rate limits to ensure fair usage across all users
• Enable real-time collaboration features (via Liveblocks)
• Comply with legal obligations

To generate interactive scenarios and personalized learning experiences, your data is processed through a multi-phase AI pipeline. Below is a detailed description of each phase.

Briefing Phase — When You Start a Quest

We send Google Gemini your skill topic and profile context (name, pronouns, country, skill interests). Gemini generates a scenario including characters, locations, a teaching plan, and a learning narrative.

Runtime Phase — During Gameplay (Each Turn)

We send Google Gemini the briefing context, your full conversation history so far, your selected choice, and all previous feedback. Gemini generates the next story beat, NPC dialogue, feedback on your choice, and new options.

Endgame Phase — After Completing a Quest

We send Google Gemini the complete conversation history, all feedback, and briefing context. Gemini generates reflection, coaching insights, and pattern recognition analysis.

Voice Synthesis

ElevenLabs receives AI-generated narrative text and character dialogue for voice synthesis. ElevenLabs does not receive your personal scenario descriptions — only the AI-generated story content.

Key Commitments

• Your data is not used to train Google’s or ElevenLabs’ AI models
• Your scenarios and conversations are never shared with other users
• You may request deletion of all your AI interaction data at any time

We do not sell your personal information. We do not share your data for marketing purposes. We share data only with the following service providers who process it on our behalf:

AI & Content Generation

• Google Gemini — AI scenario generation and conversation (receives scenario data, profile context, conversation history)
• ElevenLabs — Voice synthesis (receives AI-generated narrative text only)

Authentication & User Management

• Clerk — Authentication, user profiles, organization management (manages credentials, email, name, phone, photo)

Payments

• Stripe — Payment processing (handles card data; Questly stores only customer ID and subscription status)

Analytics & Monitoring

• PostHog — Product analytics (receives user identification on lifecycle events: email, name, avatar; tracks events; session replay at 10% with text masking)
• Google Analytics — Website analytics (page views, device info, IP-based geography)
• Vercel Analytics — Web performance metrics (Core Web Vitals, page speed)
• Sentry — Error tracking and performance (console logs, error context, session replay at 10% with text/media masking; 100% on errors)
• BetterStack — Log aggregation and monitoring (application logs, error context)

Infrastructure & Hosting

• Neon — PostgreSQL database hosting (stores all user profiles, game sessions, preferences)
• Vercel — Application hosting, edge functions, serverless infrastructure
• Vercel Blob — File storage for user-uploaded content
• Upstash Redis — Distributed rate limiting (transient counters keyed by user/IP)

Communication

• Resend — Transactional email delivery (recipient email, email content)
• Knock — In-app notifications (user ID, notification events)

Security & Integrity

• Arcjet — Bot detection, DDoS protection (IP addresses, request metadata)
• Svix — Webhook infrastructure (authentication and payment event payloads, signature verification)

Collaboration

• Liveblocks — Real-time collaboration features (user ID, presence data, room state)

Content Management

• BaseHub — Headless CMS for marketing content (does not receive user data)

We may also disclose information if required by law, regulation, legal process, or governmental request.

We retain your data according to the following schedule:

• Account & profile data — While active + 30 days after deletion
• Game sessions (scenarios, conversations, feedback, endgame) — While active + 30 days after deletion
• Analytics data (PostHog, Google Analytics) — Up to 13 months
• Error logs (Sentry) — 90 days
• Application logs (BetterStack) — 30 days
• Rate limiting data (Upstash) — Transient (minutes)
• Webhook delivery logs (Svix) — Per Svix retention policy
• Payment records — As required by applicable tax and financial regulations

You may request deletion of your data at any time (see “Your Rights” below).

Legal Basis for Processing (GDPR Article 6)

• Consent — Analytics cookies, marketing communications
• Contractual necessity — Account management, service delivery, AI processing for quest generation
• Legitimate interest — Security, fraud prevention, service improvement, rate limiting

For EU/EEA Residents (GDPR)

You have the right to:

• Access your personal data and obtain a copy
• Rectify inaccurate or incomplete data
• Erase your personal data (“right to be forgotten”)
• Port your data to another service
• Object to certain types of data processing
• Withdraw consent at any time (analytics, marketing)
• Lodge a complaint with your supervisory authority
• Restrict processing of your personal data

For California Residents (CCPA/CPRA)

You have the right to:

• Know what personal information we collect and how it is used
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale of personal information (note: we do not sell personal information)
• Opt-out confirmation — We visibly confirm when your opt-out has been processed
• Non-discrimination for exercising your privacy rights

For Indian Residents (DPDPA 2023)

You have the right to:

• Access information about your personal data
• Correction and erasure of personal data
• Grievance redressal — Contact our Grievance Officer at privacy@questly.life
• Nomination — Nominate another person to exercise rights in case of death or incapacity

Automated Decision-Making (GDPR Article 22)

Our AI generates scenarios, dialogue, and feedback based on your inputs. These are educational simulations — not decisions producing legal or similarly significant effects. You always choose how to respond; you are not bound by AI-generated content.

How to exercise your rights: Contact privacy@questly.life. We respond to verified requests within 30 days (GDPR/DPDPA) or 45 days (CCPA).

We use the following categories of cookies:

1. Essential

Clerk authentication sessions, CSRF tokens, locale preference. Required for core functionality. Cannot be disabled.

2. Analytics

PostHog (product analytics) and Google Analytics (website traffic). Track page views, feature usage, and session patterns. Can be disabled.

3. Functional

User preferences (voice preset, theme settings). Enhance experience but not required for core functionality.

4. Marketing

Currently not active. No marketing cookies are set by default.

Session Replay

PostHog and Sentry record anonymized session replays for approximately 10% of sessions (100% when errors occur). All text content is automatically masked in replays, and all media (images, videos) is blocked from replay recordings. Session replays help us identify usability issues and debug errors.

Analytics Infrastructure

We route analytics data through our domain to ensure consistent functionality for all users. This does not change what data is collected or how it is processed.

How to Opt Out

• Analytics cookies: Manage via browser settings or our cookie preferences
• Google Analytics: Install Google’s opt-out browser add-on
• Essential cookies cannot be disabled (required for authentication)

Questly is designed for users aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at privacy@questly.life.

We take the security of your data seriously and implement appropriate technical and organizational measures, including:

• Encryption in transit using TLS for all data transmissions
• Access controls limiting data access to authorized personnel only
• Regular security reviews of our infrastructure and practices
• Bot detection and DDoS protection (Arcjet) to prevent malicious access
• Distributed rate limiting to prevent abuse
• Webhook signature verification (Svix) to ensure data integrity
• Text masking in session replays to protect user content in error reports
• Secure authentication via Clerk with industry-standard credential management

In the event of a data breach that may affect your personal information, we will notify affected users and relevant authorities as required by applicable law.

SnapSprint AI Pvt Ltd is based in India. Your data is stored and processed on servers located in the United States through our infrastructure providers (Vercel, Neon).

Data transits through US-based processors including Clerk, Stripe, PostHog, Sentry, ElevenLabs, Google (Gemini), Resend, and other services listed in Section 5.

For EU/EEA users: transfers are conducted under Standard Contractual Clauses (SCCs) where applicable. For Indian users: transfers are conducted in compliance with DPDPA cross-border data transfer provisions.

We ensure all third-party processors provide adequate data protection safeguards.

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or through a prominent notice on the Service at least 30 days before the changes take effect. We encourage you to review this page periodically for the latest information.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• General legal inquiries: legal@questly.life
• Privacy-specific requests: privacy@questly.life
• Support: support@questly.life
• Grievance Officer (DPDPA): privacy@questly.life
• Website: questly.life
• Mailing address: 712, Mahagun Maestro, Sector 50, Noida 201301, Uttar Pradesh, India

In compliance with California SB 243 (effective January 2026) and EU AI Act Article 50, we disclose the following:

• Questly uses AI (Google Gemini) to generate all in-game content: scenarios, character dialogue, feedback, and coaching insights
• When you interact with characters during a Quest, you are interacting with AI-generated personas, not real people
• AI-generated voice narration is synthetic (produced by ElevenLabs), not recorded human speech
• AI outputs may occasionally be inaccurate, incomplete, or contextually inappropriate
• AI-generated content is not professional advice (legal, medical, psychological, financial)
• We do not use AI to make automated decisions that produce legal or similarly significant effects on you
• Your personal data is not used to train any AI models (Google Gemini or ElevenLabs)

This Privacy Policy is governed by the laws of India. For disputes relating to this policy, courts in Noida, Uttar Pradesh, India shall have jurisdiction.

Nothing in this section limits your rights under GDPR, CCPA, or other applicable privacy laws.