Questana Logo

Privacy Policy

Effective Date: July 1, 2025

1. Who We Are

Questana Limited, registered in Ireland, provides interactive scavenger-hunt games. Contact us at privacy@questana.ai.

2. Data We Collect

  • Email address (for bookings)
  • Player name and quest code (for login)
  • Payment metadata via Stripe
  • Chat messages, answers, and feedback
  • Device location (to support gameplay and verify presence at quest locations)
  • Technical details (IP, browser, device type)
  • Notifications (if permissions are granted)
  • Promotion entry and submission data
  • Identity verification information where needed for prize claims
  • Limited winner announcement data, such as first name, team name, city, score and prize won

3. How We Use Your Data

We use your data for the following purposes:

  • Registering and managing your booking (Contract)
  • Facilitating gameplay and chat responses (Contract)
  • Supporting gameplay using location-based quest mechanics (Contract)
  • Processing payments via Stripe (Contract)
  • Administering prize promotions, verifying eligibility, contacting winners, arranging prize fulfilment, and preventing fraud or misuse (Contract / Legitimate Interest)
  • Sending optional promotional updates (Consent)
  • Improving services and ensuring security (Legitimate Interest)

4. Data Retention

We retain data as follows:

  • Contact, booking, and payment info: 2 years
  • Chat logs, answers, feedback, and location data: 4 years
  • Analytics: anonymized within 12 months

You may request deletion by contacting us at the above email.

5. Third-Party Services

We use trusted processors:

  • AWS (hosting, storage) – EU
  • Stripe (payments) – EU
  • Vercel (web hosting) – EU
  • OpenAI (AI chat processing) – EU/US with SCC safeguards
  • PostHog (product analytics) – EU
  • Google Ads (conversion tracking & remarketing) – US, with SCC safeguards

Data is not sold or rented. Transfers outside the EU are protected with Standard Contractual Clauses (SCCs).

6. Security

  • HTTPS on all services
  • Role-based access control
  • Backend multi-factor authentication
  • Unique access codes for games

7. Analytics

We use PostHog to understand how visitors interact with our website. PostHog collects anonymised behavioural data including page views, button clicks, and booking funnel events (e.g. booking started, checkout completed, feedback submitted). This data is processed in the EU and is used solely to improve our service. No personally identifiable information is attached to analytics events except where you have progressed through the booking flow, at which point your email address may be used to associate events with your session via posthog.identify.

8. Cookies

We use three categories of cookies, all managed through our consent banner:

  • Essential cookies — required for the site to function (e.g. session continuity). Always active.
  • Analytics cookies — set by PostHog to understand how visitors interact with the site (page views, booking funnel events). Only loaded with consent.
  • Advertising cookies — set by Google Ads for conversion measurement and remarketing. These allow us to measure whether an ad click led to a booking and to show relevant ads to past visitors. Only loaded with consent. See Google's Privacy Policy for details on how Google uses this data.

9. Your Rights

Under GDPR, you may access, correct, delete, or object to the processing of your data, withdraw consent, or file a complaint with a supervisory authority. Contact us to exercise these rights.

10. Prize Promotions and Winner Publicity

Where Questana offers cash prizes, rewards, promotional competitions or other incentives, we may collect and use personal data to administer the promotion, verify eligibility, validate scores or results, contact winners, arrange payment or delivery of prizes, prevent fraud or misuse, and comply with legal or regulatory obligations.

This may include information such as player or team name, booking details, contact information, game activity, score data, identity verification information, and any information reasonably required to confirm eligibility or deliver a prize.

If we announce the outcome of a promotion, we may publish limited winner information where reasonably necessary to identify the winning result and promote the competition, such as a winner's first name, team name, city or quest completed, score and prize won.

We will not publish a winner's full name, photograph, video, social media handle, testimonial, interview, likeness or other additional identifiable promotional content without first requesting separate permission, unless otherwise permitted or required by law.

Any personal data collected or used in connection with prize promotions, winner verification, payment, winner announcements or publicity will be handled in accordance with this Privacy Policy and applicable data protection law.

11. Children's Privacy

We do not knowingly collect data from children under 16. Quests must be booked by adults aged 18 or over.

12. Changes

Updates to this policy will be posted with a revised Effective Date.