Privacy
Effective Date: June 13, 2026
Questovery Privacy Policy
Version 1.0 - effective as of May 27, 2026.
Reference language notice: This English translation is provided for convenience only. In case of discrepancy, inconsistency, or interpretation difference, the French version shall prevail.
This Privacy Policy describes how LEZO, publisher of Questovery, processes personal data in connection with the use of the Questovery website, mobile application and services.
1. Data Controller and Contact
LEZO (EURL)
21 boulevard Auguste Pageot
44000 Nantes
France
- Support contact: [email protected]
- Personal data contact: [email protected]
Depending on the processing operation, LEZO may act as a separate data controller or as a processor on behalf of a professional customer using Questovery.
2. Roles of LEZO and the Customer
LEZO acts as data controller for its own processing operations, including website management, accounts, authentication, security, support, technical administration, billing, service improvement, legal obligations and defense of its rights.
When Questovery is used by a professional customer to create, administer or operate a quest, that customer may act as data controller for data related to its participants, players, teams, content, routes, media, participation conditions, commercial offers and relationships with its own users. In this case, LEZO processes certain data on behalf of the customer, as processor.
The customer remains responsible for informing its own users where processing falls within its purposes, content, participation rules or relationship with them.
3. Data We Process
Depending on your use, we may process the following categories of data:
- account and identification data: email address, identifier, first name, last name, pseudonym, role, organization, team, account status
- authentication and security data: securely stored passwords, login links or codes, connection logs, security events
- content data: quests, steps, texts, questions, answers, hints, scenarios, media, images, sounds, videos, files, team and player names
- participation data: joined quest, team, progress, answers, score, ranking, history, feedback, game status, timestamps
- location data, where the feature is enabled and permission is granted: GPS position, geolocated validation events, movement trace during an active quest
- notification data: push token, preferences and sending status where notifications are enabled
- payment and billing data: plan, prepaid credits, order references, transaction identifiers, payment status, invoices and information necessary to manage payment
- technical data: IP address, device model, operating system, browser, app version, technical logs, errors, diagnostic and performance data
- support data: requests, exchanges, attachments, information shared to resolve a question or incident.
4. Purposes and Legal Bases
We process personal data for the following purposes:
| Purpose | Examples of data | Main legal basis |
|---|---|---|
| Providing Questovery services | account, organization, quest, team, progress, content, media | contract performance or legitimate interest depending on context |
| Authentication and access management | email, identifiers, roles, invitations, QR codes, access links | contract performance, legitimate interest |
| Quest participation | team, answers, progress, score, ranking, feedback | contract performance or processing performed on behalf of the customer |
| Gameplay geolocation | position, trace, geolocated validations | consent or device permission, performance of the requested feature |
| Photos, videos and media | provided or collected media, associated consents | consent, service performance or customer responsibility depending on context |
| Payment and billing | plan, credits, payment references, invoices | contract performance, legal obligation |
| Support and maintenance | support request, logs, diagnosis | legitimate interest, contract performance |
| Security and abuse prevention | logs, security events, IP address, technical identifiers | legitimate interest, legal obligation where applicable |
| Improvement and usage measurement | technical data, usage events, aggregate statistics | legitimate interest or consent where required |
| Compliance with legal obligations and defense of rights | invoices, evidence, necessary logs | legal obligation, legitimate interest |
5. Geolocation
Location is used only if the feature is enabled in the relevant quest and you grant the necessary permissions on your device.
Location may be used to unlock nearby steps, validate geolocated objectives, record a trace during an active game, display a route or produce results linked to the quest.
Where background location permission is granted, trace recording may continue while the application is not displayed, only during an active quest and for the needs of the relevant feature.
You can withdraw location permissions at any time from your device settings. Some quest features may then no longer work properly.
6. Recipients and Processors
Depending on the case, data may be accessible to the following persons and categories of recipients:
- LEZO and authorized persons involved in operating, supporting, maintaining, securing, billing or administering the service
- the professional customer or organizer responsible for the quest, within the limits necessary to administer, monitor and operate the quest
- members of a team or other participants in the same quest, where this visibility is necessary for the operation of the quest, scores, rankings, results or media feeds
- technical providers necessary for the service, including hosting, storage, transactional email, notification, payment, mobile distribution, monitoring, error management, support, analytics or mapping where these services are enabled
- administrative or judicial authorities where required by law.
We do not sell your personal data.
7. Payments
Where payments, subscriptions, prepaid credits or in-app purchases are offered, they may be processed by payment providers or app stores. LEZO does not directly process full bank card data where payment is operated by a specialized provider.
Payment providers or app stores may act under their own terms and privacy policies for processing operations they perform as independent controllers.
8. Cookies and Similar Technologies
The website may use cookies or similar technologies that are strictly necessary for the service to operate, including for session, authentication, security or preferences.
Audience measurement cookies or tools may be used where permitted by law or where your consent has been collected. You can manage your preferences from the consent interface where displayed.
9. Retention Periods
Data is retained for a period appropriate to its purpose, unless there is a legal obligation, evidentiary need, security need, dispute, valid deletion request or technical constraint.
| Category | Indicative period |
|---|---|
| Account data | Duration of the account, then residual period necessary for evidence, security or legal obligations. |
| Quest, team, progress, answer and score data | Duration necessary to operate the quest and relationship with the relevant customer, then deletion or anonymization according to applicable settings. |
| Photos, videos and media | Duration necessary for the intended use in the quest or service, unless deleted, instructed otherwise by the customer or justified retention applies. |
| Location data and traces | Duration necessary for quest operation, displaying results or support, then deletion or anonymization according to applicable settings. |
| Payment and billing data | Duration necessary for contractual, accounting and tax management. |
| Technical and security logs | Duration limited to security, diagnosis, support and evidence needs. |
| Support data | Duration necessary to handle the request, then reasonable retention for evidence and support improvement. |
| Cookies and analytics | Duration defined by the tool and applicable consent choices. |
Where LEZO processes data on behalf of a customer, some retention periods may be determined by that customer or by the applicable contract.
10. Security
LEZO implements reasonable technical and organizational measures designed to protect personal data, including access controls, encryption in transit, logging, monitoring, limiting access to authorized persons, backups or security procedures adapted to the service.
No online service can guarantee absolute security. In the event of an incident affecting personal data, LEZO takes the necessary measures in accordance with applicable regulations and, where LEZO acts as processor, informs the relevant customer under the agreed conditions.
11. Transfers Outside the European Union
We prioritize processing and hosting in the European Union. Some providers or third-party services may nevertheless involve a transfer outside the European Union where necessary for the service or the operation of an enabled provider.
Where safeguards are required by applicable law, LEZO implements appropriate safeguards or relies on safeguards provided by the relevant provider.
12. Your Rights
You have, under the conditions provided by regulations, the rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent where processing is based on consent, and the right not to be subject to an automated individual decision where applicable.
You can exercise your rights:
- from the application where the feature is available
- by email at [email protected].
Where your request concerns processing performed by LEZO on behalf of a customer, LEZO may forward your request to the relevant customer or invite you to contact that customer.
You may also lodge a complaint with the CNIL or your competent supervisory authority.
13. Minors
Questovery may be used in contexts organized by professional customers. Where minors participate in a quest, the customer or organizer remains responsible for determining the applicable information, authorization, consent or supervision conditions.
14. Policy Updates
We may amend this Privacy Policy to reflect legal, technical, functional or contractual developments. The latest published version applies.