Privacy Policy

Introduction

Questiva Consultants operates an online learning platform for QuickBooks Online textbooks, free tools, and instructor resources. This policy explains what information we collect when you use our site and how we use it. It applies to visitors, learners, teachers, and anyone who creates a Questiva account.

Information we collect

• Account information: email address, name, optional phone number, optional company and job title.
• Payment information, processed by our payment processor, currently Authorize.net. We never store full card numbers; we keep order records (amount, items, status, timestamps).
• Learning activity, tools you use, courses you start, assessments you take, progress on textbooks, Points awarded.
• Group membership, if you join a teacher’s group, your name and progress are visible to that teacher.
• An account your instructor created for you, an instructor who has bought seats for their class can create an account in your name and give you a temporary password to sign in with. That password works once: you are asked to choose your own before you can do anything else, and from that point your instructor cannot sign in as you.
• Technical data: IP address (for security and rate limiting), browser type, pages visited.

How we use information

• To provide and improve the service.
• To send transactional email (login codes, receipts, course updates).
• To send marketing email, only if you opt in.
• To answer your questions in the AI tutor and support chat. Your question, the relevant passage from the book, and a summary of your progress are sent to our AI provider to generate a reply, see Sharing below.
• To fulfil and ship orders, and to calculate sales tax and shipping.
• To enforce our Terms and prevent abuse.
• To comply with legal obligations.

Sharing

We do not sell or share your personal information for advertising, and we do not use your data to train third-party AI models. We share data only with the service providers below, only as needed for them to perform their function, and we may disclose information if required by law.

• Authorize.net, payment processing. Card details are entered in their hosted form and never reach our servers.
• Mailgun: delivery of transactional and marketing email.
• Anthropic: powers our AI tutor and support chat. When you ask a question, your message and the relevant textbook passage are sent to Anthropic to generate an answer, along with a summary of your progress in the book so the answer fits where you are.
• Voyage AI, converts textbook passages and your search queries into the numeric form that makes book search and the tutor work.
• FedEx, shipping rates and address verification. If you order a printed book we send your delivery address to check it is deliverable.
• AccuTrack: our print fulfillment partner. They receive the name, delivery address, email, and contents of physical orders so they can ship them.
• Amazon Web Services and Cloudflare, hosting, storage, and protection against attacks and abuse.

If we add or change a provider that handles personal information, we will update this list.

Cookies and analytics

We use a small number of cookies that are necessary to run the site, keeping you signed in, remembering your reading position, and protecting forms against abuse. These cannot be turned off without breaking the site, and they are not used for advertising.

We also use privacy-friendly analytics to understand which pages and tools are useful. Analytics only runs if you accept it in the banner shown on your first visit, and you can change your mind at any time. Declining does not limit any feature. We do not use advertising cookies, third-party ad networks, or cross-site tracking.

Do Not Track. Some browsers can send a “Do Not Track” signal. There is no common industry standard for interpreting it, so we do not respond to it specifically. Instead we ask for your analytics consent directly, and honour that choice.

Your rights

You can download a copy of your data or delete your account yourself from My account → Settings. You can opt out of marketing email using the unsubscribe link in any marketing message, or from the same settings page. Transactional email (login codes, receipts, shipping notices) is not marketing and continues while your account is open.

You may also ask us to correct information that is wrong, or ask what we hold, by emailing [email protected]. We will not treat you differently for exercising any of these rights.

California privacy rights

If you live in California you have the right to know what personal information we collect and why, to request a copy of it, to ask us to correct or delete it, and to not be discriminated against for asking. The categories we collect and our purposes are listed above; the self-service tools described under Your rights are how you exercise those requests, and they are open to everyone, not just California residents.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

Student records and schools

When a college, school, or instructor uses Questiva with a class, the enrolled learner’s name, email, progress, and assessment results are visible to the instructor who owns that group, and to administrators at the institution that bought the access. We treat that information as belonging to the institution, not to us: we use it only to provide the service they purchased, we do not sell it, and we do not use it for advertising or to build a profile for any purpose other than the learner’s own progress.

An instructor who has bought seats for their class can also create an account on a student’s behalf and hold the initial password, so that a student who cannot reach their email can still sign in. That password is single-use: the student is required to choose their own before the account can be used for anything, and the instructor has no way to sign in as them afterwards. We record which instructor created each account, and the student is told who did.

Where an institution is subject to the Family Educational Rights and Privacy Act (FERPA), we act as a “school official” with a legitimate educational interest and follow the institution’s direction on retention and deletion. An institution can request export or deletion of its learners’ records by emailing [email protected]. We offer a written data protection agreement for institutional purchasers on request.

Data retention

We keep your account data while your account is active. Order records are retained as long as legally required for accounting purposes. You can request deletion at any time; some records may persist in encrypted backups for a short period afterward.

Security

Connections to Questiva are encrypted with TLS. Passwords (when used) are stored as salted bcrypt hashes. We monitor for unusual login activity and rate-limit authentication endpoints. No system is perfectly secure; please use a unique password.

Age

Questiva is built for college, vocational, and professional learners. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, email [email protected] and we will delete it. Instructors running a class that includes learners under 13 must contact us before enrolling them, so we can put the right agreement in place first.

Changes to this policy

We may update this policy as the product evolves. Material changes will be announced by email to active account holders before they take effect.

Contact

Questions about this policy or your data? Email [email protected].