Privacy Policy

Effective date: February 28, 2026

This Privacy Policy explains how LEZO (Questovery) collects, uses, stores, and protects your data when you use the Questovery mobile app and website.

1. Data controller

LEZO (EURL) 21 boulevard Auguste Pageot, 44000 Nantes, France

Support: [email protected]
DPO: [email protected]

2. Data we process

Depending on your use, we may process:

Account data: email address, password (securely stored), username, organization.
Content data: quests, steps, answers, media (image/audio/video), team and player names.
Technical data: device model, operating system, app version, technical logs, errors.
Notification data: push token if notifications are enabled.
Location data (if permission is granted):
- Precise GPS location during an active quest to unlock nearby steps.
- GPS route trace (sequence of points) during gameplay.
- If background location permission is granted, route recording may continue while the app is not on screen, only during an active quest.

3. Purposes

We process your data to:

Provide app and website features.
Authenticate users and secure accounts.
Unlock geolocated steps and record gameplay routes.
Display route history and results after the game.
Send notifications if enabled.
Improve reliability, performance, and user experience.

4. Legal bases

Depending on context, processing is based on:

Contract performance (providing requested features).
Consent (e.g. permissions, analytics where required).
Legitimate interests (security, abuse prevention, service improvement).
Compliance with legal obligations.

5. Location data – key information

Location is used only if you grant permission on your device.

Foreground location: used during active quests for gameplay (unlocking steps) and route recording.
Background location: used only during an active quest if you grant the dedicated background permission.
User control: you can revoke location permissions at any time in device settings.
GPS trace retention: kept until the related game is deleted.

6. Data sharing

We do not sell personal data.

We may rely on processors (hosting, notifications, payments, analytics, support) strictly to provide the purposes described in this policy, under appropriate contractual safeguards.

7. Cookies and similar technologies (website)

The website may use:

Strictly necessary cookies (session, authentication, preferences).
Analytics/performance cookies where consent is required by law.

You can manage your preferences at any time through the consent interface.

8. Retention periods

Account data: until account deletion, then residual legal/technical retention where necessary.
Notification data: while notifications are enabled.
Analytics data: according to the retention settings of the analytics tool.
GPS traces: until the related game is deleted.

9. Security

We implement appropriate technical and organizational measures, including access controls, encryption in transit, logging, monitoring, and security procedures.

10. Your rights (GDPR)

You have rights including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.

To exercise your rights:

From the app where available (e.g. account deletion).
By email: [email protected] or [email protected].

You may also lodge a complaint with your competent data protection authority.

11. Transfers and hosting

We prioritize processing and hosting in the European Union. If a transfer outside the EU is required for specific providers, we implement safeguards required by applicable law.

12. Policy updates

We may update this policy to reflect legal, technical, or product changes. The latest published version applies.