Privacy Policy

Last updated: [Insert Date]

Gradeet ("Gradeet", "we", "us", or "our") provides a computer-based testing and examination management platform used by schools, tutorial centres, corporations, and other organisations ("Organisations" or "Customers") globally. This Privacy Policy explains what personal data we collect, why we collect it, how it is used and protected, and the choices available to you when you use Gradeet's website, applications, and services (together, the "Service").

This Policy applies to Organisation administrators and staff, exam supervisors/invigilators, and students or candidates ("End Users") who take exams through the Service. Please read it alongside our Terms and Conditions.

1. Who Is Responsible for Your Data

Gradeet Technologies [Ltd.] ("Gradeet"), a company [to be incorporated / incorporated] under the laws of [Insert Jurisdiction], with registered address at [Insert Registered Address], is the operator of the Service.

2. Information We Collect

2.1 Information Organisations and staff provide directly

  • Account details: full name, email address, phone number, password (stored as a salted hash), job title, and organisation name.
  • Organisation/billing details: business or school name, address, tax or registration details where applicable, and subscription plan.
  • Content you create: exam questions, question banks, marking schemes, exam schedules, and reports.
  • Communications: messages you send to our support team, feedback, and survey responses.

2.2 Information about students and exam candidates

This information is typically uploaded by an Organisation administrator, or entered by the student when creating an exam session:

  • Identity data: full name, student/candidate ID, class or grade, email address or phone number (where used for exam access).
  • Exam data: responses submitted, scores, time taken, flagged-for-review markers, and essay answers submitted for grading.
  • Proctoring and anti-cheating signals: tab-switch and full-screen-exit events with timestamps, connection/heartbeat status, browser and device fingerprint, and — only on plans where AI webcam proctoring is enabled and the Organisation has activated it — periodic webcam images or short video snapshots captured during the exam session.

2.3 Information collected automatically

  • Device and log data: IP address, browser type and version, operating system, device identifiers, and referring URLs.
  • Usage data: pages viewed, features used, and timestamps of activity, collected to keep the platform reliable and secure.
  • Cookies and similar technologies: see Section 9 (Cookies) below.

2.4 Payment information

Subscription payments are processed by our third-party payment processors (e.g., Stripe). Gradeet does not collect or store full card numbers, CVV codes, or bank account credentials on its own servers. We receive limited transaction metadata from these processors (e.g., amount, currency, payment status, and a masked reference), which we use to activate and manage subscriptions.

3. How We Use Personal Data

  • Provide the Service: to create accounts, deliver exams, auto-grade objective questions, generate performance reports, and support essay marking.
  • Exam integrity: to detect and flag possible cheating (tab switching, full-screen exits, connection loss, device changes) and to give supervisors real-time visibility during a live exam.
  • Billing: to process subscription payments, send invoices/receipts, and manage plan upgrades, downgrades, or cancellations.
  • Communication: to send service notices, security alerts, exam reminders, and — where you have opted in — product updates and marketing.
  • Security: to detect, investigate, and prevent fraud, abuse, unauthorised access, and technical issues.
  • Improvement: to understand how the Service is used so we can fix bugs and build features; we prefer aggregated or de-identified data for this wherever possible.
  • Legal compliance: to comply with applicable law, respond to lawful requests from public authorities, and enforce our Terms and Conditions.

4. Legal Basis for Processing

We rely on one or more of the following legal bases for processing personal data: performance of a contract with the Organisation or user; the Organisation's or user's consent; our legitimate interests in operating, securing, and improving the Service (balanced against your rights); and compliance with a legal obligation.

Where the EU/UK GDPR applies, the same categories of legal basis apply under Articles 6 and 9 of the GDPR. Special category data (such as data revealing disability accommodations requested for an exam) is processed only where a valid basis under applicable law exists, such as explicit consent or substantial public interest.

5. Anti-Cheating and Proctoring Monitoring — Special Notice

Because exam integrity is core to the Service, Gradeet processes behavioural signals (tab switches, full-screen exits, connection status, device/browser fingerprint) for every exam by default, and — only where an Organisation on an eligible plan enables it — periodic webcam captures for AI-assisted proctoring.

  • Organisations must clearly inform students/candidates, in advance of any exam, that these monitoring features are active, and must obtain any consent required under applicable law (including from parents/guardians for minors) before enabling webcam proctoring.
  • Gradeet does not use webcam captures for any purpose other than exam-integrity review by the Organisation's supervisors, and does not sell or share this data with advertisers or unrelated third parties.
  • Flagged events and any webcam captures are retained only for the period reasonably necessary for the Organisation to review results and resolve integrity disputes (see Section 8, Data Retention), after which they are deleted or anonymised.

6. Children's and Students' Data

Many End Users of the Service are secondary school students, some of whom are under 18 or under the age of consent in their jurisdiction. Gradeet relies on the Organisation (school, tutorial centre, or corporate customer) to obtain any consent from a parent, guardian, or the student required by law before uploading a minor's personal data to the platform or enabling monitoring features such as webcam proctoring. Gradeet does not knowingly collect personal data directly from children outside of this Organisation-mediated context, and does not use student exam data for behavioural advertising.

7. How We Share Information

We do not sell personal data. We share personal data only in the following circumstances:

  • Within the Organisation: administrators and supervisors at a student's own school/organisation can see that student's exam activity, scores, and integrity flags, as intended by the Service.
  • Service providers (sub-processors): vendors who process data on our behalf under contract, including payment processors (e.g., Stripe); DigitalOcean and AWS (cloud hosting); Cloudflare (content delivery, DDoS/WAF protection); MongoDB Atlas (database hosting, where applicable); and transactional email/SMS providers. These providers are only permitted to use the data to perform services for us.
  • Legal and safety reasons: where required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Gradeet, our users, or the public.
  • Business transfers: if Gradeet is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a policy at least as protective.

8. Data Retention

We retain personal data for as long as the relevant Organisation account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. As a general guide:

  • Exam responses, scores, and reports: retained for the duration of the Organisation's subscription plus [12] months, unless the Organisation exports or deletes them sooner, or requests a longer retention period.
  • Proctoring/anti-cheat logs and webcam captures: retained for [30–90] days after the relevant exam, unless flagged for an active integrity investigation.
  • Billing records: retained for the period required by applicable tax and financial record-keeping laws.

An Organisation may request export or deletion of its data at any time, subject to the Terms and Conditions and any legal retention obligations.

9. Cookies and Similar Technologies

We use cookies and similar technologies (such as local storage) to keep you signed in, remember preferences, secure the platform against fraud, and understand aggregate usage of the Service.

  • Strictly necessary cookies: required for login sessions, exam session continuity, and security; cannot be switched off.
  • Performance/analytics cookies: help us understand how the Service is used so we can improve it.
  • Preference cookies: remember settings such as language or display preferences.

Where required by law, we will present a cookie banner allowing you to accept or manage non-essential cookies. You can also control cookies through your browser settings, though disabling essential cookies may prevent parts of the Service (including exams) from working correctly.

10. International Data Transfers

Gradeet's infrastructure is hosted primarily on servers accessible via DigitalOcean, AWS, and Cloudflare's global edge network, with some data processed on servers located outside your jurisdiction. Where personal data is transferred internationally, we take steps required by applicable data protection laws (and, where applicable, GDPR Chapter V) to ensure an adequate level of protection, such as contractual safeguards with our processors.

11. Data Security

We use industry-standard safeguards to protect personal data, including encryption of data in transit (TLS) and at rest, access controls limiting staff access on a need-to-know basis, and Cloudflare's Web Application Firewall and DDoS protection at the network edge. No system is completely secure, and we cannot guarantee absolute security; we will notify affected Organisations and, where required by law, the relevant regulator without undue delay in the event of a data breach affecting their personal data.

12. Your Rights

Subject to applicable law, you (or, for a student, the Organisation acting on the student's behalf where appropriate) may have the right to:

  • Access the personal data we hold about you and request a copy.
  • Correct inaccurate or incomplete personal data.
  • Request deletion of personal data, subject to legal retention requirements.
  • Object to, or request that we restrict, certain processing.
  • Request a portable copy of certain data (data portability).
  • Withdraw consent at any time, where processing is based on consent.
  • Lodge a complaint with the relevant supervisory authority in your country if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 15. For student data, please contact the student's school or Organisation in the first instance, as they control that data.

13. Third-Party Links and Integrations

The Service may contain links to third-party websites (for example, payment gateway checkout pages) or integrate with third-party services the Organisation chooses to connect. This Policy does not cover those third parties' practices; please review their own privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated version with a new "Last updated" date, and where changes are material, we will provide additional notice (such as an email or in-app notification) before the changes take effect.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, contact us at: