Privacy Policy

Data we use

We process login email addresses and session data; school, role and membership details; exam drafts, instructions, generated questions, approved versions and audio files; service usage and administrative audit records. OTP rate limiting uses keyed hashes of email addresses and IP addresses.

Why and how

We use this data to authenticate users, manage access, create and publish exams, provide AI and audio features, secure the service and handle support. Data comes from users, school administrators, application requests and service activity. Essential session and workspace selection cookies support sign in.

Access and demo requests

When the public request form is enabled, we collect the full name, email address, request type, interface language and any organisation or message you provide directly through the form. An organisation is required for a demo request. We process these details on the server and store them in the service database with restricted access to review and manage your request. Submitting does not create an account, grant access, subscribe you to marketing or send an automatic reply to you. When internal notifications are enabled, the SMTP server sends only the request type, submission time and a link to the administration page to an authorised organisational inbox. Your name, email address, organisation and message are not included in this notification. Acceptance by the mail server does not confirm inbox delivery. Do not include student information or confidential exam content. Contact details are not sent to AI providers or added to analytics events.

For abuse prevention, the application uses keyed HMAC summaries rather than storing the raw IP address in request records. This does not describe hosting providers' infrastructure access logs, whose handling has not been audited. Request records are retained for 90 days from submission and deleted during the daily cleanup after that period; abuse-prevention state expires after 48 hours and is also cleaned up daily. These schedules apply to application records and do not guarantee deletion from backups, hosting logs, notification-provider systems or recipient mailboxes. Notification-provider and mailbox retention must be assessed separately. Contact us for access, correction or deletion requests.

Service providers

Supabase provides authentication, database and private file storage. When configured, the configured SMTP server delivers internal request alerts without the submitted contact fields or message. OpenAI receives exam instructions or content when AI generation or speech is requested. Vercel hosts the application and provides cookieless Web Analytics with query strings, fragments and record IDs removed from reported URLs. With optional consent, Microsoft Clarity measures navigation, clicks, heatmaps and session recordings on limited admin and teacher pages. Clarity is off until consent is given; advertising storage is denied. We do not send a Clarity identify call or custom events.

Retention and deletion

Draft deletion removes related database records, but deletion of all stored audio files is not currently guaranteed. Published exam versions and administrative audit records are kept as immutable records. No general account deletion flow or uniform retention period has been established. Microsoft documents 30 days for ordinary Clarity playback and 9 months for click/heatmap data and labelled or favourited sessions. Contact us to request access, correction or deletion.

International processing

These providers may process data outside Türkiye. Provider documentation alone does not confirm Exam Studio’s applicable transfer mechanism or processing region; these details require operational and contractual verification before production use.