Privacy Policy

1. Introduction

Welcome to the AssessX Privacy Policy. This policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered examination platform. Please read this policy carefully.

2. Information We Collect

2.1 Personal Information

We collect the following personal information:

• Account Information: Name, email address, phone number, role (student/instructor)
• Profile Information: Profile picture, bio, educational institution
• Authentication Data: Password (encrypted), login history, session data

2.2 Academic Information

• Exam Content: Questions, answers, submissions, grades
• Course Data: Course enrollments, assignments, progress
• Performance Data: Scores, feedback, analytics

2.3 Technical Information

• Device Information: IP address, browser type, operating system
• Usage Data: Pages visited, features used, time spent
• Log Data: Error logs, access logs, security logs

2.4 Anti-Cheating Data

When anti-cheating features are enabled, we may collect:

• Screen recording during exams
• Webcam images (if proctoring is enabled)
• Browser activity and tab switching
• Keystroke patterns and timing data

3. How We Use Your Information

3.1 Service Delivery

• Create and manage your account
• Facilitate exam taking and grading
• Provide AI-powered feedback and assessment
• Generate analytics and reports
• Communicate about your account and activities

3.2 AI Processing — No Model Training

AI is used only to produce recommendations (for example a suggested grade and feedback). Your instructor reviews these recommendations and decides what is released. We do not use your data to train or fine-tune any AI model.

3.3 Academic Integrity

• Detect and prevent cheating
• Verify student identity
• Monitor exam sessions for irregularities
• Maintain exam security and fairness

3.4 Service Improvement

• Analyze usage patterns to improve features
• Troubleshoot technical issues
• Develop new features and functionality
• Enhance user experience

4. How We Share Your Information

4.1 With Educational Institutions

If you are using AssessX through an educational institution, we share relevant academic data (grades, submissions, performance) with authorized instructors and administrators.

4.2 Service Providers

We share data with trusted third-party service providers who help us operate the platform:

• Cloud hosting providers (DigitalOcean, Cloudflare)
• File storage (Cloudflare R2)
• AI service providers enabled by your institution, from: OpenAI, Anthropic, Google, xAI, Groq, DeepSeek, Alibaba Cloud (Qwen)
• Email service providers (SendGrid)
• Analytics providers

4.3 Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or to protect our rights, property, or safety.

4.4 What We Don't Share

• We NEVER sell your personal data
• We don't share your data with advertisers
• We don't use your data for unrelated marketing

5. Data Security

5.1 Security Measures

We implement industry-standard security measures including:

• Encryption: All data transmitted using TLS/SSL encryption
• Password Security: Passwords are hashed and salted using bcrypt
• Access Controls: Role-based access with least privilege principle, optional two-factor authentication
• Protection: Sign-in lockout after repeated failures, request rate limiting, and automated blocking of abusive traffic
• Audit Trail: Sensitive actions (sign-ins, role changes, grade releases, impersonation) are logged
• Reviews: Regular internal security reviews

5.2 Data Storage

Your data is stored on secure servers with regular backups. We use reputable cloud providers with industry-leading security certifications.

6. Your Rights and Choices

6.1 Access and Correction

You have the right to access and update your personal information through your account settings or by contacting us.

6.2 Data Deletion

You can request deletion of your account and personal data. Please see our Account Deletion Policy for details. Note that some data may be retained for legal or administrative purposes.

6.3 Data Portability

You can request a copy of your data in a machine-readable format.

6.4 Opt-Out Options

• Unsubscribe from marketing emails via the unsubscribe link
• Disable certain tracking features in your account settings
• Withdraw your consent to AI processing where your institution relies on consent (via the consent prompt in the platform)

7. Cookies and Tracking

7.1 Cookies We Use

• Essential Cookies: Required for authentication and core functionality
• Analytics Cookies: Help us understand how users interact with the platform
• Preference Cookies: Remember your settings and preferences

7.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect platform functionality.

8. Children's Privacy

AssessX may be used by students of all ages through educational institutions. When used by children under 13 (or applicable age in your jurisdiction), we comply with COPPA and similar regulations. Parental consent is obtained through the educational institution.

9. International Data Transfers

Your data may be processed in countries outside your residence, including by the AI and hosting providers listed above. For users in the Kingdom of Saudi Arabia, transfers outside the Kingdom are made in line with the Personal Data Protection Law (PDPL) and its regulations on transferring personal data outside the Kingdom. Safeguards include:

• Data processing terms with our service providers
• Sending only the data a feature needs
• Instructing AI providers not to store requests where the provider supports it

10. Data Retention

We retain your data for as long as necessary to:

• Provide services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements

Typical Retention Periods:

• Active accounts: Duration of account + 1 year
• Academic records: Per institutional requirements (typically 5-7 years)
• Log data: 90 days to 2 years
• Backup data: 30 days

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via:

• Email notification
• In-app notification
• Notice on our website

Your continued use of AssessX after changes constitutes acceptance of the updated policy.

12. Privacy by Design

We build privacy into our platform from the ground up:

• Data minimization: We only collect what we need
• Purpose limitation: Data is used only for stated purposes
• Transparency: Clear communication about data practices
• User control: Easy-to-use privacy settings and controls

13. Third-Party Services

13.1 AI Services

We use the AI providers listed in section 4.2 for grading recommendations and feedback. Exam answers are sent to the provider selected by your institution. Grading requests for typed answers do not include your name, email address or student ID. Some features process content that may itself contain your name: scanned paper exams (the page image) and group project grading (repository contributor names). Your institution chooses which providers are enabled. OpenAI, Anthropic and Google state that they do not use data sent through their business APIs to train their models.

13.2 Analytics

We may use analytics services to understand platform usage. These services have their own privacy policies.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Email: info@scalexi.ai
• Website: www.scalexi.ai

15. Regional Privacy Rights

15.1 Kingdom of Saudi Arabia (PDPL)

Under the Personal Data Protection Law, you have the right to:

• Be informed of the legal basis and purpose of collecting your personal data
• Access your personal data and obtain a copy of it
• Request correction of inaccurate or incomplete data
• Request destruction of data that is no longer needed
• Withdraw your consent where processing is based on consent
• Lodge a complaint with the Saudi Data & AI Authority (SDAIA)

Your institution is usually the controller of your academic data; requests can be made to your institution or to us.

15.2 European Union (GDPR)

If you are in the EU, you have additional rights including:

• Right to be forgotten
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

15.3 California (CCPA)

California residents have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Opt-out of the sale of personal information
• Request deletion of personal information
• Not be discriminated against for exercising privacy rights