PRIVACY POLICY

1. Introduction

This Privacy Policy applies to the ExamSync application available at https://examsync.app and all related services operated by ExamSync. It explains how ExamSync (“ExamSync”, “we”, “our”, or “us”) collects, uses, stores, and protects personal information.

ExamSync is designed to help educational institutions manage and monitor examination sessions, including access arrangements and exam timing.

By using ExamSync, you agree to the practices described in this Privacy Policy.

2. Data Controller

Educational institutions using ExamSync are generally the Data Controllers for any personal data they choose to enter into the Service.

ExamSync acts as a Data Processor where applicable by providing the platform used to manage examination sessions.

For questions regarding this Privacy Policy, please contact:

Email: examsync.app@gmail.com

3. Information Collected

Account Information

When creating an account, we may collect:

  • First name
  • Last name
  • Email address
  • School or institution name
  • Country
  • Firebase Authentication User ID (UID)

When signing in with Google, we may receive:

  • Your Google account name
  • Your email address
  • Your Google profile picture (if available)

Passwords are never stored by ExamSync. Authentication is securely managed by Firebase Authentication.

Google User Data

If you choose to sign in using your Google account, ExamSync only accesses the information necessary to authenticate your identity.

This may include:

  • Your name
  • Your email address
  • Your profile picture

ExamSync does not request or access:

  • Gmail
  • Google Drive
  • Google Calendar
  • Google Contacts
  • Google Photos
  • Any other Google services

Google account information is used solely to:

  • authenticate your identity;
  • create your ExamSync account;
  • associate your account with your educational institution;
  • display your name and profile information within the application.

ExamSync does not use Google user data for:

  • advertising; marketing;
  • profiling;
  • analytics;
  • training artificial intelligence or machine learning models.

ExamSync does not store Google OAuth refresh tokens.

School Information

Depending on how your institution uses ExamSync, we may store:

  • School name
  • School logo (optional)
  • Primary school domain
  • School administrators
  • User roles and permissions
  • Subscription status

Examination Data

ExamSync stores operational data required for examination management, including:

  • Examination session information
  • Access arrangement sessions
  • Timing records
  • Extra time usage
  • Rest break information
  • Announcements
  • Configuration settings
  • Session history
  • Generated reports

Student Information

ExamSync is designed to operate using the minimum amount of student information necessary.

Institutions are encouraged to record first names or initials only whenever possible.

Student names entered into examination sessions are used solely for:

  • identifying students during examination sessions;
  • producing examination reports;
  • recording access arrangement usage;
  • providing historical examination records.

ExamSync does not store:

  • examination results;
  • candidate numbers;
  • grades;
  • academic performance records.

Student names may also be stored locally within the user’s browser (Local Storage) to simplify future examination setup. These locally stored names can be deleted at any time using the application’s built-in tools.

Educational institutions remain responsible for ensuring that any student information entered into ExamSync complies with applicable data protection laws and their own internal policies.

Payment Information

Subscription payments are processed securely by Stripe.

ExamSync does not collect or store:

  • credit card numbers;
  • debit card numbers;
  • security codes (CVV);
  • banking information.

We may store subscription status and payment identifiers necessary for subscription management.

Technical Information

We may automatically collect technical information including:

  • browser type;
  • device information;
  • diagnostic logs;
  • security logs.

IP addresses may be processed by Firebase, Google Cloud, or other infrastructure providers for operational and security purposes but are not stored or used directly by the ExamSync application.

4. How We Use Your Information

We use information only to:

  • provide the ExamSync service;
  • authenticate users;
  • manage examination sessions;
  • synchronise examination timing;
  • manage user permissions;
  • manage subscriptions;
  • provide customer support;
  • improve platform reliability;
  • maintain security;
  • comply with legal obligations.

We do not sell personal information.

5. Legal Basis (Where Applicable)

Where applicable, processing is based on:

  • performance of a contract;
  • legitimate interests;
  • legal obligations;
  • user consent where required.

6. Data Sharing

ExamSync shares personal information only where necessary to provide, operate, maintain, and secure the Service.

Our service providers include:

  • Google Firebase
  • Google Cloud Platform
  • Stripe
  • secure hosting and infrastructure providers

These providers process personal information solely on our behalf and only for the purpose of delivering the ExamSync service, under appropriate contractual and security safeguards.

Google user data obtained through Google Sign-In (including a user’s name, email address, and profile picture, where available) is used solely for authentication, account creation, and account management. This information is not sold, rented, or shared with third parties for advertising, marketing, profiling, analytics, or any unrelated purpose.

Google user data is shared only with Google Firebase Authentication and Google Cloud Platform to the extent necessary to authenticate users, operate the Service, and securely store account information.

ExamSync does not sell personal information or Google user data to third parties.

7. International Transfers

Your information may be processed in countries outside your own.
Where required by law, appropriate safeguards are implemented for international data transfers.

8. Data Retention

Personal information is retained only for as long as necessary to operate the Service and comply with legal obligations.

User Accounts

Users may permanently delete their own account directly from within the application.
When a user account is deleted, the associated personal account data is removed immediately, except where retention is required by law or for legitimate security or billing purposes.

School Accounts

School accounts may be deleted only by an administrator after:

  • the school’s subscription has expired or has been cancelled;
  • and administrator privileges have been transferred to another user, where applicable.

When a school deletion request is submitted, the school enters a 7-day grace period during which the deletion request may be cancelled.

After the grace period expires, all data associated with the school, including examination records, uploaded files, user accounts, and school branding, is permanently deleted.

If an active subscription is cancelled, administrators may also contact examsync.app@gmail.com to request immediate cancellation and a pro-rata refund for the unused portion of the current billing period, where applicable.

Google User Data

Google user data obtained through Google Sign-In (including the user’s name, email address, and profile picture, where available) is retained only for as long as the user’s ExamSync account remains active and only for the purpose of providing the Service.

When a user permanently deletes their ExamSync account, any Google user data stored by ExamSync is permanently deleted, except where retention is required by applicable law or for legitimate security or billing purposes.

9. Security

We implement appropriate technical, administrative, and organisational measures designed to protect personal information from loss, misuse, and unauthorised access, disclosure, alteration, or destruction. These measures include encrypted HTTPS/TLS connections, Firebase Authentication, Firestore Security Rules, role-based access controls, secure cloud infrastructure, and encrypted backups.

While we take reasonable steps to protect personal information, no method of transmission over the Internet or electronic storage is completely secure. Accordingly, we cannot guarantee absolute security.

10. User Rights

Depending on applicable law, users may have rights to:

  • access your personal information;
  • correct inaccurate information;
  • request deletion;
  • restrict processing;
  • object to processing;
  • request information about stored data;
  • lodge complaints with your supervisory authority.

Requests may be submitted by contacting:
Email: examsync.app@gmail.com

11. Cookies and Tracking

ExamSync uses only technologies necessary to provide the Service.

These include:

  • authentication cookies;
  • essential session cookies;
  • browser Local Storage used for application functionality.

No advertising cookies are used.

ExamSync does not use Google Analytics, Firebase Analytics, Crashlytics, or advertising tracking technologies.

12. Children’s Data

ExamSync is intended for use by educational institutions and authorised staff.

It is not intended for direct use by children.

Educational institutions remain responsible for ensuring that any student information entered into ExamSync complies with applicable data protection laws.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the application or our website where appropriate.

Continued use of ExamSync following publication of an updated Privacy Policy constitutes acceptance of the revised Policy.

14. Contact

If you have any questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact:

Contact Form: https://examsync.net/contact-us/

Email: examsync.app@gmail.com