Privacy Policy
Last updated: 11 October 2026
ExamQR is used by organisations (training centres, universities, certification bodies, employers) to build and run exams. We keep what an account needs and what the organisation asks us to process for its exams. Candidate answers are never sent to AI providers, we do not sell data or show advertising, and proctoring screenshots and alerts are deleted 90 days after the exam.
1. Who we are and our role
ExamQR is operated by TEX VIETNAM TECHNOLOGY JOINT STOCK COMPANY (CÔNG TY CỔ PHẦN CÔNG NGHỆ TEX VIỆT NAM; "TEX Vietnam JSC", "we", "us"). This policy covers examqr.com, app.examqr.com, the custom domains organisations connect to ExamQR, and the ExamQR offline exam apps when they talk to our servers (the "Service").
- Account holders (people who sign up and the staff they invite): we are the data controller for your account data.
- Candidates (people who take an exam set up by an organisation): the organisation decides what to collect and why, so it is the controller and we are its processor. We process candidate data only on the organisation's instructions, under our Data Processing Agreement. If you are a candidate, contact the organisation that invited you first; we will help it answer you.
2. Data about account holders
| Data | Why |
|---|---|
| Email address, name, password (stored only as a salted hash), and optionally phone, address, birthday, gender and profile photo | To create your account, sign you in and contact you about it |
| Google account identifier, if you sign in with Google | To recognise you at sign-in |
| Time zone and interface language | To show exam times and the Service in your language |
| Your organisation's content: tests, question banks, exams, rooms, schedules, branding, landing pages, staff you invite | To provide the Service |
| Documents and descriptions you send to AI features (for example a Word or PDF test to convert, a topic to generate questions about) | To run the AI feature you asked for (section 5) |
| Plan, credits balance and history, orders: transaction reference, product, amount, currency | To deliver what you bought and keep accounting records |
| Activity log of account actions (for example sign-in, creating or deleting an exam) with time | Security, support and abuse prevention |
| For the offline exam apps: licence key, device identifier and error reports | To activate licences and fix crashes |
We do not receive your card or bank details: Paddle handles payment as the merchant of record and tells us only that a purchase succeeded.
3. Data about candidates (processed for organisations)
| Data | When |
|---|---|
| Profile the organisation enters or imports: name, candidate code, group or class, and optionally birthday, gender, email, phone, address, notes and photo; a sign-in password stored only as a salted hash | When the organisation adds the candidate, or the candidate registers for an open exam |
| Exam record: the version of the test delivered, answers, time spent per question, start and finish times, score and result | Every exam |
| Technical data: IP address and device used for the exam | Every exam, to detect a second device and help supervisors |
| Proctoring alerts: leaving the exam window, screen or face alerts, with time | Every online exam |
| Screenshots of the candidate's screen, taken when the screen changes significantly | Only if the organisation turns on screen monitoring for that exam; the browser asks the candidate to share their screen |
| Face check: camera photos and the face measurements calculated from the candidate's photo | Off by default. Only if the organisation turns it on after confirming to us that it has the candidates' consent; the browser asks for camera permission |
| Live video and chat with supervisors | Only if the organisation uses live supervision. Video is shown live and not recorded; chat messages are kept in server memory for at most 5 days, not in the database |
Candidate answers are never sent to an AI provider. Candidates do not need an account with us and we never email candidates for our own purposes; emails a candidate receives (for example an exam invitation) are sent on the organisation's instruction.
4. How we use data and on what basis
- To provide the Service and the exams organisations run on it. Basis: performance of our contract with the account holder; for candidate data, the organisation's instructions under the DPA.
- To send transactional email: sign-up codes, password resets, receipts, notices about your account and exams. Basis: performance of our contract with the account holder; for emails to candidates, the organisation's instructions under the DPA. We do not send marketing email unless you ask for it.
- To keep the Service secure and prevent abuse, for example limits on failed sign-ins. Basis: legitimate interest in running a safe service.
- To understand overall use through aggregate statistics. Basis: legitimate interest.
- To comply with law, for example tax and accounting records.
We do not sell personal data, do not show advertising, and do not use your content or candidate data to train AI models.
5. AI features
When you use an AI feature, we send the document or description you provided (and, for question generation, the subject, level and topic you chose) to the AI provider listed in section 7, and return the result to you. We use paid API services whose terms do not allow the provider to train models on this data. AI output can be wrong; review it before you publish an exam.
6. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
| .AspNetCore.Cookies | Keeps you (or a candidate, or a supervisor) signed in | Until the browser is closed |
| .AspNetCore.Session | Short-lived state such as a sign-up code check | 30 minutes of inactivity |
| .AspNetCore.Antiforgery.* | Protects forms against cross-site request forgery | Until the browser is closed |
| .AspNetCore.Culture, USER_LANG | Remembers your language | 1 year |
| DVID | Random device identifier used to detect a second device during an exam | 60 days |
| AUID | Random identifier that links your use of the free test-mixing tool to your account if you later sign up | 1 year |
| REF_ID | Remembers the partner who referred you, if you arrived through a referral link | Until the browser is closed |
The Service has no advertising or third-party analytics cookies. When you buy something, the Paddle checkout runs in a Paddle window and may set Paddle's own cookies under Paddle's privacy policy. If an organisation enables Google sign-in or reCAPTCHA, Google may set its own cookies on those pages.
7. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Network delivery and security of all our domains, hosting of the public website | Global network |
| OVHcloud | Application server, database and file storage | United States |
| Paddle.com Market Ltd and affiliates | Payments, invoices, taxes and refunds (merchant of record) | United Kingdom, United States |
| Anthropic, PBC; Google LLC (Gemini API) | AI features (section 5). They receive what you send to an AI feature, never candidate answers | United States |
| Google LLC | Sign in with Google and reCAPTCHA (only where enabled); the public STUN server that helps live video connect | United States |
| Our email delivery provider | Sending account, receipt and exam emails | United States |
| jsDelivr and the Tailwind CSS CDN | Deliver open-source scripts and styles to your browser (jsDelivr on the pages of the web application, including exam pages; the Tailwind CSS CDN only on the free tools, help pages and error pages); they see your IP address but receive no account data | Global network |
| DiceBear | Avatar pictures in the live quiz; receives the player's nickname and IP address | Germany |
Each provider acts under a contract that limits what it may do with the data. We will update this list before adding a provider that processes candidate data and, for organisations under our DPA, give notice as the DPA describes.
8. International transfers
We are based in Vietnam and our servers are in the United States, so data is transferred to those countries. For data from the European Economic Area, the United Kingdom and Switzerland, transfers rely on the European Commission's standard contractual clauses (and the UK addendum), which are part of our DPA, and on our providers' own transfer mechanisms.
9. How long we keep data
- Proctoring alerts and screenshots: deleted automatically 90 days after the exam date.
- Candidate profiles, answers and results: until the organisation deletes them or closes its account.
- Account data and your content: as long as the account exists. After you close it, we delete it within 30 days, and remove it from backups as they expire (backups are kept for 14 days).
- Purchase records: up to 10 years, as required by accounting and tax law, even after the account is closed.
- Error logs: up to 30 days. Account activity logs: up to 12 months.
10. Your rights
You can see and correct your profile in the Service at any time, and export candidate lists and results to Excel. To get a copy of your account data or to close your account, email [email protected] from your account address; we answer within 30 days. Depending on where you live, you may also have the right to object to or restrict processing, to data portability, and to complain to a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office).
Candidates: please send requests to the organisation that ran your exam. If you write to us, we will pass your request to that organisation and help it respond.
Residents of California and other US states with privacy laws: we do not sell or share personal data for advertising and do not use it for profiling with legal effects.
11. Children
Accounts are for adults. Organisations may run exams for candidates under 18; in that case the organisation is responsible for having a lawful basis, including parental consent where the law requires it, and must not turn on face check for children without that consent.
12. Security
See our Security page. If we discover a breach affecting personal data, we will inform the affected organisations and account holders without undue delay and, where required, the authorities.
13. Changes
We may update this policy when the Service changes. The date at the top shows the latest version. For material changes we will tell account holders by email or in the Service.
14. Contact
TEX VIETNAM TECHNOLOGY JOINT STOCK COMPANY (CÔNG TY CỔ PHẦN CÔNG NGHỆ TEX VIỆT NAM; registered name without diacritics: CONG TY CO PHAN CONG NGHE TEX VIET NAM).
Registered address: No. 367-E16, Group 11, Dong Anh Town, Dong Anh District, Hanoi City, Vietnam.
Email: [email protected].