Privacy Policy

1. Who we are

ExamifyPro ("we", "us", "our") is an online platform providing exam preparation services. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our website examifypro.com and our services.

2. Data Protection Officer (DPO)

For all questions related to data protection, exercise of your rights, or complaints, you can contact our DPO:

3. What data we collect

3.1 Data you provide directly

• Account information: email address, hashed password (we never see or store your password in clear text — it is encrypted with bcrypt by our authentication provider)
• Profile information (optional): display name, country, preferences
• Payment information: we do not collect or store credit card details ourselves. Payments are processed by Stripe, which handles all card data securely
• Two-factor authentication (optional): if you enable 2FA, we store a TOTP secret encrypted at rest
• Communications: messages you send via our contact form, support tickets, or testimonials

3.2 Data we collect automatically

• Exam activity: your answers to exam questions, scores, time spent, completion dates
• Technical data: IP address (collected server-side for security/anti-fraud), browser type, device type, operating system, referring page
• Session data: login timestamps, session duration (essential cookies)
• Question reports: any reports you submit about exam questions (reason + optional description)

3.3 Data from third parties

We do not buy personal data from third parties. We only receive data from:

• Stripe: transaction confirmations and subscription status
• Email providers: bounce/delivery information for emails we send you

3.4 Future analytics (not yet active)

We plan to implement a privacy-friendly analytics service (such as Plausible Analytics) in the future to understand how our service is used. When activated, this will only collect anonymized data (page views, browser type, country at the country level, not city) without any personally identifiable information. You will be notified and asked to consent before activation. Currently, no analytics service is in operation.

4. Why we collect this data (legal basis)

Under GDPR, we process your data based on the following legal grounds:

5. Who has access to your data

Your data is shared only with the following categories of recipients, and only for the purposes described above:

5.1 Service providers (sub-processors)

All our service providers are bound by data processing agreements (DPAs) and comply with applicable data protection laws. Providers located outside the EU/EEA use Standard Contractual Clauses (SCCs) to ensure adequate data protection.

5.2 Legal requirements

We may disclose your data if required by law, court order, or government request, or to protect the rights, property, or safety of ExamifyPro, our users, or others.

5.3 We never sell your data

ExamifyPro does not sell, rent, or trade your personal data with third parties for marketing or any other purposes. Ever.

6. International data transfers

Some of our service providers are located outside the European Economic Area (EEA), particularly in the United States. When data is transferred outside the EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements (DPAs) with each provider
• Encryption in transit (TLS 1.3) and at rest (AES-256)

7. How long we keep your data

8. Your rights

Under GDPR and other applicable privacy laws, you have the following rights regarding your personal data:

• Right of access: request a copy of all personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations
• Right to restriction: request that we limit how we process your data
• Right to data portability: receive your data in a structured, machine-readable format to transfer to another service
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: at any time for processing based on consent
• Right not to be subject to automated decision-making: we do not use automated decision-making that has legal effects on you
• Right to lodge a complaint: with a supervisory authority (CNIL in France, see section 11)

9. California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we collect and how we use it
• Right to delete personal information we have collected
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to correct inaccurate personal information
• Right to non-discrimination for exercising your privacy rights
• Right to limit use of sensitive personal information

To exercise these rights, contact us at admin@examifypro.com.

10. Other international users

ExamifyPro serves users worldwide. We comply with applicable data protection laws including:

• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA)
• United Kingdom: UK GDPR and Data Protection Act 2018
• Brazil: Lei Geral de Proteção de Dados (LGPD)
• Australia: Privacy Act 1988 and Australian Privacy Principles

If your country has specific privacy regulations and you believe we are not complying, please contact us.

11. Right to lodge a complaint

If you believe we have not handled your data properly, you have the right to file a complaint with:

You can also contact the supervisory authority in your country of residence within the EU/EEA.

12. Children's privacy

ExamifyPro is intended for users aged 16 and above.

• We do not knowingly collect data from children under 16.
• For users aged 16 to 18, depending on local laws, parental consent may be required for paid subscriptions. It is the parent or legal guardian's responsibility to verify this.
• If you believe a child under 16 has provided us data, please contact us and we will delete it promptly.

13. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Passwords hashed with bcrypt (we cannot read them)
• Two-factor authentication (2FA) available for all accounts
• Row Level Security (RLS) on all database tables
• Regular security audits and updates
• Access logs and intrusion detection
• Principle of least privilege for staff access

In the event of a data breach affecting your personal data, we will notify you and the competent authorities within 72 hours, as required by GDPR.

14. Automated decision-making and AI

ExamifyPro uses artificial intelligence to generate exam questions. However:

• AI is used only for content generation (questions), not for processing your personal data.
• We do not use automated decision-making that produces legal or similarly significant effects on you.
• Your exam results are calculated using deterministic rules (number of correct answers), not AI.
• The third-party AI services we use (such as DeepSeek) only receive anonymous prompts about the subject of the exam to generate questions and explanations. They do not have access to any personally identifiable information about you, your account, or your exam history.

14.1 Your data is not used to train AI

We use Supabase as our database and authentication infrastructure. According to Supabase's privacy commitments, customer data — including all data stored in ExamifyPro — is not used to train artificial intelligence models, machine learning algorithms, or any similar automated systems.

This means:

• Your exam answers, scores, and personal information remain private.
• Your usage patterns and analytics are never shared with AI training datasets.
• Your account data is processed solely for the purposes described in this Privacy Policy.

For details on Supabase's commitment to data privacy, see supabase.com/privacy.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "Last updated" date at the top. Continued use of the service after changes constitutes acceptance of the updated policy.

16. Contact us

For any question, request, or complaint regarding this Privacy Policy or your personal data: