Privacy Policy

Last updated: June 2025 · Version 1.0

This Privacy Policy explains how Testly collects, uses, and protects information when you use our platform. By using Testly, you agree to this policy.

1. Information We Collect

Account information: When you register, we collect your name, email address, and a hashed password (or your Google account details if you sign in via Google).

School and assessment data: Information you enter about your school, subjects, sessions, and assessment content.

Student data you provide: Names, email addresses, and class-level information that you upload for your students. You are the data controller for this information.

Usage data: We log activity such as logins, assessment creation, and exports to maintain security and audit trails.

Technical data: IP addresses, browser type, and session identifiers collected automatically for security purposes.

2. How We Use Your Information

To provide and operate the Testly platform.
To send assessment links and result emails to students on your behalf.
To process credit purchases and manage your account.
To detect and prevent fraud, abuse, and security threats.
To improve the platform based on aggregated, anonymised usage patterns.
To communicate important service updates to your registered email address.

3. Student Data

You are the data controller for student information you upload. We process it solely as your data processor — only to deliver assessment links and results to those students on your instruction. We do not use student data for any other purpose, including marketing.

We store student data only for as long as it is associated with active assessments on your account. When you delete an assessment or student record, the associated personal data is removed from our systems.

4. Data Sharing

We do not sell, rent, or trade your personal data or your students' data. We may share data only:

With service providers that help us operate the platform (e.g. email delivery, hosting), under strict confidentiality obligations.
When required by law — to comply with legal obligations, court orders, or law enforcement requests.
To protect rights — to protect the safety, rights, or property of Testly, its users, or the public.

5. Data Security

We implement industry-standard security measures including:

Passwords hashed with bcrypt (cost factor 12) — we never store plain-text passwords.
CSRF tokens on all state-changing requests.
Prepared statements and parameterised queries to prevent SQL injection.
Session cookies with HttpOnly, Secure, and SameSite=Lax attributes.
Rate limiting on authentication and registration endpoints.

No system is completely immune to security breaches. If a breach occurs that affects your data, we will notify you promptly.

6. Data Retention

We retain your account data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where retention is required by law or for legitimate security purposes (such as audit logs).

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Object to or restrict certain processing.
Data portability (receive your data in a structured format).

To exercise any of these rights, contact us through the Testly platform.

8. Cookies and Local Storage

We use session cookies for authentication and a theme preference stored in browser localStorage. We do not use third-party tracking cookies or advertising cookies.

9. Third-Party Services

We integrate with Google for OAuth sign-in. When you use Google sign-in, Google's own Privacy Policy applies to the data Google processes. We only receive your name, email address, and Google account ID from Google.

10. Children's Privacy

The educator account features of Testly are intended for adults (18+). Student data entered by educators may relate to minors; as noted above, you are responsible for ensuring you have the appropriate consents to upload that data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice on the platform. Your continued use after changes take effect constitutes acceptance.

12. Contact

For privacy-related questions or to exercise your rights, please contact us through the Testly platform.