Privacy policy
Assessment data is personal and proctoring data is biometric. This page explains exactly what is collected, who can view it, and when it is deleted — and states clearly when your institution is the controller and when we are.
The distinction is not a formality: it determines who an access or deletion request should be addressed to.
When a university or institute subscribes to EvaliX, the institution remains the controller of its students' and staff data, and we act as a processor on its behalf and under its instructions. It decides what is collected, which proctoring layers are enabled, and the retention period within the ceilings we provide.
Data you send through the demo request form or the newsletter signup is controlled by us, and used only to reply to you and arrange the session.
Nothing outside this table is collected. What the institution does not enable is not collected at all.
| Category | What it includes | Retention |
|---|---|---|
| Account data | Name, institutional email, role, and academic identifier where applicable. | For the duration of the subscription, then per institutional policy |
| Assessment responses | Answers, scores, response times and navigation history within the assessment. | Academic record — set by the institution |
| Proctoring material | Timestamped snapshots, short clips at flagged events, device fingerprint and network address. Collected only when the institution enables the proctoring layer on a specific assessment. | A configurable ceiling ending in automatic deletion |
| Biometric data | The facial matching template derived from the reference image, when the facial verification path is used. | Deleted with proctoring material when the ceiling expires |
| Usage data | Sign-in logs, content operations, and the audit trail for every change to a grade or approved item. | Required for academic integrity and not deleted early |
This is the most sensitive category in the platform and we treat it accordingly. It is not collected by default, it always has an alternative, and access to it is logged.
The facial proctoring layer is disabled by default. Enabling it is a decision the institution makes per assessment, not a global setting that applies to everything.
For a candidate to whom facial verification does not apply, or who does not consent to it, the platform provides alternative paths: supervised in-person verification, or reuse of a documented prior verification. The path used is recorded against the attempt.
Before the session starts, the candidate is shown exactly what is recorded, for how long, and who can view it.
Every view of a candidate's proctoring material is logged with viewer and timestamp, and is exportable on request.
Databases, proctoring media and backups are hosted on cloud infrastructure inside the Kingdom of Saudi Arabia. This is a default rather than a purchasable option, and institutional data is not transferred outside the Kingdom for operational purposes.
Where we rely on sub-processors — for payment processing, email delivery or the forms on this site — they receive only what the service requires, and are listed in a maintained annex available to subscribing institutions on request. [To be completed with the approved sub-processor list]
The forms on this site are delivered through an external form service to our inbox. Please do not use the form to send student data or any sensitive personal data.
If you are a student or member of an institution using EvaliX, your request goes to your institution as the controller, and we support it in fulfilling the request. If it concerns data you sent through this website, address it to us directly.
Knowing what is held about you and obtaining a copy.
Correcting inaccurate or incomplete data.
Requesting deletion within the limits of academic record retention.
Objecting to a specific processing activity, including facial verification.
Security. Access is governed by roles and permissions, and every change to a grade or approved item is written to an immutable audit trail. We do not use institutional data to train general-purpose AI models.
Cookies. This website uses no tracking cookies and no advertising trackers. [To be updated if analytics tools are added later]
Changes. When this policy changes materially we notify subscribing institutions before it takes effect, and keep previous versions available on request.
Legal entity. [Registered company name] · [Commercial registration number] · [National address]
Write to evalix.ai@gmail.com and we reply within one business day. Subscribing institutions may request the data processing addendum and the full sub-processor list.
