A clear notice about how ExamCrow collects, uses, shares, and protects personal data
This Privacy Policy explains how ExamCrow [Legal Entity Name] (“ExamCrow”, “we”, “us”, or “our”) processes personal data when you use our website, dashboard, courses, practice features, learning paths, communications, and related services that link to this page.
Start with the summary, then jump to the detailed section you need
This notice is written in layers: a short summary first, followed by detailed sections on data categories, purposes, sharing, rights, retention, children, and contact routes.
Key points before the detailed notice
The short version below is for convenience only. The full sections that follow control if there is any conflict.
What we collect
Account details, learning activity, communications, support requests, transaction records, device and usage data, and data you upload or submit.
Why we use it
To operate the service, secure accounts, process purchases, support learning features, communicate with you, improve the platform, and comply with law.
Who may receive it
Our service providers, payment and authentication partners, analytics / security providers, and—where relevant—institutions, sponsors, or partners connected to your access.
Your choices
Depending on your location and the applicable law, you may request access, correction, deletion, portability, restriction, objection, or withdrawal of consent.
Who we are and when this notice applies
This Privacy Policy applies to personal data processed through the ExamCrow website, public pages, user account areas, dashboard, course and practice features, learning paths, communications, support channels, and other products or services that link to this notice.
The data controller / data fiduciary for the personal data covered by this notice is: ExamCrow [Legal Entity Name].
Privacy contact: privacy@[your-domain].com
Grievance / escalation contact (if applicable): grievance@[your-domain].com
Postal address: [Registered / principal business address]
If a specific feature, partner program, campaign, institution-sponsored offering, or third-party sign-in flow is governed by a separate privacy notice, that separate notice will apply to that specific processing to the extent stated there.
Categories of personal data we may collect
Data you provide directly
- Account and profile details such as name, email address, phone number, password or login credentials, profile information, and education or study interests.
- Content you submit, upload, or create, including assignments, notes, answers, study inputs, feedback, survey responses, support messages, and any material you provide through forms or communications.
- Purchase, billing, invoice, refund, or subscription information that you provide when you buy a paid product or service.
- Identity or verification information if a feature, legal obligation, anti-fraud review, or support workflow specifically requires it.
Learning, usage, and device data
- Course enrollments, learning progress, test and practice results, saved content, streaks, preferences, and activity within the service.
- Device, browser, app, and log data such as IP address, approximate location inferred from IP, device identifiers, operating system, browser type, pages or features used, timestamps, crash data, and diagnostic information.
- Cookie IDs, local storage data, and similar identifiers used for authentication, security, preferences, analytics, and feature measurement, subject to applicable consent rules.
Data from third parties
- Authentication information from single sign-on or social login providers if you choose to use those options.
- Limited payment and transaction status information from payment processors when you make a purchase; payment card details are generally collected and handled by the processor, not stored in full by us.
- Data from institutions, employers, sponsors, resellers, or partners where they provision access for you or connect your use of the service to a program, license, or sponsored seat.
- Security and fraud signals from service providers that help us protect the service and users.
Sensitive or third-party data
- We do not ask you to send special-category / sensitive personal data unless it is clearly necessary for a specific feature, a legal obligation, or a fraud-prevention / security purpose and we have an appropriate lawful basis.
- If you upload or submit content that contains personal data about another person, you must have the legal right and any required consents or notices needed to share that data with us and to allow us to process it for the relevant service purpose.
Purposes of processing and, where applicable, legal bases
Core service operations
- To create and manage your account, authenticate you, and provide the website, dashboard, courses, practice features, learning paths, subscriptions, and related functionality.
- To process purchases, invoices, refunds, renewals, tax records, and related customer support.
- To personalize your experience, such as surfacing relevant content, saving preferences, or remembering settings.
- To communicate service notices, account messages, security alerts, transactional updates, and responses to your requests.
Improvement, analytics, and protection
- To troubleshoot, monitor performance, detect bugs, moderate misuse, enforce our Terms, and protect the service, our business, and our users from fraud, abuse, spam, and security threats.
- To understand how the service is used, improve features, measure effectiveness, and develop new offerings.
- To create aggregated or de-identified analytics and reports, where permitted by law, provided such outputs do not reasonably identify you.
Marketing, compliance, and legal obligations
- To send product updates, newsletters, events, promotional communications, or offers where allowed by law and subject to your choices and opt-out rights.
- To comply with applicable laws, tax and accounting requirements, lawful requests from authorities, court orders, and valid dispute, audit, or investigation requirements.
- To establish, exercise, or defend legal claims and to protect rights, safety, and property.
Legal bases we may rely on
- Performance of a contract — for providing the service you requested, including account access, purchases, learning features, and customer support.
- Consent — where we ask for it, including certain optional features, non-essential cookies where required, or specific communications.
- Legitimate interests — such as securing and improving the service, preventing fraud, understanding usage, and operating our business, balanced against your rights.
- Legal obligation / compliance — where we must process data to comply with law, regulation, or lawful requests.
We may use automated tools to recommend content, detect fraud or abuse, or moderate submissions. Unless expressly stated otherwise, these tools are not intended to make decisions that have legal or similarly significant effects on you without human review.
How we use cookies, local storage, and similar tools
We and our service providers may use cookies, SDKs, local storage, pixels, log files, and similar technologies to operate the service, keep users signed in, remember preferences, secure accounts, understand usage, measure performance, and support communications and analytics.
- Strictly necessary tools — used for core functionality, authentication, security, load balancing, and fraud prevention.
- Preference tools — used to remember settings and improve usability.
- Analytics / measurement tools — used to understand product performance and usage patterns.
- Optional / non-essential tools — only where enabled and where permitted under applicable law.
Where required by law, we will seek consent before placing or activating non-essential cookies or similar technologies, and you can change your preferences through our cookie settings or browser controls. See also our Cookie Policy.
When data moves across borders
We and our service providers may process personal data in countries other than the country where you live. Those countries may have privacy laws that differ from the laws in your jurisdiction.
Where required by applicable law, we will use appropriate safeguards for cross-border transfers, such as contractual commitments, transfer mechanisms recognized by law, or other valid legal measures.
If you want more information about the safeguards we use for a particular transfer, you can contact us using the details below.
How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purposes described in this notice, including to provide the service, keep appropriate records, resolve disputes, enforce our agreements, prevent fraud and abuse, comply with law, and support backup / recovery processes.
- Account and profile data — generally while your account is active and for a reasonable period afterward to manage reactivation, disputes, or compliance obligations.
- Learning and usage data — for as long as needed to provide features, maintain progress records, improve the service, and protect the platform, unless you request deletion and we are not legally required to keep it.
- Billing, purchase, tax, and refund records — for the period required by applicable finance, tax, accounting, and audit laws.
- Security logs and fraud-prevention records — for as long as reasonably required to detect, investigate, document, and prevent abuse or attacks.
- Backups — until overwritten in the ordinary backup rotation cycle.
When we no longer need personal data, we will delete it, de-identify it, or isolate it from routine use, unless the law permits or requires otherwise.
How you can access, control, and update your data
General rights and controls
- Access, review, and update certain account information through your account settings where available.
- Request access to, correction of, or deletion of your personal data, subject to lawful exceptions.
- Request portability of certain data where required by applicable law and technically feasible.
- Withdraw consent at any time where processing depends on consent. Withdrawal does not affect processing already lawfully carried out before withdrawal.
- Unsubscribe from marketing emails using the unsubscribe link or by contacting us.
- Control cookies and similar technologies using your browser settings or our cookie controls, where available.
Additional rights that may apply by jurisdiction
- If you are in the EEA, UK, or Switzerland, you may also have rights to restriction, objection, and complaint to your supervisory authority, subject to applicable conditions and exemptions.
- If you are in India, you may have rights under applicable law to access information about your personal data, request correction / erasure, withdraw consent, and seek grievance redressal, subject to the relevant statutory commencement, rules, and exceptions.
- If you are in California or another U.S. state with applicable privacy rights, you may have rights to know, access, correct, delete, and—where applicable—opt out of certain disclosures or uses, subject to thresholds, verification, and exceptions under the law.
How to make a request
To exercise a privacy right, email privacy@[your-domain].com or use our contact page.
We may need to verify your identity before acting on certain requests, and we may decline or limit a request where the law allows, including to protect the rights of others, maintain security, comply with legal duties, or preserve records needed for disputes, fraud prevention, or tax/accounting purposes.
If you are in India and are not satisfied with our grievance response, you may have the right to escalate the matter to the Data Protection Board of India when and to the extent the relevant statutory provisions and rules are in force and apply to our processing.
How we approach data relating to minors
ExamCrow is an education platform, so some users may be minors. We handle children’s data with additional care where required by applicable law.
- If the law in your jurisdiction requires parental or guardian consent for a child to use the service or for us to process a child’s personal data, we may request age information, parent / guardian details, or verifiable authorization before enabling certain features or continuing access.
- Where legally required, we may limit, suspend, or delete an account or data if appropriate parent / guardian authorization is missing or cannot be verified.
- If you believe a child has provided personal data in a manner that was not authorized under applicable law, please contact us promptly so we can review and take appropriate action.
Parents, lawful guardians, schools, or program administrators should ensure that any account or access they provision for a child complies with the laws, notices, and permissions that apply to that child and the relevant program.
How we protect personal data
We use reasonable technical, administrative, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure.
- Access controls, authentication measures, and role-based restrictions where appropriate.
- Logging, monitoring, and security review processes designed to identify and respond to suspicious activity.
- Vendor and processor management measures designed to reduce operational and security risk.
No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for notifying us promptly if you believe your account or data may have been compromised.
External sites, links, logins, and partner tools
The service may contain links to external websites, embedded tools, payment flows, authentication providers, institution portals, or other third-party services that we do not control.
This Privacy Policy does not apply to the privacy or security practices of third parties except to the extent we explicitly say otherwise. We encourage you to read the privacy notices and terms of any external service before using it.
If you sign in using a third-party provider, make a payment through a payment provider, or enter a partner-managed program or institution flow, that third party may collect and process personal data under its own terms.
When we update the notice
We may update this Privacy Policy from time to time to reflect changes in the service, our processing practices, applicable law, or operational needs.
When we do, we will update the “Last updated” date at the top of the page and, where required by law, provide additional notice or obtain fresh consent before the changes take effect.
How to reach us about privacy
ExamCrow [Legal Entity Name]
Privacy email: privacy@[your-domain].com
Grievance / escalation contact: grievance@[your-domain].com
Postal address: [Registered / principal business address]
Clear notice. Defensive language. Fewer brittle promises.
This page is intentionally written to be specific enough for transparency, but cautious enough to avoid claims that are hard to keep accurate as your stack, vendors, and product features evolve.