Privacy Notice

1. What Information Do We Collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us, including materials you upload for exam generation.

We collect personal information that you voluntarily provide to us when you register on the Services, purchase credits, upload study materials, use the practice-exam and grading features, express interest in the Services, or otherwise contact us. This may include:

• Account data: name, email address, password (stored in hashed form), and account preferences.
• Uploaded content: study materials, documents, and files you upload for the purpose of generating practice questions, and your responses/submissions to those questions.
• Derived academic data: practice exam results, topic-level performance analytics, and grading feedback generated by our AI systems from your uploaded content and submissions.
• Payment information: processed by our payment processor, Paddle (see “When and With Whom Do We Share Your Personal Information?” below) — we do not directly store full payment card numbers.
• Communications: information you provide when you contact support or otherwise correspond with us.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Sensitive information

We do not intentionally collect special-category personal information (such as racial or ethnic origin, religious beliefs, health data, or sexual orientation). We ask that you do not include such information in the study materials you upload, other than where inherent to the academic subject matter itself (for example, a biology or health-sciences course). Because our Services are inherently designed to derive academic performance information from your uploaded materials, we treat that derived data with the same care as other account information described in this Notice, even though it is not “special category” data under most privacy laws.

Information automatically collected

In Short: Some information — such as your IP address, browser, and device characteristics — is collected automatically when you use the Services.

We automatically collect certain information when you visit, use, or navigate the Services. This does not reveal your specific identity but may include your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country/general location, and information about how and when you use the Services. This information is primarily used to maintain security and operation of the Services and for internal analytics and reporting.

We also collect information through cookies and similar technologies — see “Do We Use Cookies and Other Tracking Technologies?” below.

2. How Do We Process Your Information?

In Short: We process your information to provide and improve the Services, to process payments, to communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for the following purposes:

• To create and manage your account and provide the Services you request, including processing your uploaded study materials with AI models to generate practice exams, grade submissions, and produce performance analytics.
• To process payments and credit pack purchases through Paddle, our Merchant of Record.
• To respond to your inquiries and provide customer support.
• To send you service-related communications, including notices about changes to these terms, your account, or your credits.
• To send you marketing communications, where permitted by law and where you have not opted out.
• To monitor usage, detect and prevent fraud, abuse, or violations of our Terms of Service, and to maintain the security of the Services.
• To comply with our legal obligations, resolve disputes, and enforce our agreements.

We process your information only when we have a valid legal basis to do so, such as your consent, the necessity of processing to perform our contract with you (providing the Services you signed up for), our legitimate interests (such as security and service improvement), or compliance with a legal obligation.

3. When and With Whom Do We Share Your Personal Information?

In Short: We share information with service providers who help us operate the Services, and in specific limited situations described below. We do not sell your personal information.

We may share your personal information in the following situations:

• Payment Processing: We share payment-related information with Paddle, our Merchant of Record, which processes payments, currency conversion, and applicable tax compliance on our behalf. Paddle processes this information subject to its own Terms of Service and Privacy Policy.
• Service Providers: We share information with the following third-party vendors, each engaged strictly to perform defined services on our behalf and each subject to confidentiality and data protection obligations appropriate to its role:
  • Clerk (United States) — user authentication, identity verification, session management, and social sign-on (Google/GitHub). Clerk processes your account credentials and authentication tokens.
  • Convex (United States) — primary cloud database and persistent application storage. Convex stores your account data, uploaded study materials, and derived academic performance data.
  • Vercel (United States) — application hosting, CDN routing, and cookieless Vercel Web Analytics. Vercel hosts the Services and processes technical/usage data necessary to serve and monitor the application.
  • Paddle (United Kingdom / United States) — Merchant of Record and payment processor. Paddle processes payment details, billing information, and applicable tax compliance for your purchases.
  • DeepSeek (People's Republic of China) — third-party AI foundation model API provider. DeepSeek processes prompt data derived from your uploaded study materials, and your submitted answers, strictly for the purpose of generating practice exam questions and performing automated evaluation/grading. See “Is Your Information Transferred Internationally?” below for details on this specific cross-border transfer and the safeguards that apply to it.
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
• Legal Obligations: We may disclose your information where required to comply with applicable law, legal process, or governmental request, or to protect the rights, property, or safety of us, our users, or others.

4. Do We Use Cookies and Other Tracking Technologies?

In Short: We use cookies and similar technologies necessary for the Services to function, and for analytics.

We use cookies and similar tracking technologies in a limited, privacy-protective way:

• Strictly necessary/functional cookies: We use first-party session and authentication cookies and local storage tokens provided by Clerk (to keep you securely signed in and authenticate account access) and Paddle (to process checkout and prevent payment fraud). These are required for the Services to function and cannot be disabled without affecting your ability to log in or complete purchases.
• Analytics: Our website performance analytics are powered by Vercel Web Analytics, which is cookieless and does not use persistent identifiers or cross-site behavioral profiling. It reports aggregate usage patterns (such as page views and general traffic sources) and does not track you individually across websites.
• No advertising or retargeting: We do not run third-party advertising pixels (such as the Meta Pixel or Google Ads conversion tags), retargeting networks, or social media plugins on the Services. We do not use cookies to serve interest-based advertising, and we do not share your browsing activity with ad networks or data brokers.

If this practice changes in the future, we will update this Notice and, where required by law, provide the appropriate consent mechanisms (such as a cookie banner) before deploying any new tracking technology.

5. How Do We Handle Your Social Logins?

In Short: If you register or log in using a third-party account, we may receive certain profile information about you.

Because ExamBench allows account registration and sign-in via third-party providers (such as Google or GitHub through Clerk), we receive limited profile data — such as your name, email address, and profile avatar — strictly to provision and authenticate your user account. We do not access your external contact lists or post to your external accounts. We use this information only for the purposes described in this Privacy Notice. We do not control, and are not responsible for, other uses of your personal information by your third-party login provider; we recommend reviewing their privacy notice.

6. Is Your Information Transferred Internationally?

In Short: We may transfer, store, and process your information in countries other than your own.

We are based in Nepal, and your information is transferred to, stored in, and processed in other countries as described below. We structure this section by category of infrastructure so you can see precisely where each type of information goes.

Hosting & Database — United States

Your account data, uploaded study materials, and derived academic performance data are hosted and stored in data centers located in the United States, via our infrastructure providers Vercel (application hosting and CDN) and Convex (primary database). Authentication data (credentials, session tokens, social sign-on data) is likewise processed by Clerk in the United States. Payment data is processed by Paddle in the United Kingdom and United States.

AI Inference — People's Republic of China

When you upload study materials or submit answers for grading, the relevant prompt data (derived from your uploaded materials and your submissions) is transmitted to DeepSeek, our third-party AI foundation model provider, for the sole purpose of generating practice exam questions and performing automated evaluation. DeepSeek's infrastructure is located in the People's Republic of China. This means your prompt data is transferred to, and processed in, a jurisdiction outside the United States, the EEA, the UK, and Nepal, and one whose data protection framework differs from those regimes.

Safeguards for this transfer

Because this transfer is material, we apply the following measures:

• Data minimization: We transmit to DeepSeek only the prompt data necessary to generate or grade a given exam (i.e., the relevant content of your uploaded materials and your submitted answers) — not your full account profile, payment information, or authentication credentials, none of which DeepSeek receives.
• Purpose limitation: DeepSeek is engaged solely to provide AI inference for exam generation and grading as our processor, under contractual terms restricting its use of the data to providing that service to us.
• Contractual safeguards: Where required by the GDPR, UK GDPR, or equivalent frameworks, we rely on the European Commission's Standard Contractual Clauses (SCCs) (or the UK's International Data Transfer Addendum, as applicable) with DeepSeek, together with supplementary technical and organizational measures, as our mechanism for lawfully transferring personal data to a jurisdiction that has not received an adequacy decision.
• Your acknowledgment and consent: If you are located in the EEA, UK, or Switzerland, by uploading study materials or submitting answers for AI-based grading, you acknowledge and explicitly consent to the transfer of the associated prompt data to DeepSeek's infrastructure in the People's Republic of China for the purposes described above. If you do not wish for your data to be processed in this manner, please do not use the practice-exam generation and automated grading features of the Services; you may contact us at the details below to discuss alternatives.

General international transfers

Beyond the above, please be aware that your information may also be transferred to, stored by, and processed in other countries in which our service providers operate, consistent with Section 3 above. If you are located in the EEA, UK, or Switzerland, these countries may not have data protection laws as comprehensive as those in your home jurisdiction. Where required, we rely on appropriate safeguards — such as the SCCs described above — and we take reasonable technical and organizational measures to protect your personal information consistent with this Notice and applicable law.

7. How Long Do We Keep Your Information?

In Short: We keep your information only as long as necessary for the purposes set out in this Notice, unless a longer period is required by law.

We retain your account information and uploaded study materials for as long as your account remains active, so that you can continue to access your practice exams, results, and analytics. If you delete a specific uploaded document or delete your account, we will delete or anonymize the associated personal information within a reasonable period, except where we are required or permitted to retain it — for example, to resolve disputes, prevent fraud, enforce our Terms of Service, or comply with tax, accounting, or other legal obligations. Where deletion is not immediately possible (such as data in backup archives), we will securely store and isolate that information from further processing until deletion is possible.

8. Do We Collect Information from Minors?

In Short: We do not knowingly collect personal information from children under 13, and users under 18 require parental or guardian permission.

The Services are not directed to, and may not be used by, anyone under the age of 13, and we do not knowingly collect personal information from children under 13. If you are between the ages of 13 and the age of majority in your jurisdiction (generally under 18), you may only use the Services with the permission of, and under the supervision of, a parent or guardian, who must agree to our Terms of Service and this Privacy Notice on your behalf.

If we become aware that personal information has been collected from a user under 13 without appropriate consent, we will take reasonable steps to deactivate the account and delete such data from our records. If you believe we may have collected information from a child under 13, please contact us at exambench@creviolabs.com.

9. What Are Your Privacy Rights?

In Short: Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, and to withdraw consent where applicable.

Depending on the laws that apply to you, your rights may include the right to:

• Request access to and a copy of the personal information we hold about you.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your personal information.
• Request that we restrict or object to certain processing of your personal information.
• Request portability of your personal information, where technically feasible.
• Withdraw your consent at any time, where we rely on consent as our legal basis for processing. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, or processing carried out on another lawful basis.

Account information & Self-Service Deletion

You can review or update certain account information at any time by logging into your account settings. If you would like to terminate your account, you can perform full account deletion directly within your Profile settings or contact us using the details in “How Can You Contact Us About This Notice?” below. Upon request or execution, we will deactivate and delete your account and associated uploaded documents, exams, and credit balances from our active databases, though we may retain limited transaction records as strictly necessary to prevent fraud, assist with investigations, enforce our Terms of Service, or comply with legal requirements.

To exercise any of these rights, please contact us using the details below, or submit a data subject access request. We will respond in accordance with applicable data protection law and may need to verify your identity before fulfilling your request.

10. California Residents' Privacy Rights

In Short: If you are a California resident, you have specific rights under California law regarding your personal information.

If you are a California resident, you have the right to know what personal information we have collected about you, the categories of sources, the purposes for collecting it, and the categories of third parties with whom we share it; the right to request deletion of your personal information, subject to certain exceptions; the right to correct inaccurate personal information; and the right to opt out of the sale or sharing of your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising purposes.

To exercise these rights, contact us using the details in “How Can You Contact Us About This Notice?” below. We will not discriminate against you for exercising any of these rights.

11. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your preference not to have your online browsing activity tracked. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to DNT signals. If a standard is adopted that we are required to follow, we will update this Notice accordingly.

12. Do We Make Updates to This Notice?

In Short: Yes, we will update this Notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised “Last updated” date at the top of this Notice. If we make material changes, we will notify you by prominently posting a notice within the Services, and, for material changes affecting your rights, by sending you a direct notification (such as an email), consistent with our Terms of Service. We encourage you to review this Notice periodically.

13. How Can You Contact Us About This Notice?

If you have questions or comments about this Notice, you may contact us at:

14. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To exercise these rights, please contact us using the details in Section 13 above or utilize the self-service Delete Account option in your account profile.