Privacy Policy

1. Introduction

ExamCraft AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered exam generation platform.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Authentication credentials (handled by Supabase Auth, which we run on our own server)

Uploaded Content

To provide our exam generation service, we process:

• Lecture materials you upload (PDFs, PowerPoint, Word documents, audio and video files)
• Extracted text and metadata from these files
• Generated embeddings for semantic search

Exam and Learning Data

We collect data related to your exam activities:

• Generated exam questions and answers
• Your exam attempts and responses
• Grading results and feedback
• Mastery tracking statistics

Usage Analytics

We may collect information about how you interact with the Service:

• Pages visited and features used
• Device and browser information
• IP address and general location
• Timestamps of activities

3. How We Use Your Information

We use collected information to:

• Provide and maintain the exam generation service
• Process your uploaded content and generate exam questions
• Grade your exam responses and provide feedback
• Track your learning progress and mastery
• Improve and optimize the Service
• Communicate with you about your account or the Service
• Ensure security and prevent fraud

4. Data Processing with Third Parties

OpenAI

We use OpenAI's API for AI-powered features. Depending on the feature, we send OpenAI:

• Text extracted from your uploaded files, to pick topics and generate exam questions
• Page images of image-heavy PDF pages, to read their content
• Figures cropped from your lecture files, to build questions about them
• Audio recordings, including lecture recordings, the audio track of videos and spoken explanations you record, for transcription
• Your answers and explanations, for grading and feedback
• Passages of your files, to create text embeddings for semantic search

Content sent to OpenAI is processed according to OpenAI's API data usage policies.

Cloudflare

Traffic to and from the Service passes through Cloudflare's network, which connects our server to the internet.

5. Data Storage and Security

Your data is stored using the following services:

• Supabase (self-hosted): We run Supabase's open-source software on our own server for user authentication, the PostgreSQL database and file storage. Your data is not stored with Supabase's hosted service.
• Embeddings: Stored in the same PostgreSQL database using the pgvector extension
• File Storage: Uploaded files, and page images and figures taken from them, are kept in private storage on our server

We implement industry-standard security measures including encryption in transit (HTTPS), secure authentication, and access controls to protect your data.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until account deletion
• Uploaded files: Retained until you delete them or close your account
• Exam data: Retained for your access and learning analytics
• Usage logs: Retained for up to 90 days for security purposes

7. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a machine-readable format
• Objection: Object to certain processing of your data

To exercise these rights, please contact us at the email address provided below.

8. Children's Privacy

ExamCraft AI is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

9. Third-Party Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]