Privacy Policy & Student Data Protection

Proctors (“Proctors,” “we,” “us,” or “our”) provides an AI-powered conversational assessment platform for schools. This Privacy Policy explains how we collect, use, store, share, and protect personal data — including data belonging to students, many of whom are minors — in connection with the Proctors platform (“Platform” or “Service”).

This Policy applies to:

• Schools and their administrators who register for the Platform;
• Authorized Users (teachers, academic staff) who access the Platform on behalf of a School;
• Students who participate in Assessments delivered through the Platform, including where a Student is a child under the age of 18.

2.1 School and Authorized User Data

• Institution name, address, and board affiliation (e.g., CBSE, State Board)
• Teacher/administrator name, role, email address, and phone number
• Curriculum materials uploaded by the School (e.g., NCERT/board chapter content)
• Class rosters and grade-band information

2.2 Student Data

• Student name and class/section, as provided by the School
• Audio recordings and/or text of Student responses during an Assessment
• Transcripts generated from Assessment conversations
• AI-generated evaluations, including conceptual understanding, communication quality, and identified learning gaps
• Assessment metadata (timestamps, chapter/topic assessed, device type used)

2.3 Automatically Collected Data

• Basic technical data (IP address, browser type, device type) needed to deliver the tokenized assessment link and maintain session security
• Platform usage data (e.g., login times, feature usage) for Authorized Users

We use collected information to:

• Deliver AI-powered conversational Assessments to Students on behalf of their School;
• Generate per-student insight reports, including reports formatted for HPC/PARAKH alignment;
• Route low-confidence evaluations to human (teacher) review;
• Maintain platform security, including tokenized access control and audit trails;
• Provide dashboards and reporting tools to Authorized Users;
• Improve and maintain the reliability of our question-generation and evaluation systems, using de-identified or aggregated data wherever feasible;
• Communicate with Schools and Authorized Users about their account and the Service;
• Comply with applicable legal obligations.

• 4.1 School Role & Parental Consent: Proctors processes Student personal data at the direction of, and under agreement with, the School. The School is responsible for establishing the lawful basis for collecting and sharing Student data with Proctors, including obtaining verifiable parental or lawful guardian consent where required under the DPDP Act (in particular, Section 9, which governs processing of children's personal data) or other applicable law.
• 4.2 Direct Account Registration Consent: Where Proctors directly collects consent from a School or Authorized User (e.g., account registration), that consent is obtained directly and specifically for the stated purpose, in accordance with the DPDP Act's consent requirements.
• 4.3 Consent Withdrawal: Schools may withdraw consent for further processing of a specific Student's data by contacting Proctors, subject to the practical effect this may have on that Student's ability to use the Platform.

Because many Platform users are minors, we apply the following additional safeguards:

• We do not permit direct marketing or advertising to Students;
• We do not enable behavioral tracking of Students for purposes unrelated to delivering the Assessment;
• Student access is limited to time-bound (24-hour), role-restricted tokenized links rather than persistent individual accounts;
• Audio and transcript data is used strictly for evaluation and human-review purposes described in this Policy, and is not repurposed for unrelated commercial use;
• Schools act as the responsible party for confirming parental/guardian consent has been obtained where the DPDP Act or other applicable law requires it before enrolling a Student.

To deliver the Service, Proctors uses the following categories of third-party sub-processors:

Each third-party provider is engaged under contractual terms requiring them to process data solely for the purpose specified, apply appropriate security safeguards, and not use Student data for their own independent purposes (such as model training on identifiable data), to the extent such terms are available from the provider. We periodically review our sub-processor list and will update this Policy accordingly.

• 7.1 Security Safeguards: We apply administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including role-based access control, tokenized access links, and audit logging of report overrides.
• 7.2 Cross-Border Safeguards: Where Assessment data is processed by third-party AI providers located outside India, such transfers are made only where permitted under the DPDP Act and subject to appropriate contractual safeguards with those providers.
• 7.3 Incident Response: No system can guarantee absolute security. We will notify affected Schools in the event of a data breach affecting their Students' personal data, in accordance with our obligations under applicable law.

• 8.1 Retention Period: We retain Assessment transcripts, audio recordings, and insight reports for as long as reasonably necessary to fulfil the purposes described in this Policy, or as instructed by the School, or as required by applicable education recordkeeping or legal obligations.
• 8.2 Deletion Upon Agreement Termination: Upon a School's termination of its agreement with Proctors, we will delete or anonymize Student personal data within a reasonable period, except where retention is required by law or for the resolution of disputes, unless the School requests earlier deletion or export.
• 8.3 On-Demand Data Export: Schools may request export or deletion of their Students' data at any time by contacting us at the details below.

We share personal data only:

• With the School to which a Student belongs (e.g., insight reports, dashboards);
• With third-party service providers described in Section 6, strictly to deliver the Service;
• Where required to comply with a legal obligation, court order, or lawful request from a public authority;
• In connection with a merger, acquisition, or sale of assets, subject to continued protection of personal data under equivalent terms.

Subject to applicable law, including the DPDP Act, Data Principals (Schools, Authorized Users, and, through their School, Students/parents) may have the right to:

• Access a summary of personal data we hold;
• Request correction of inaccurate or incomplete data;
• Request erasure of personal data, subject to legal retention requirements;
• Withdraw consent for further processing, where consent is the basis for processing;
• Nominate another individual to exercise these rights in the event of death or incapacity;
• Register a grievance regarding the handling of personal data.

Requests relating to Student data should generally be routed through the Student's School, which acts as the primary point of contact for such requests. Schools or individuals may also contact us directly using the details in Section 13.

Our website and Platform may use strictly necessary cookies or similar technologies to maintain session security and enable core functionality (such as tokenized assessment links). We do not use third-party advertising cookies on Student-facing pages.

In the event of a personal data breach that is likely to result in harm to affected individuals, we will notify the affected School(s) without undue delay and take reasonable steps to mitigate the impact, in accordance with applicable law and our agreement with the School.

In accordance with the DPDP Act, questions, complaints, or requests regarding this Policy or the handling of personal data may be directed to:

Schools and Authorized Users may also raise concerns through their standard Proctors support channel.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated to registered Schools via email or in-platform notice, and the “Last updated” date above will be revised accordingly.

This Privacy Policy should be read together with our Terms of Service, Student Data Policy, and Security Overview.