Privacy Policy

Who this covers

Zensbot LLC provides exam-preparation software to coaching institutes. Two different groups have data here and they are treated differently.

An institute is our customer. Its students are the institute's users, not ours — the institute decides who has an account, what they can see, and whether they are charged. We hold their data on the institute's behalf and we do not market to them.

What we collect

• Account details: name, email address, phone number where given, and role within the institute.
• Exam activity: attempts, answers, timings, scores, and marking decisions.
• Study activity: practice sessions, flashcard reviews, notes, bookmarks, highlights and confidence ratings.
• Proctoring records where an institute enables it: the violation timeline for a sitting, such as leaving the exam window.
• Audio recordings for IELTS speaking, where that qualification is used.
• Technical records: sign-in times, IP address, browser, and error reports.

What we do not do

• We do not sell personal data.
• We do not use student work to train our own models.
• We do not contact an institute's students for our own marketing.
• We do not use webcam or microphone monitoring for proctoring. Proctoring is browser-based only.

Keeping institutes separate

Every institute's data is isolated at the database level using row-level security, scoped per request. One institute cannot read another's students, questions or results — this is enforced by the database rather than by application code that could forget.

Who we share it with

We use a small number of service providers to run the platform — hosting, email delivery, error reporting, payment processing, and an AI provider used for drafting questions and proposing marks.

Being confirmed. We are finalising the published sub-processor list, including which AI provider is named and whether its upstream providers are listed individually. Ask us and we will tell you the current list in full.

Where it is held

Application data is hosted in AWS in the Mumbai region (ap-south-1). The web front end is served by Vercel's global network.

How long we keep it

Being confirmed. Retention periods are being set — in particular how long exam attempts, proctoring records and IELTS speaking recordings are kept after an institute stops using the platform. Speaking-recording retention is deliberately unimplemented until this is decided rather than guessed at.

Your rights

If you are a student, your institute controls your account: ask them first, and they can reach us. If you are an institute, you can export your data and ask us to delete it.

Being confirmed. The self-service export and deletion tools are still being built. Until they ship, ask us and we will do it manually.

Security

• Passwords are hashed with argon2 and never stored in readable form.
• Sessions use short-lived tokens; the refresh token is held in a cookie JavaScript cannot read.
• Two-factor authentication is available and can be required.
• Repeated failed sign-ins lock an account temporarily.

Changes and contact

If we change this policy in a way that matters, we will tell institute administrators rather than quietly updating the page.

Being confirmed. A dedicated privacy contact address and the governing jurisdiction for this policy are being confirmed. In the meantime, write to us at hello@zensbot.com.