For colleges: how we process data

• The college is the Data Fiduciary for the personal data of its students and staff on Assessly. It decides why and how that data is processed, and gives the notices and obtains the consents the Digital Personal Data Protection Act, 2023 requires, including verifiable parental consent for any student under 18.
• Assessly is the Data Processor. It processes that data only on the college's documented instructions: the agreement, the annex, and the settings the college's staff choose. If Assessly believes an instruction breaks the law, it tells the college.
• Assessly is a Data Fiduciary in its own right only for the limited data it needs to run and secure the Platform and meet its own legal duties, such as sign-in records, security logs and invoices, and for individuals who use Assessly without a college.
• The college owns its data. It also keeps ownership of the questions, tests, lessons, rubrics and forms its staff create, and grants Assessly a perpetual, irrevocable, worldwide, royalty-free, transferable and sublicensable licence to use them in Assessly's products, including question banks, practice, AI and analytics. The licence continues after the agreement ends. Assessly does not publicly name the college as the source without its consent, or resell its papers as papers branded with its name.
• Third-party material. The college confirms it has the right to upload what its staff add, including material from textbooks or other sources, and is responsible for third-party rights in it.

Students

• Account: name, username, email addresses, password (only as a salted hash), photo, bio and status message; class, section, branch, batch year and university seat number (USN); email address changes and merged accounts; sign-in codes and two-step sign-in if turned on; preferences; account closure requests and their reasons.
• What they do on the Platform: practice and test answers, code and its history as it is written, scores, AI feedback and time per question; lesson progress, quiz answers, streaks, points, leagues and leaderboard rank; Ace tutor conversations, including a copy kept after they are cleared; spoken practice answers and transcripts; AI mock interview answers, transcripts, scores, filler-word and hesitation analysis, and CV text; career plan answers, job preferences and actions on jobs; feedback and form answers; product analytics.
• Device and technical: IP address, browser and device type, operating system, phone model, network type, app version, signed-in devices and sign-in history, phone push token and crash and error reports.
• Communications: Pulse posts, chats, direct messages, reactions and attachments, read and online status; moderation copies of edited, deleted and reported messages; emails sent and their delivery, email preferences; notifications and whether placement notices were opened.
• Assessments and integrity: proctoring consent records; test events; a browser fingerprint; webcam still images and sound levels where the college turns them on; in the desktop app, a selfie and ID card photo when the test requires it, and the results of device and system checks; answer similarity, flags, appeals and decisions.
• Placement: academic record as the college or student provides it (CGPA, backlogs, class 10, class 12 and degree percentages, date of birth, phone number, gender, category, attendance, education gap, work experience, exam scores); marksheet evidence and its review; CVs; a public profile if published; applications, rounds, offers, package, joining date, holds and appeals; readiness history and staff notes; imported attendance records, including distance from the venue.
• Support: support tickets and replies, in-app feedback with device details, and page feedback.

Staff

• Account: name, email addresses, role and permissions, photo, password (only as a salted hash), two-step sign-in, invitations.
• What they do on the Platform: content they author; the change history of placement and content records with old and new values; exports; Ace staff assistant conversations and uploads; notes made with AI placement tools; product analytics.
• Device and technical: IP address, browser and device type, signed-in devices and sign-in history, push token and crash and error reports.
• Communications: Pulse posts, chats, direct messages and attachments; messages to students; emails sent.
• Assessments and integrity: grading decisions, overrides, flag and appeal decisions, extra time and resits allowed.
• Placement: company and recruiter contacts they add; the college's billing contact, GSTIN and purchase order.
• Support: support tickets and feedback.

No financial account numbers, health data or biometric templates are collected for a college's students under the annex, and no government identifiers other than the USN are asked for, though a photo of an ID card can show one.

Analytics and error reports. In the web app, product analytics (PostHog) record signed-in users' pages and clicks with their account ID, name, email address, role and college, and error reports (Sentry) carry their account ID, email address, role and college ID. Both happen whatever the user chooses in the cookie banner. A replay of the screen around an error is attached only after the user accepts analytics cookies.

Voice. In AI mock interviews the student's voice is streamed to a speech provider to be turned into text; Assessly keeps the transcript and scores, not the audio. In the spoken interview practice in Learn, speech is turned into text by the recogniser built into the student's own browser or phone (from Google, Apple or Microsoft); Assessly receives only the text, never the audio.

During a proctored assessment the Platform records signals that help the college judge its integrity: leaving the test tab, window or full screen; paste events (the length and a fingerprint of what was pasted); attempts to open developer tools; attempt and submission times; similarity between students' answers; a browser fingerprint; and the student's proctoring consent. In the desktop app, when the test requires it, it also records a selfie and a photo of the student's ID card, and the results of device and system checks run before and during the test. Where the college turns on the camera, face detection runs in the student's browser and small still images are kept at the start and end of the attempt and when it detects no face, more than one face or the student looking away; there is no video. Where the college turns on the microphone, only numeric scores for whether voices are present are kept; no audio is recorded. Raw keystrokes are not recorded.

Assessly processes the college's data only to:

• create and manage accounts and class membership for students and staff;
• deliver practice, lessons, assessments, tutoring and mock interviews, and grade them;
• produce scores, readiness measures and the reports the agreement describes;
• support the integrity of assessments through the proctoring the college enables;
• run, secure, monitor and support the Platform, including service emails and phone notifications, and prevent abuse.

Assessly does not sell the college's data, use it for advertising or share it with other colleges. Identifiable personal data is never used to train AI models, and Assessly's AI providers are contractually restricted from training on the data Assessly sends them. Assessly may aggregate or de-identify the data so that no person can be identified from it, and use the result for any purpose, including benchmarks across colleges and training and improving its AI and products, together with the content the college licenses to it. Figures specific to the college are not published without its consent.

• To give AI feedback, interview turns and tutor replies, the text a student types or speaks is sent to OpenAI, in the United States. Email addresses are not sent. A student's name or details reach the AI provider only where the student or a staff member puts them into the text, such as a resume used to set up a mock interview.
• Accounts, email addresses or networks that the Platform blocks or flags for abuse lose AI features until the block or flag is cleared. Marking of the college's assessments is never affected, and the college can ask us to review any case.
• AI grades and feedback can be wrong. Staff can review any grade, and the college's faculty make the final academic decision.

Answers a student gives, by voice or typed, in the spoken interview practice in Learn, and their transcripts, are part of the college's practice and interview records. The college controls them, and Assessly does not delete them automatically. The college's staff see counts and scores, not the words. Coding practice and assessment submissions are visible to staff as usual. A student cannot delete their spoken answers, and closing their account does not delete them. A student's request to delete them goes to the college.

• The providers that process the college's data, what each receives and where, are the ones on our public Sub-processors page. The database, file storage and code execution are in India (Mumbai).
• Each provider is bound by contract to protect the data it receives and to use it only to provide its service. Assessly remains responsible to the college for what its sub-processors do with the college's data.
• Assessly tells the college by email at least 15 days before adding or replacing a provider that will receive its students' personal data. The college may object on reasonable data protection grounds; if the objection cannot be resolved, the college may end the affected services and receive a pro rata refund for the unexpired months.
• Transfers outside India are permitted by the DPDP Act except to countries the Central Government restricts; none of the providers' locations is restricted today.

• Separation between colleges: each college's data is isolated in the database by row-level security keyed on the college.
• Least access by default: access is closed unless a reviewed change opens it, and automated checks run before every release.
• Access by role: staff see and do only what their role allows. Assessly's own administrative access requires two-factor sign-in; college staff can turn it on in their settings.
• Encryption: all connections use HTTPS (TLS). Data at rest is encrypted by the hosting providers.
• Sign-in protection: passwords are stored only as salted hashes, and sign-in and public forms are protected against automated abuse.
• Assessment integrity: answer keys are not sent to students' devices, and during a paper a student's answers can be saved only to their own attempt.
• Records of changes: administrative actions, content edits, grade overrides, role grants and staff data exports are logged.
• Monitoring: automated abuse scanning, error monitoring and external uptime monitoring.
• Outside testing: a published bug bounty programme.
• People: personnel who can access personal data are bound by written confidentiality duties and given access only to what their work requires.

Assessly does not hold ISO 27001 or SOC 2 certification and does not claim to, and has no penetration test report from an outside firm. It does not offer a percentage uptime guarantee.

Assessly notifies the college's named contacts by email and phone without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting the college's data. The notice gives what is known at the time, and the rest as it becomes known: what happened and when; the categories and approximate number of people affected; the data involved; the likely consequences; what Assessly has done to contain it; and a contact person.

This is the information the college needs to inform the Data Protection Board of India and the affected students. Assessly keeps the college informed, helps with any notice the college gives, provides a written report once the breach is resolved, and does not write to the college's students about the breach without agreeing it with the college first, unless the law requires it.

• Requests to access, correct or erase data, or to raise a grievance, are handled through the college as Data Fiduciary. If a request reaches Assessly directly, Assessly passes it to the college within 3 working days and does not answer it on the college's behalf without agreement.
• When a request reaches Assessly directly, Assessly also tells the student it has passed the request to the college.
• Assessly helps the college answer a request within 7 working days of being asked. Students can view and correct their own profile on the Platform.
• Erasure the college instructs is carried out within 15 working days, unless the law or the college's own academic record duties require the data to be kept.

• A student whose account the college manages cannot close it or erase their data themselves. They ask the college to close it from their settings, with an optional reason, and can withdraw the request while it waits.
• The college's top-level administrator (the College admin, who manages the college's settings) approves or declines. A decline carries a written reason. The student is told either way, by email and in the app.
• An approved closure happens 14 days after approval. Until then the student can cancel it by signing in again or choosing "Keep my account".
• Closing removes the student's sign-in and personal data that is not a college record, such as their photo, notifications, Ace chats, saved jobs and unsent drafts. The college's records stay intact, with the student's name and USN, as the retention table above sets out.
• A student whose membership of the college ends becomes an individual, for whom Assessly is the Data Fiduciary, and can close their own account with the same 14 days to cancel. The college's records about them stay with the college.
• Every closure request and decision is recorded with who made it, for whom, when and the reason. College admins can see their college's record.

Once a year, and after any personal data breach, the college may send a reasonable written security and data protection questionnaire, which Assessly answers within 30 days. If that does not settle a reasonable concern, or a regulator requires it, the college or an independent auditor bound by confidentiality may review Assessly's relevant records on 30 days' notice, during working hours, at the college's cost, and without access to other colleges' data.

• Assessly provides an export of the college's data in common machine-readable formats, such as CSV or JSON, on request during the term and at its end, at no extra charge.
• Staff keep read access for 30 days after the term ends, to review and export.
• Within 30 days after that window, Assessly deletes the college's data from its live systems and confirms deletion in writing on request. Backups expire on the host's schedule.
• Proctoring evidence is the exception: Assessly asks the college in writing whether it should be returned, kept for the college's retention period or deleted, and acts only on the college's written instruction.
• Assessly may keep the minimum records the law requires, such as invoices.

• Grievances and requests from students or staff: grievance@assessly.in
• Breaches, outages and security incidents, at any hour: incidents@assessly.in
• The full annex, security reviews and everything else: hello@assessly.in