Testam — Privacy Policy
Effective Date: August 1, 2026 Last Updated: August 1, 2026
---
1. Overview
This Privacy Policy explains what information Testam ("the Platform", "the Service") collects, why it is collected, how it is used, and the choices available to you. It applies to the Testam web application and its supporting APIs.
Testam is developed and maintained by the Utilsware Team ("the Developer"). Testam is free to use.
Unlike a purely local tool, Testam is a hosted assessment platform: exams, questions, attempts, and results must be stored on our servers so that they can be delivered to candidates, graded, and reported on. This document is written in plain language so you know exactly what that means.
If this policy is updated, the revised version will be published at the same location with an updated Effective Date. Continued use of the Service after an update constitutes acceptance of the revised policy.
---
2. Information You Provide
Account information. Your name, email address, and password. Passwords are never stored in plain text — they are stored as salted one-way hashes and cannot be recovered by anyone, including the Developer. Email addresses are additionally stored in hashed form for lookup.
Organization information. If you create or join an organization: the organization name, branding assets you upload (such as a logo), member roles, and any domain you configure for join requests.
Assessment content. Questions, answer keys, explanations, categories, exams, sections, certificates and any media (images, video, documents) you upload for use inside them.
Candidate and attempt data. Responses submitted during an exam attempt, timestamps, scores, grader comments, and — where the exam owner has enabled it — proctoring signals such as fullscreen exits, window-focus changes, and violation counts.
Optional contact details. A mobile number, if you choose to use SMS-based one-time passcodes for exam access.
---
3. Information Collected Automatically
- Technical data required to operate the Service: IP address, browser and device type, and request timestamps. These are used for security, abuse prevention, and diagnostics.
- Session data: an authentication token issued at sign-in. It is held in your browser's session storage and is discarded when the tab is closed.
- Operational logs: error and performance logs used to keep the Service running. Logs are retained for a limited period and are not used to build advertising profiles.
---
4. Proctoring Data
Proctoring is off by default and is configured per exam by the exam owner. When enabled, Testam may record:
- Fullscreen entry and exit events
- Window and tab focus changes
- Blocked interactions such as copy, paste, right-click, or developer-tool access
- Webcam snapshots or screen recordings, only when the exam owner explicitly enables those options
Candidates are shown which proctoring measures are active before an attempt begins, and an attempt cannot start without consenting to them. Proctoring artifacts are visible only to the exam owner's organization and are deleted when the parent attempt is deleted.
---
5. AI Features
Testam offers optional AI-assisted question generation and AI-assisted grading of subjective answers. When you invoke one of these features, the relevant content — the prompt or topic you supply, or the question and candidate answer being graded — is sent to the configured AI provider (such as OpenAI, Anthropic, or AWS Bedrock) for processing.
- AI features are opt-in and are never invoked automatically.
- Only the content required for the request is transmitted; account credentials are never sent.
- AI-generated output is always presented as a draft for human review. AI grading results can be overridden by a human grader.
---
6. How Information Is Used
Information is used solely to:
- Authenticate you and enforce role-based access
- Create, deliver, and grade exams
- Produce analytics, reports, and certificates for the account or organization that owns the data
- Send transactional messages you or your organization have configured (invitations, exam links, one-time passcodes, result notifications)
- Maintain the security, integrity, and availability of the Service
Your data is never sold, rented, or licensed to third parties, and is never used for advertising or for profiling across other services.
---
7. Data Ownership and Sharing
Content you create belongs to you, or to your organization where you created it under an organizational account.
Within an organization, access is governed by role. Administrators and moderators can see the questions, exams, attempts, and results belonging to their organization. Members see only their own attempts and results.
Data is shared outside your account only in these cases:
- Service providers required to operate the Platform — cloud hosting, database hosting, object storage, email and SMS delivery, and the AI provider you invoke. Each receives only what is necessary to perform its function.
- Legal obligation — where disclosure is required by applicable law or valid legal process.
There is no other sharing.
---
8. Public Content
Questions and exams can be marked public. Public content is visible to anyone using the Platform. Certificates can be verified through a unique verification code; a verification lookup reveals only the certificate holder's name, the exam title, the issuing organization, and the issue and expiry dates.
---
9. Security
- All traffic is transmitted over HTTPS/TLS.
- Passwords are hashed with a modern, computationally expensive one-way algorithm.
- Access is enforced server-side on every request through role and organization checks.
- Uploaded media is stored in access-controlled object storage and served through signed, expiring URLs.
No online system can be guaranteed absolutely secure, but the Platform is built and maintained with these protections as a baseline.
---
10. Data Retention and Deletion
Your data is retained for as long as your account or organization is active.
- You may delete individual questions, exams, attempts, and media at any time from within the Platform.
- You may request deletion of your entire account by writing to the address in Section 13. On deletion, personal data is removed and content owned by you is deleted or, where it belongs to an organization you were part of, transferred to that organization's administrator.
- Backups are purged on a rolling schedule; deleted data does not persist in backups indefinitely.
---
11. Your Rights
You may:
- Access and export the data you have created
- Correct inaccurate account information from your profile page
- Delete your content or your account
- Withdraw from an organization
- Object to optional processing by simply not enabling the optional feature (proctoring, AI, SMS)
---
12. Children's Privacy
Testam is not directed at children under 13. Where an educational institution uses Testam with minors, that institution is responsible for obtaining the consent required by its jurisdiction and acts as the controller of the resulting data.
---
13. Contact
Questions about this policy, or requests relating to your data, can be sent to:
utilsware.admin@gmail.com