Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:
Nomevex Inc.
Email: founder@nomevex.com

Data Protection Officer: Contact our DPO at dpo@nomevex.dev.

2. Data We Collect

2.1 Account Information

• Name, email address, institution affiliation, and role (student, instructor, administrator)
• Password (stored as a bcrypt hash — we never see your plaintext password)
• Multi-factor authentication secrets (TOTP)

Lawful basis: Art. 6(1)(b) — necessary for the performance of a contract (providing the platform service).

2.2 Exam Session Data

• Event metadata: timestamps, event types, session duration, scores
• Cryptographic hashes and Merkle tree integrity proofs
• Device integrity proofs and verification artifacts

Lawful basis: Art. 6(1)(b) — necessary for exam delivery and integrity verification.

2.3 AI Monitoring Outputs

• Detection events: face presence, object detection, behavioral analysis — with confidence scores
• Risk scoring factors: historical flags, device risk, network characteristics, behavioral patterns
• Plagiarism detection results (code similarity analysis)
• Collusion detection patterns (timing and behavioral correlation)

Lawful basis: Art. 6(1)(f) — legitimate interest in maintaining exam integrity. You have the right to object to this processing (see Section 8).

Automated decision-making: AI monitoring produces automated flags that are always subject to human review before any adverse action is taken. You have the right to obtain human intervention, express your point of view, and contest any automated decision (GDPR Art. 22).

2.4 Privacy Modes

Nomevex supports three configurable privacy modes. Your institution selects the mode for each exam:

• Minimal Audit Mode (default): AI runs locally on your device. Only event metadata, cryptographic hashes, and integrity proofs are transmitted. No raw video, audio, or screenshots leave your device.
• Selective Evidence Mode: Evidence (screenshots, audio clips) is captured only when specific trigger rules fire. Evidence is encrypted before upload and automatically deleted after the retention period.
• Full Monitoring Mode: Continuous recording of video, audio, and screen activity. Requires explicit institutional disclosure and governance approval. Used only for high-security examinations.

2.5 Device Information

• Operating system, screen resolution, peripheral devices
• Running processes during the exam (for unauthorized tool detection)
• Device fingerprint: browser properties (user agent, screen resolution, timezone, platform, language, hardware concurrency, canvas rendering, WebGL renderer) — hashed via SHA-256

Lawful basis: Art. 6(1)(f) — legitimate interest in session security (binding the exam session to a specific device to prevent device switching). The device fingerprint is stored in session memory only and is not persisted across browser sessions.

2.6 Behavioral Monitoring

• Keystroke dynamics: dwell time and flight time analysis (timing between keystrokes, not keystroke content)
• Mouse movement patterns: straightness detection (for bot detection)
• Window focus events and tab switches
• Process monitoring: detection of screen capture tools, remote desktop sessions, and unauthorized applications

Lawful basis: Art. 6(1)(f) — legitimate interest in detecting cheating and automated assistance. We do not record the content of your keystrokes, browsing history, or personal files.

2.7 Blockchain Anchoring

Cryptographic Merkle roots (hashes) are periodically anchored to the Polygon blockchain to provide immutable timestamp proofs. These hashes contain no personal data — they are one-way mathematical commitments to exam session data. Once published, blockchain data cannot be removed, but it contains no personally identifiable information.

Lawful basis: Art. 6(1)(f) — legitimate interest in providing tamper-evident, independently verifiable integrity proofs.

3. Data We Do NOT Collect

• Raw video or audio recordings (unless your institution explicitly enables Full Monitoring Mode)
• Keystroke content (the actual letters you type)
• Browsing history or personal files
• Location data or biometric identifiers (we detect face presence, not identity)
• Social media profiles or contacts
• Financial or payment information (processed entirely by DodoPayments — we never see your card details)

4. How We Use Data

• To deliver and verify examination sessions
• To generate cryptographic audit trails for integrity verification
• To detect and prevent academic dishonesty and integrity violations
• To provide AI-powered learning analytics (concept mastery, prerequisite gaps) when AI Learn is enabled
• To comply with institutional and legal obligations
• To improve our platform security and AI monitoring accuracy (using anonymized, aggregated data only)

5. AI and Automated Decision-Making

Nomevex uses AI models for the following purposes:

• On-device AI monitoring: Face presence detection, prohibited object detection, and behavioral analysis — runs locally on your device using ONNX models. No raw video is sent to our servers.
• Risk scoring: Multi-factor risk assessment based on session behavior, device characteristics, and historical patterns.
• Collusion detection: Pattern analysis across sessions to identify coordinated cheating.
• Plagiarism detection: Code similarity analysis using tokenization and winnowing algorithms.
• AI explanations: Narrative explanations of flagged behavior for reviewer context.

Your rights regarding AI decisions:

• All AI-generated flags are subject to mandatory human review before any academic or disciplinary action.
• You have the right to obtain a meaningful explanation of the logic involved in any automated decision.
• You have the right to obtain human intervention, express your point of view, and contest any automated decision (GDPR Art. 22).
• You have the right to request a review using only non-AI, human-only evaluation.

AI model provider: Where AI models from Microsoft Azure AI Foundry are used, your data is processed under a Data Processing Agreement. Microsoft does not use your data to train or improve their models.

This section is the summary. The AI Disclosure Notice is the detailed, plain-language account of every AI system in the platform, what each one receives, and what it is not allowed to decide on its own. Read that one if you want to know what happens to a specific decision.

6. Third-Party Processors

We share data with the following third-party processors, solely for the purposes described:

All third-party processors are bound by Data Processing Agreements. A full subprocessor list is available upon request.

7. Data Retention

Institutions can configure retention policies per-exam and globally. Automated deletion runs every 6 hours. Session anonymization is applied to completed sessions after the retention period.

8. Your Rights

Under GDPR and similar regulations, you have the right to:

• Access your personal data (Art. 15) — request a copy of all data we hold about you
• Rectification (Art. 16) — request correction of inaccurate data
• Erasure (Art. 17) — request deletion of your personal data
• Restrict processing (Art. 18) — request limitation of how we process your data
• Data portability (Art. 20) — receive your data in a structured, machine-readable format
• Object to processing (Art. 21) — object to processing based on legitimate interests, including profiling
• Withdraw consent (Art. 7(3)) — withdraw consent at any time, as easily as you gave it
• Contest automated decisions (Art. 22) — obtain human intervention, express your view, and contest any automated decision
• Lodge a complaint — with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@nomevex.dev or your institution’s Data Protection Officer.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. Where we transfer data internationally, we implement appropriate safeguards:

• EU Standard Contractual Clauses (SCCs) with all non-EEA processors
• Configurable data residency — institutions can select EU, US, or APAC regions for data storage
• Microsoft Azure AI Foundry processes data under EU Data Boundary commitments where configured

You may request a copy of the applicable transfer safeguards by contacting privacy@nomevex.dev.

10. Cookies

See our Cookie Policy for detailed information about the cookies we use.

We use only essential session cookies for authentication. We do not use analytics or advertising cookies.

11. Data Security

• AES-256-GCM encryption for all data at rest
• TLS 1.2+ for all data in transit
• Row-Level Security (RLS) for multi-tenant data isolation
• Hardware Security Module (HSM) / KMS key management with automatic rotation
• Tamper-evident audit logging with chain integrity verification
• Private Kubernetes cluster with network policies and workload identity

12. Children’s Privacy

Nomevex is used by educational institutions. For students under 16, we require institutional consent from the educational establishment or parent/guardian as required by applicable law.

13. Changes to This Policy

We will notify you of material changes to this Privacy Policy via email or prominent notice on the platform. Continued use after notification constitutes acceptance of the updated policy.

14. India — Digital Personal Data Protection Act (DPDP) 2023

If you are accessing Nomevex from India, the following additional disclosures apply under the Digital Personal Data Protection Act, 2023:

• Data Fiduciary: The educational institution using Nomevex is the Data Fiduciary. Nomevex acts as a Data Processor on the institution’s instructions.
• Consent: We process your data based on your institution’s instructions and, where required, your explicit consent. You may withdraw consent at any time by contacting your institution’s Data Protection Officer.
• Purpose Limitation: Personal data is processed only for the purposes described in this policy and as instructed by your institution.
• Data Principal Rights: Under the DPDP Act, you have the right to: (a) access information about processing, (b) correct inaccurate data, (c) erase data no longer necessary, (d) grievance redressal, and (e) nominate another person for data rights exercise.
• Grievance Officer: For DPDP-related grievances, contact grievance@nomevex.dev. We will respond within 72 hours.
• Cross-Border Transfer: Data may be transferred outside India as described in Section 9 (International Data Transfers). Such transfers comply with applicable DPDP rules.
• Data Breach Notification: In the event of a personal data breach, we will notify the institution and, where required, the Data Protection Board of India.

15. California — CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, security).
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this changes, we will provide a “Do Not Sell or Share My Personal Information” link.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (education records, device information) only to provide the service. You may request that we limit its use.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.
• Categories Collected: Identifiers (name, email), education records (exam scores, flags), internet activity (device info, session data), and geolocation data (derived from IP, if collected).
• Verification: We will verify your identity before responding to requests. You may designate an authorized agent to make requests on your behalf.

To exercise your CCPA/CPRA rights, contact us at privacy@nomevex.dev.

16. United Kingdom — UK GDPR

If you are in the United Kingdom, the UK GDPR (the retained EU GDPR as incorporated into UK law by the Data Protection Act 2018) applies. The same rights as described in Section 8 apply, with the following additional information:

• Supervisory Authority: Information Commissioner’s Office (ICO) — ico.org.uk
• UK Representative: For UK data subjects, Nomevex’s UK representative can be contacted at uk-rep@nomevex.dev.
• International Transfers: Where we transfer data from the UK to countries without an adequacy decision, we use the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs.

17. Contact

For privacy-related inquiries:
Email: privacy@nomevex.dev
DPO: dpo@nomevex.dev
Data Protection Officer, Nomevex Inc.