Security

Data Privacy

A detailed look at how Examly collects, processes, stores, and protects your personal data — and the rights you have over it.

Last updated: June 2026

Your data rights

👁️

Right of access

You can request a copy of all personal data we hold about you, including your account details, test results, and activity history.

How: Email privacy@examly.io with subject "Data Access Request"

✏️

Right to rectification

If any personal data we hold about you is incorrect or incomplete, you have the right to have it corrected.

How: Email privacy@examly.io or update your Google profile directly

🗑️

Right to erasure

You can request deletion of your account and all associated personal data. We will process this within 30 days, except where we are required to retain data by law.

How: Email privacy@examly.io with subject "Account Deletion Request"

📦

Right to data portability

You can request an export of your data in a structured, machine-readable format (CSV or JSON). This includes your test results and account information.

How: Email privacy@examly.io with subject "Data Export Request"

🔄

Right to withdraw consent

You can withdraw consent at any time by deleting your account or revoking Examly's access to your Google account.

How: Revoke at myaccount.google.com/permissions or email us to delete your account

🚫

Right to object

You can object to how we process your personal data, particularly where we rely on legitimate interests as our legal basis.

How: Email privacy@examly.io describing your objection

What data we hold

Category	Examples	Source	Retention
Identity data	Name, email address, profile picture	Google Sign-In	Duration of account + 30 days after deletion request
Usage data	Pages visited, time spent, features used	Automatically collected	90 days (anonymised after 30 days)
Exam data (teachers)	Questions uploaded, tests created, academy settings	Teacher inputs	Duration of account
Exam data (students)	Test attempts, answers, scores, results	Student activity	Duration of account; aggregate data may be retained anonymised

Our legal basis for processing your data

We process your personal data on the following legal bases: Contract performance: We need your name and email to create and operate your account, deliver test results, and provide the core service. Legitimate interests: We process server logs and usage data to keep the platform secure, detect abuse, and improve the product. We balance this against your privacy rights. Consent: Where you have explicitly opted in (e.g., receiving notification emails), we rely on consent. You can withdraw consent at any time. We do not process special category data (health information, biometric data, political opinions, etc.).

Data transfers

Examly uses Supabase for data storage. Supabase operates data centres in multiple regions. By using Examly, you consent to your data being stored and processed in these regions. Any transfers are protected by appropriate safeguards including data processing agreements and, where required, standard contractual clauses. We do not transfer your data to countries without adequate data protection laws without appropriate protections in place.

Data processors we use

We work with a small number of trusted third-party service providers who process your data on our behalf: • Supabase — database storage and authentication infrastructure • Google — OAuth authentication (you interact with Google directly) Each processor is bound by a data processing agreement and may only process your data as instructed by us.

How to exercise your rights

To exercise any of your data rights, email us at privacy@examly.io. Please include: • Your full name and the email address on your account • The specific right you wish to exercise • Any relevant details We will respond within 30 days. In complex cases, we may extend this by a further 60 days — we will notify you if this is necessary. You also have the right to lodge a complaint with your national data protection authority if you believe we have not handled your data correctly.

Exercise your data rights

Email privacy@examly.io — we respond within 30 days.