Privacy Policy

This Privacy Policy explains how Gradlok (“Gradlok”, “we”, “us”), the operators of the Gradlok platform at gradlok.app, collect, use, store, and protect personal data when you and your institution use our online assessment and proctoring platform (the “Service”). We are committed to handling data responsibly and in line with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Who is responsible for your data

When an institution (a school, college, or coaching institute) uses Gradlok to run exams, the institution is typically the Data Fiduciary that decides why and how student data is processed, and Gradlok acts as a Data Processor on the institution’s instructions. For data we collect directly (for example, from an institution’s administrators), Gradlok is the Data Fiduciary.

2. What data we collect

• Account & institution data — name, email, phone, role, and institution details of administrators and staff.
• Student & exam data — names or roll numbers, responses, scores, and results uploaded or generated during an exam.
• Proctoring data — webcam snapshots captured during an exam, tab-switch and activity signals, and related integrity flags.
• Technical data — device, browser, IP address, and log data used to operate and secure the Service.

3. Children’s data & parental consent

Many exams involve students under the age of 18. Under the DPDP Act, processing a child’s personal data generally requires verifiable consent of a parent or lawful guardian. Where an exam involves minors, the institution is responsible for obtaining and recording this consent, and Gradlok provides tooling to support consent capture. We do not knowingly use children’s data for tracking, behavioural monitoring, or targeted advertising.

4. How we use data

• To deliver, operate, and secure the Service;
• To generate results, reports, and integrity flags for the institution;
• To provide support and communicate about the Service;
• To comply with legal obligations.

We do not sell personal data, and we do not use proctoring data for any purpose other than delivering the Service to your institution.

5. Storage & security

Personal data is stored on secure, access-controlled servers hosted by our cloud infrastructure provider (MongoDB Atlas). We use technical and organisational measures — including encryption in transit and at rest, access controls, and monitoring — to protect data against unauthorised access, loss, or misuse.

6. Data retention

We retain personal data only for as long as needed to provide the Service and to meet legal requirements. Proctoring snapshots and exam data are retained for up to 90 days after the relevant exam, unless the institution requests earlier deletion or a longer period is required for a dispute or by law.

7. Sharing with third parties

We share data only with sub-processors that help us run the Service (such as cloud hosting and AI providers), under contracts that require appropriate protection, and when required by law. A list of sub-processors is available on request at admin@gradlok.app.

8. Your rights

Subject to the DPDP Act, you may request access to, correction of, or erasure of your personal data, and you may raise a grievance. Students and guardians should usually contact their institution first, as the Data Fiduciary. You can also contact us using the details below.

9. Grievance officer

For any privacy questions or grievances, you can reach our Grievance Officer by email at admin@gradlok.app. We aim to acknowledge grievances within a reasonable time as required under the DPDP Act.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email, and the “Last updated” date above will change.

11. Contact

Questions about this policy or your data? Email us at admin@gradlok.app.