Last updated: 13 November 2026
1. About this policy
This Privacy Policy explains how TatvaOne Labs, Inc. (“TatvaOne.AI”, “we”, “us”), the company behind Proctorly and AcademicOS, collects, uses, shares and protects personal data. Our products are operated in the USA by TatvaOne Labs, Inc.
Company address:
TatvaOne Labs, Inc.
6860 North Dallas Parkway
Suite 200
Plano, TX 75024, USA
It covers:
- visitors to our websites, including people who fill in forms, book meetings or subscribe to our newsletter;
- staff of our customers (universities, colleges, exam bodies and other institutions) who use our products;
- candidates, learners and evaluators whose data is processed through Proctorly or AcademicOS on behalf of an institution.
We have written this policy with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and its Rules in mind, and with the EU and UK General Data Protection Regulation (“GDPR”) where it applies to us. Where an institution outside India is subject to other laws, such as FERPA in the United States or biometric privacy laws, its agreement with us sets out how we support its obligations.
2. Our role: when we decide, and when your institution does
Website, marketing and customer account data. For data we collect through our websites, forms, bookings, newsletters and the management of customer accounts, TatvaOne.AI decides why and how the data is processed. We act as the Data Fiduciary under the DPDP Act and as the controller under the GDPR.
Candidate and exam data. When an institution runs an exam, a course or a marking cycle on our products, the institution decides why and how candidate data is processed. The institution is the Data Fiduciary (or controller), and TatvaOne.AI processes the data on its behalf and on its documented instructions as a Data Processor (or processor), under a written agreement with that institution.
If you are a candidate or learner, your institution’s own notice tells you what it collects and why. Please send requests about your exam data to your institution first; we will help the institution respond.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Contact and enquiry data | Name, work email, phone, institution, role, exam type, candidates per sitting, products of interest, message | You, through our forms |
| Booking data | Meeting type, date and time, time zone, chosen meeting platform, notes, and the meeting link created for you | You, through our booking page |
| Newsletter and download data | Email, name, the resource you requested | You |
| Website usage data | Pages visited, referring page, campaign parameters (UTM), a hashed IP address, browser user agent; analytics data only if analytics is enabled and, where required, you have consented | Your browser |
| Customer account data | Names, work emails, roles and activity logs of institution staff who use our products | The institution and its users |
| Candidate exam data | Name, candidate identifiers, exam answers and timestamps; ID document images; face checks; webcam video and audio recordings; screen recordings; browser and device event logs; flags, reviewer decisions and reasons; support records | The candidate and the institution, during an exam |
| Marking and results data | Digitized answer scripts, marks, evaluator identity and evaluator face checks, results and revaluation records | The institution and its evaluators |
| Course and learner data (AcademicOS) | Enrollment, progress, submissions, feedback, questions asked to AskOS | The institution, faculty and learners |
What we capture in an exam depends on the assurance level the institution chooses for that exam. A recorded quiz needs less than a live-proctored licensing exam. See proctoring privacy for the detail at each level.
4. What we do not do
- We do not infer emotion, personality or intent from a candidate’s face or voice.
- We do not monitor candidates without telling them. Candidates are told what is captured before the exam starts.
- The optional Windows desktop agent notes that an application is open. It does not read the candidate’s documents or files.
- No automated flag fails a candidate or imposes a sanction. A trained person reviews each flag, and the institution decides.
- We do not use candidate recordings or data to train AI models unless the institution opts in.
- We do not sell personal data.
5. Why we use personal data, and on what basis
| Purpose | Data | Basis under the DPDP Act | Basis under the GDPR (where it applies) |
|---|---|---|---|
| Replying to enquiries, arranging demos and meetings | Contact, enquiry and booking data | Consent, or data you provided voluntarily for that purpose | Steps at your request before a contract; legitimate interests |
| Sending resources and newsletters | Email, name | Consent | Consent |
| Running and improving our websites; measuring campaigns | Website usage data | Consent where required | Legitimate interests; consent for non-essential cookies |
| Providing our products to institutions | Customer account data | Contract with the institution; legitimate uses | Contract; legitimate interests |
| Running exams, identity checks, monitoring, flag review and evidence records | Candidate exam data | Determined by the institution as Data Fiduciary; we process on its instructions | Determined by the institution as controller |
| Security, fraud prevention and keeping our systems working | Logs, account and usage data | Legitimate uses; legal obligations | Legitimate interests; legal obligation |
| Meeting legal obligations and defending legal claims | Any relevant data | Compliance with law | Legal obligation; legitimate interests |
Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing that took place before it.
6. Candidates under 18
Some exams, such as entrance and admissions tests, may include candidates under 18. Under the DPDP Act, processing a child’s personal data requires verifiable consent from a parent or lawful guardian unless an exemption applies. The institution, as Data Fiduciary, is responsible for obtaining that consent or confirming the exemption. We process such data only on the institution’s instructions and do not use it for tracking, behavioral monitoring outside the exam, or targeted advertising.
7. Who we share personal data with
- Service providers (subprocessors) that host our products, send email, deliver meetings and support our business, under written contracts that limit their use of the data. See our subprocessors page. Customers receive the full, current list with locations in the data processing agreement, and it is available on request at [email protected].
- The institution that runs your exam or course, for candidate and learner data.
- Meeting platforms you choose when you book a meeting, such as Microsoft Teams, Google Meet, Zoom or Webex, to create the meeting.
- Our customer relationship management and email service providers, to manage enquiries and send the emails you ask for.
- Authorities, where the law requires it, and professional advisers under confidentiality.
- A buyer or successor if our business is reorganized or sold, subject to this policy.
8. Where data is stored, and international transfers
Proctorly data is hosted in the client’s geographic location by default. An institution can choose another Amazon Web Services region, or keep data in its own S3 bucket, for example to meet its own data protection assessment or contract. Website and marketing data may be processed by service providers in other countries. You can ask us at [email protected] which providers process your data and where.
The DPDP Act permits transfers outside India except to countries the Government restricts by notification. Where the GDPR applies and data leaves the EU or UK, we use safeguards recognized by law, such as standard contractual clauses.
9. How long we keep personal data
- Candidate exam data is kept for the period the institution sets per exam policy, then deleted across live storage and backups, following a documented deletion process.
- Face checks are kept only as hashed, unchangeable signatures, only when an institution runs repeat exams for the same students, and are deleted on request when the contract ends.
- Enquiry, booking and lead data is kept for as long as needed to handle your enquiry and any follow-up, then deleted or anonymized. You can ask us to delete it sooner.
- Newsletter data is kept until you unsubscribe.
- Logs are kept for as long as needed for security and to keep our systems working, then deleted or anonymized, or longer where the law requires.
10. How we protect personal data
Each institution’s data is kept separate from every other institution’s. Our staff get least-privilege access, and all access is logged, including our reviewers’. A tamper-evident audit trail records every view, decision and change in an exam case. Vulnerability assessment and penetration testing are carried out by an empanelled auditor, with a summary available on request. See security for more.
If a personal data breach affects you, we will notify the relevant institution, the Data Protection Board of India and you, as the law requires.
11. Your rights
Under the DPDP Act you have the right to:
- get a summary of your personal data and how it is processed;
- have your personal data corrected, completed, updated or erased;
- withdraw consent where processing is based on consent;
- have a readily available means of grievance redressal;
- nominate another person to exercise your rights in case of death or incapacity.
Where the GDPR applies, you also have rights to access, rectification, erasure, restriction, data portability and to object, and to complain to your local supervisory authority.
Candidates and learners: please contact your institution first. It controls your exam data and will ask us to help where needed. If you contact us directly, we will pass your request to the institution.
To exercise your rights over data we control, write to [email protected]. We will verify your identity before acting and respond within the period the DPDP Act and its Rules require.
12. Cookies
Our websites use cookies that are necessary to run the site and, only if enabled, analytics cookies. See our Cookie Policy.
13. Grievance Officer and contact
If you have a question or complaint about how we handle personal data, contact our Grievance Officer:
- Grievance Officer: TatvaOne Labs, Inc.
- Email: [email protected]
- Address: 6860 North Dallas Parkway, Suite 200, Plano, TX 75024, USA
We aim to resolve grievances within the period the DPDP Act and its Rules require. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
14. Changes to this policy
We will update this policy when our products or the law change. We will post the new version here with a new “Last updated” date and, for material changes, tell customers in advance.