Privacy Policy

99exams.ai provides software for creators to run exam-practice websites. This policy covers the platform at 99exams.ai, the creator dashboard, and creator sites hosted on the platform (at 99exams.ai addresses or creators' own domains).

Creators may have their own privacy policies for their sites. If a creator's policy and this one differ on how the creator uses your data, the creator's policy applies to the creator.

• For creators and their teammates, we decide how account data is used, so we are the controller of that data.
• For learners on a creator site, the creator decides why learner data is collected and how it is used for their site, so the creator is the controller. We process that data on the creator's behalf, to run the site for them.
• Learner data is kept separate for each creator. A learner's account, attempts and notes on one creator's site are not shared with other creators.
• Creators' private question banks belong to them. We never use them to train AI models and never share them with other creators or third parties, except the service providers below that help us run the platform.

• Account information: name, email address, password (stored only as a secure hash), language preference, and the workspace or site you belong to. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Usage and learning data: the exams and questions you attempt, your answers, scores, time spent, notes, bookmarks and settings, plus basic technical data such as IP address, browser type and pages visited, used for security and to keep the service working.
• Uploaded files and content: documents creators upload (for example PDF or Word files), the questions and explanations created from them, images and site text.
• Payment metadata: when a purchase is made through Salla or Stripe, we receive details such as the order ID, product, amount, currency and status. We never receive or store full card numbers or card security codes; those are handled by the payment provider.
• Messages you send us, such as support emails and content reports.

We use information to:

• provide the platform: run accounts and creator sites, save progress, deliver exams and grant access after a purchase;
• process uploads, including extracting questions from documents;
• send service emails, such as sign-in links, receipts from the creator's provider, and important account notices;
• keep the platform secure, prevent abuse and fraud, and enforce our Terms (99exams.ai/terms);
• understand how the platform is used, in aggregate, so we can improve it;
• meet legal obligations.

We do not sell personal data, and we do not use it for third-party advertising.

Some features send content to AI models to do their job, for example reading an uploaded document to extract questions, or answering a learner's question about an explanation. This processing runs on Cloudflare's AI infrastructure as part of our hosting.

Content is processed only to provide that feature to you. We do not use creators' private question banks or learners' answers to train AI models, and we do not allow our providers to do so.

We rely on a small number of providers to run the platform. They may only use data to provide their service to us.

• Cloudflare: hosting, databases, file storage, content delivery, security and AI processing.
• Salla: e-commerce and payments, when a creator connects a Salla store.
• Stripe: payments, when a creator connects Stripe.
• Resend: sending service emails.
• Google: optional "Sign in with Google".

Payment providers act under their own privacy policies for the payments they process.

• With the creator whose site you use: creators can see their own learners' account details, purchases and practice results so they can run their site and support you.
• With service providers, as described above.
• When required by law, or to protect the rights, safety or property of our users, the public or us.
• If our business is reorganised or sold, data may transfer to the new owner, who must keep protecting it as this policy describes.

Our providers operate globally, so data may be processed outside the country where you live. When this happens we rely on appropriate safeguards required by applicable law, such as contractual protections.

• Account data is kept while your account is open.
• Learner data on a creator site is kept while the learner's account on that site exists, or until the creator deletes it or closes their site.
• When a creator closes their workspace, their content and their learners' data are deleted from our active systems within 30 days, and from backups within a further 90 days.
• Security logs are kept for up to 12 months.
• We keep payment and tax records for as long as the law requires.

We use encryption in transit, hash passwords, keep uploaded files private by default, and limit access to data to people who need it. No system is perfectly secure, so please use a strong, unique password. If we learn of a breach that affects you, we will notify you and the relevant authorities as the law requires.

Depending on where you live, including under Saudi Arabia's Personal Data Protection Law (PDPL) and the EU and UK GDPR, you may have the right to:

• be told how your data is used (this policy);
• access a copy of your data;
• correct inaccurate data;
• delete your data;
• receive your data in a portable format;
• object to or restrict some uses, and withdraw consent where we rely on it;
• complain to your data protection authority, such as the Saudi Data & AI Authority (SDAIA).

To use these rights, email privacy@99exams.ai. If you are a learner, we may pass your request to the creator who runs your site, because they control that data, and help them respond. We will reply within the time the law requires and may need to confirm your identity first.

We only use essential cookies that the platform needs to work:

• a session cookie to keep you signed in;
• a language cookie to remember your interface language;
• a colour-mode preference to remember light or dark mode.

We do not use advertising or cross-site tracking cookies, so there is no cookie banner to accept.

The platform is not designed for young children. Learners under 13 may only use a creator site with the consent and supervision of a parent or guardian, who can contact us or the creator to review or delete the child's data. If we learn we have collected data from a child under 13 without that consent, we will delete it.

We may update this policy as the platform changes. If a change is significant, we will tell you by email or in the dashboard before it takes effect. The date at the top shows when it last changed.

For privacy questions or requests, email privacy@99exams.ai.

For anything else about our terms, see 99exams.ai/terms.