Privacy Policy
Version 2026-07-01
1. Who we are and what this policy covers
Alumys LLC ("Alumys", "we") runs Alumys Tools, a cloud platform for organizations at tools.alumys.com. Its first product is Alumys Assessment, where organizations build and run examinations; products added to the platform later are covered by this policy too. The platform also includes the examination app where examinees take examinations, the public site at alumys.com, and the Alumys API. Our address is 626 N Alafaya Trail, Suite 206, Orlando, FL 32828, United States.
This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to everyone who uses our sites and services. It does not apply to the practices of our customers, the organizations that use Alumys to run their own examinations; see Section 3.
2. The three kinds of people we hold information about
- Account holders. Examiners and administrators who create or join an organization on the Tools console. You must be at least 18 to hold an account.
- Examinees. People an organization invites to take an examination. Examinees do not hold Alumys accounts; they use a tokenized link the organization sends them.
- Visitors and contacts. People who browse alumys.com, subscribe to our newsletter, contact support, or communicate with us as a prospective customer or vendor.
3. Our role: service provider for examinee data
When an organization uses Alumys to run examinations, that organization decides who to examine, what to ask, how long to keep the results and what to do with them. For that data the organization is the controller (a "business" under California law) and Alumys is its service provider (a "processor"). We process examinee data only on the organization's instructions under our Terms of Service and Data Processing Agreement, and we do not use it for our own purposes.
If you are an examinee and want to access, correct or delete information about your examination, contact the organization that invited you. Their name appears on the invitation and on the examination screen. We help organizations answer these requests and we will forward a request that reaches us directly.
For account holders, visitors and contacts, Alumys decides how the information is used and is the controller.
4. What we collect
4.1 Information you give us
| Who | Information | Why we collect it |
|---|---|---|
| Account holders | Name, work email address, password (held by our identity provider, never by us), organization name, role, profile settings, two-factor enrollment | To create and secure your account, and to let your organization manage its members |
| Account holders | Billing contact, billing address, tax status; card details go directly to Stripe and we hold only Stripe's customer reference and the last four digits | To charge for the service and issue invoices and receipts |
| Account holders | Examination content you author: questions, answer keys, rubrics, test cases, settings, branding | To provide the service; this content belongs to your organization |
| Examinees | Name and email address as entered by the inviting organization; any identifier the organization attaches to the invitation | To deliver the invitation and attribute results to the right person |
| Examinees | Answers, code submissions, uploaded files where the examination asks for them, time taken, scores, grading notes written by the organization | To run and grade the examination on the organization's behalf |
| Visitors and contacts | Email address and, if you give it, name and company, when you subscribe to the newsletter, request a demo or contact support; the content of your messages | To answer you and, with your confirmed opt-in, to send the newsletter |
4.2 Information collected automatically
| Information | Detail |
|---|---|
| Integrity signals during an examination | Browser events only: window and tab focus changes, copy and paste events, fullscreen changes, and timing. We do not access the camera, microphone or screen, and we do not collect biometric data or record the examinee. Signals are shown to the inviting organization as part of the result. |
| Device and connection data | IP address, browser type and version, operating system, screen size, language, referring page, and the pages or API endpoints requested, with timestamps |
| Visits to our public pages | On our public pages only, never inside the signed-in console or on examination pages, Plausible Analytics counts each visit: the page, the referring site, the country, and the browser and device type. It sets no cookies and keeps no IP address or other identifier, so we see aggregate totals only and cannot tell who visited. |
| Security and audit logs | Sign-in events, changes to organization settings and members, API key use, webhook deliveries. Logs carry request identifiers rather than names where possible. |
| Error reports | When something breaks, a report is sent to our error-tracking service. Personal data, credentials, cookies and request bodies are stripped before the report leaves our systems. |
| Cookies | See Section 8. |
4.3 Information from others
Our identity provider, Auth0, confirms your email address and tells us whether you signed in with a password or a single sign-on provider your organization configured. Stripe tells us whether a payment succeeded and the card brand and last four digits. We do not buy personal information from data brokers and we do not enrich your profile from social networks.
5. How we use information
- To provide, operate and secure the service, including authenticating you, delivering examinations, grading, and producing results and analytics for the organization that ran the examination.
- To bill and collect payment, detect fraud and abuse, and enforce our Terms of Service and Acceptable Use Policy.
- To answer support requests and to send service messages: security notices, billing notices, changes to terms, and notices about the organization you belong to. You cannot opt out of service messages while you hold an account.
- To send our product newsletter to people who confirmed their subscription (double opt-in). Every issue carries an unsubscribe link and our postal address, as the CAN-SPAM Act requires.
- To understand how the product is used in aggregate so we can improve it. We do this with counts and de-identified data, not by reading examination content.
- To comply with law, respond to lawful requests and protect the rights and safety of Alumys, our customers and examinees.
We do not use examination content, answers, code submissions or results to train machine-learning models, and we do not allow our vendors to.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We show no third-party advertising on any Alumys site or application.
6. Who we share information with
We share personal information only with the following, and only as far as needed to run the service:
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, storage, email delivery (Amazon SES) | United States |
| Auth0 (Okta) | Identity and authentication | United States |
| Stripe | Payments, invoicing, tax | United States |
| Sentry | Error reporting, with personal data stripped | United States |
| Redis Ltd. (Redis Cloud) | Rate-limit counters and short-lived cache; no personal data | United States |
We also share information: with the organization that invited you, if you are an examinee, because the results belong to them; with your organization's administrators, if you are an account holder, so they can manage members; with professional advisers and insurers under confidentiality; with a buyer or successor if Alumys is sold or merges, under this policy; and with authorities when the law requires it. We tell customers before we add or replace a subprocessor.
Every vendor in the table has signed a data processing agreement with us and processes data in United States regions.
Plausible Analytics (Plausible Insights OÜ), which counts visits to our public pages as described in Section 4.2, is not in the table because it receives no account, examination or customer data. It counts those visits in the European Union, without cookies and without keeping IP addresses.
7. How long we keep information
| Information | Retention |
|---|---|
| Account and organization records | Until the organization deletes itself or removes the member. Deleting an organization erases its records and the Auth0 identities of its members. We keep invoices and tax records for seven years as the law requires. |
| Examination content and answer keys | Owned by the organization; kept until the organization deletes the examination or itself. |
| Examinee answers, code, results and integrity signals | Kept for the retention period the organization sets on its account. At the end of it, personal identifiers are erased and scores survive only as anonymized rows for the organization's statistics. |
| Support tickets and threads | Two years after the ticket closes |
| Newsletter subscriptions | Until you unsubscribe. We keep a suppression record of unsubscribed addresses so we do not email you again. |
| Logs and error reports | 30 to 90 days. |
| Backups | Daily encrypted backups with point-in-time recovery, kept 30 days in production. Deleted data leaves backups on that cycle. |
8. Cookies and similar technologies
We use only cookies that the service needs to work:
- A session cookie and a rotating refresh cookie that keep you signed in to the Tools console. Both are HTTP-only and secure, and are cleared when you sign out.
- An examination token cookie that keeps an examinee's session tied to their invitation for the duration of the examination.
- A cross-site request forgery token. Your display preferences (such as the theme) are kept in your browser's local storage, not in a cookie.
We do not use advertising cookies or analytics cookies. We count visits to our public pages with Plausible Analytics, which works without cookies and without identifying you (Section 4.2). Because we set no tracking cookies and do not identify visitors, we do not respond differently to browser "Do Not Track" or Global Privacy Control signals; there is nothing for them to switch off.
9. Security
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Accounts are held by Auth0 and passwords never touch our servers; two-factor authentication is available to every account and required for Alumys staff. Access to production is limited to named staff behind multi-factor authentication and is logged. Code that examinees submit runs in an isolated sandbox with no network access and is not stored there. Our platform underwent seven independent security reviews before launch, and an independent penetration test is scheduled within 90 days of our first contract that requires one. Our security overview is published at alumys.com/security.
If a security incident affects your personal information we will notify the affected organization without undue delay and within 72 hours of confirming it, and we will notify individuals and regulators where state breach-notification laws require. Report a vulnerability to support@alumys.com with the subject line "Security".
10. Your choices and rights
10.1 Everyone
- Account holders can view and change their profile and organization settings in the Tools console, download their organization's data through the export features and the API, and delete their organization, which erases its data as described in Section 7.
- Newsletter subscribers can unsubscribe with the link in any issue or by writing to us.
- Anyone can ask us what personal information we hold about them, ask us to correct or delete it, or object to a use of it, by writing to support@alumys.com with the subject line "Privacy". We answer within 45 days. We will verify your identity first, usually by writing back to the email address on the account.
- Examinees should send requests to the organization that invited them (Section 3). If you write to us we will forward your request to that organization within five business days and help them answer it.
10.2 Residents of California and other US states with privacy laws
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another state with a consumer privacy law, you may have the right to know what personal information we collect, to access it in a portable form, to correct or delete it, to opt out of its sale, sharing or use for targeted advertising or profiling, and not to be discriminated against for exercising these rights. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of. Use the contact in Section 10.1 to exercise the other rights; you may use an authorized agent if you give them written permission. If we decline a request you may appeal by replying to our decision, and we will answer the appeal within 45 days.
California notice at collection: in the last twelve months we collected the categories listed in Section 4 (identifiers, commercial information, internet and network activity, professional information, and the examination-related information described there) for the purposes in Section 5, disclosed them to the service providers in Section 6, and kept them for the periods in Section 7. We do not collect sensitive personal information as California defines it, except that an examinee's account credentials at Auth0 are held by Auth0 on our behalf.
11. Children
Alumys accounts are for adults; you must be 18 or older to create one. Our services are not directed to children under 13 and we do not knowingly collect personal information from them. Organizations may invite examinees under 18 only where they have the authority to do so, for instance a school examining its own students, and they remain responsible for any consent the law requires. If you believe a child under 13 has been examined through Alumys without such authority, write to us and we will delete the record.
12. Where information is processed
Alumys operates from the United States and all of the vendors in the table in Section 6 process data in United States regions; Plausible Analytics counts visits to our public pages in the European Union without personal data. We serve customers in the United States. If we begin serving customers elsewhere we will update this policy with the applicable transfer mechanisms and legal bases before doing so.
13. Changes to this policy
We will post any change here with a new effective date and, for material changes, email account holders at least 30 days before the change takes effect; continuing to use the service after that date means you accept the new version. Earlier versions are available on request.
14. Contact
Alumys LLC, 626 N Alafaya Trail, Suite 206, Orlando, FL 32828, United States. Email: support@alumys.com with the subject line "Privacy".