Privacy Policy

Effective Date: September 1, 2026

Who We Are

ExamCademy is operated by Zaros AI OÜ (Estonian commercial registry code 16646980), a company registered in Estonia, which is the data controller responsible for the personal data described in this policy. For any privacy question or request, contact us at info@examcademy.com.

Information We Collect

• Account Info: Name, email, and login data via Auth0.
• Payment Info: Managed by Stripe, we don't store card details.
• Usage Data: With your permission, page views, interactions, browser information, performance measurements, and any enabled session replay collected through PostHog to improve the platform. When you are signed in, we associate these analytics with your account identifier, name, and email address so activity can be connected across sessions and devices.
• Marketing Measurement: With your separate permission, PostHog may send page visits, selected conversion events, conversion identifiers, and, when available, a hashed (pseudonymized) form of your email address to Reddit and Google Ads to measure the effectiveness of our advertising. We do not use this choice for personalized advertising, remarketing, or Customer Match audiences.
• Performance Data: Quiz scores, study progress, and time spent on questions for educational analytics.
• Community Contributions: Exam submissions, question content, comments, and contribution history for the community features.
• AstroTutor Interactions: Chat messages with AstroTutor (our AI tutor) to provide contextual assistance and improve the service.
• Leaderboard Data: Contribution statistics and rankings displayed publicly on leaderboards.

How We Use Your Information

• To provide and maintain exam access
• To process payments and manage subscriptions
• To respond to support requests
• To analyze and improve platform performance
• To personalize your learning experience
• To comply with legal obligations

Legal Bases

Where the GDPR applies, we rely on the following legal bases:

• Consent: Product analytics including any enabled session replay, marketing measurement, and marketing emails. You can withdraw consent at any time.
• Contract: Providing your account, exam access, study features, and payment processing.
• Legitimate interest: Site security and abuse prevention, including automated rate-limit enforcement; service error diagnostics; and measuring consent-banner outcomes with aggregate, identifier-free counts.
• Legal obligation: Keeping tax and accounting records.

Data Retention

We retain your personal data only as long as necessary to provide services and comply with legal obligations. Account data is deleted within 30 days of account closure, unless required by law to retain longer. Question-view and similar usage records are anonymized on account closure — detached from your account so they no longer identify you — rather than deleted, and are kept in that identifier-free form for aggregate statistics.

AstroTutor conversations are an exception worth calling out. Your messages, the exam content AstroTutor looks up to answer them, and what it remembers about your study goals are sent to OpenAI and stored on OpenAI's systems under their retention policy. This is required for the feature to work: AstroTutor answers in several steps, and each step refers back to the stored previous one. Deleting your ExamCademy account removes what AstroTutor remembers about you from our database, but does not delete conversations already held by OpenAI. Your chat history in the browser is stored only on your own device and is erased when you sign out.

Data Sharing

We do not sell personal data. We may share information with:

• Stripe (payment processing)
• Auth0 (authentication)
• OpenAI (AstroTutor feature - chat messages are processed and stored by OpenAI's API; see Data Retention)
• PostHog (EU-hosted product analytics; analytics events are sent only after you allow analytics)
• Reddit (advertising measurement; the Reddit Pixel loads only after you also allow marketing)
• Google Ads (advertising conversion measurement; selected PostHog events are eligible for export only after you also allow marketing). See how Google processes business data.
• Brevo (email service provider; sends a one-time transactional welcome email — using your account email and name — when your account is created, independent of marketing consent. Only with your marketing consent, Brevo additionally receives triggers derived from your study progress to send progress emails — every email includes an unsubscribe link)
• Service providers who assist our operations
• Law enforcement when required by law
• Business successors in case of merger or acquisition

Community & Public Information

When you contribute to our community features, certain information may be publicly visible:

• Your username and profile picture on contributed content
• Your position on community leaderboards
• Contribution statistics (number of approved exams, questions)
• Comments and interactions on community content

You can control your visibility in profile settings. Content you submit may remain on the platform even after account deletion if it has been approved and integrated into our question bank.

International Data Transfers

Some of our service providers process personal data in the United States: OpenAI, Stripe, Auth0 (Okta), Reddit, and Google. These transfers are protected by each provider's certification under the EU-U.S. Data Privacy Framework and/or by Standard Contractual Clauses. PostHog and Brevo process your data within the EU.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Automated Abuse Protection

To keep the question bank available to everyone, we automatically detect bulk access patterns, such as rapid automated retrieval of large numbers of questions. Detection can automatically suspend an account. If your account is suspended and you believe this was a mistake, you can appeal by emailing info@examcademy.com; a person will review the decision.

Cookies & Tracking

We use necessary cookies and local storage for login sessions, security, your display preferences, and remembering your cookie choice. These technologies are required to provide features you request and are not used for advertising.

Before you make a choice, activity from the current visit is held only in this browser's memory; it is transmitted to PostHog only if you accept analytics and is discarded otherwise. We also count how often the consent banner is accepted or rejected, without any identifier attached to those counts.

Optional tracking starts disabled. You can make separate choices for Product analytics and Marketing measurement. If analytics is enabled, PostHog helps us understand page usage, deliberately instrumented feature interactions, and site performance. Signed-in analytics are associated with your account identifier, name, and email. Depending on our PostHog project settings, analytics may include session replay showing how you navigate and interact with the site. Analytics data is retained only for as long as needed to analyze and improve ExamCademy, according to our configured retention settings.

Marketing measurement is an additional choice and is never enabled by analytics consent alone. If enabled, PostHog's Reddit Pixel site destination loads Reddit's tracking script and sends mapped page visits, including a conversion identifier and, when available, a hashed (pseudonymized) form of your email — never the plain address. Selected conversion events and identifiers, which may include that hashed email when available, also become eligible for export from PostHog to Reddit and Google Ads. Browser analytics and server-side conversion events transmitted after you accept carry the consent state under which they were sent — including activity from the same visit that was held in this browser's memory before your choice — and conversion exports to Reddit and Google occur only for events marked with marketing consent. The integration depends on PostHog events, so marketing can only be selected together with analytics. We do not send every PostHog event to these advertising services and do not use this choice for personalized advertising, remarketing, or Customer Match audiences.

You can reject all optional tracking without losing access to ExamCademy. You can also change or withdraw either choice at any time through Cookie settings in the site footer or the exam settings panel. Withdrawing stops future collection, clears the analytics identity stored by this browser when applicable, unloads the browser marketing destination, and marks future PostHog events as ineligible for advertising export. It does not automatically erase analytics collected before withdrawal; you may contact us to exercise your deletion rights.

Separately, we may process limited server-side error diagnostics needed to secure and maintain the service. These diagnostics do not use optional browser analytics storage or enable advertising tracking.

Your Rights

Depending on your location, you may have the following rights:

• Access, correct, or delete your personal data
• Restrict or object to processing of your data
• Data portability (receive your data in a structured format)
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

Children's Privacy

Our service is not directed at persons under 16. We do not knowingly collect personal information from persons under 16. If we become aware of such collection, we will delete the information immediately.

Changes to Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date.

Contact

Email us: info@examcademy.com