Privacy Policy

This Privacy Policy explains how Exclr8 collects, uses, shares, and protects your personal information when you use ExamPen and the CamPen app, in line with South Africa’s Protection of Personal Information Act (POPIA). Please read it carefully.

1. 1

   Introduction and who we are

   ExamPen and the CamPen app are owned and operated by Exclr8 Business Automation (Pty) Ltd, a South African company (“Exclr8”, “we”, “us”, “our”). Under South Africa’s Protection of Personal Information Act, 2013 (“POPIA”), Exclr8 is the responsible party for the personal information described in this policy.

   CamPen is a study app that lets students practise past examination papers and receive marked feedback. This policy applies to the CamPen app and to our website at exampen.ai (together, the “service”), and explains what personal information we collect, why we collect it, who we share it with, and the rights you have. You can reach us, including our Information Officer, through our contact page.

2. 2

   The information we collect

   We only collect the personal information we need to run the service. Depending on how you use ExamPen, this may include:

   • Account and profile information— your name, email address, and the profile photo associated with the account you sign in with.
   • Sign-in information— when you sign in with Google, Microsoft, or Apple, we receive a secure token and basic details such as your verified email address. We never receive your password for those accounts.
   • Your work and submissions— the answers you type, write with Apple Pencil, or photograph and upload so that they can be marked.
   • Activity and usage information— the tests you take, your marks, results and progress, your token balance and usage, your subscription status, and the sign-in providers linked to your account.
   • Device and technical information— the type of device you sign in on, your active sign-in sessions, and the IP address of a form submission, which we use to keep the service secure and prevent abuse.
   • Communications— the information you give us when you contact us or send feedback, and our replies.
   • Purchase information— confirmation of any plan or tokens you buy. We do not collect or store your card or banking details (see “Payments” below).
3. 3

   How we collect your information

   We collect personal information in three ways: directly from you, for example when you set up your account, submit answers, or contact us; automatically, as you use the service, such as your activity, progress, and technical information; and from trusted third parties, such as the sign-in provider you choose and the payment provider that processes your purchase.

4. 4

   Why we use your information, and our lawful basis

   POPIA requires us to have a lawful basis for processing your personal information. We use your information to:

   • provide and operate the service and your account, so we can give you what you have signed up for;
   • mark your answers and show you feedback, results, and progress, which is the core service you ask us to perform;
   • keep the service and your account secure, prevent fraud, spam, and abuse, and protect our users, which is in our legitimate interests and yours;
   • communicate with you, provide support, and respond to your requests;
   • improve the service and fix problems; and
   • comply with our legal obligations.

   Where the law requires consent, for example for certain processing of a child’s information, we rely on the consent of you or your parent or guardian, and you may withdraw that consent at any time.

5. 5

   AI marking

   Important

   When you ask for marking, your answers, including any handwriting or photographs, are processed by automated systems and trusted artificial intelligence services so that we can produce marks and feedback. This processing is carried out only to give you your result. We do not use your answers for advertising, and our AI processing is carried out under terms that do not permit your answers to be used to train the provider’s AI models.

6. 6

   Payments

   Important

   Payments for plans and tokens are handled by trusted payment providers, such as Apple’s App Store within the app, and a payment provider for any card payments offered on our website. The payment provider processes the payment and we receive only confirmation of your purchase, such as a transaction reference. We never see or store your full card or banking details.

7. 7

   Who we share your information with

   We do not sell your personal information, and we do not share it for advertising. We share it only with service providers (known as “operators” under POPIA) who process it on our behalf, under our instructions, and who are required to protect it to a standard at least equal to this policy:

   • Sign-in providers (Google, Microsoft, Apple) to log you in securely;
   • Payment providers, such as Apple, to process your purchases;
   • Microsoft Azure, which hosts and processes the service and its data;
   • Google reCAPTCHA Enterprise, which helps protect our forms from bots and spam;
   • an email provider, which delivers messages we send you.

   We may also disclose information where we are required to do so by law, or where it is necessary to protect our rights, our users, or the public. Each sign-in provider has its own privacy policy, which applies when you choose to use it.

8. 8

   Where your information is stored, and transfers abroad

   Our service runs on secure cloud infrastructure (Microsoft Azure), and your information may be stored or processed in data centres outside South Africa. Where personal information is transferred outside South Africa, we take steps to ensure it receives a level of protection consistent with POPIA and the rules that apply to transborder information flows.

9. 9

   How long we keep your information

   We keep your personal information for as long as your account is active and for as long as we need it to provide the service. Tests you archive are removed after approximately 30 days, and signing out clears your work from that device. When your account is deleted, we remove your personal information, except where we are required to keep certain records for legal, accounting, or security reasons. When information is no longer needed, we delete or de-identify it.

10. 10

    How we keep your information secure

    We protect your information using appropriate technical and organisational measures. These include encrypted connections (HTTPS/TLS), secured storage and access controls, and keeping your sign-in tokens only on your own device rather than syncing them to other devices. Exclr8 aligns its practices with the ISO 27001 information- security standard and with POPIA. No online service can be guaranteed completely secure, but we work hard to protect your information and to respond appropriately if something goes wrong.

11. 11

    Cookies and similar technologies

    We use a small number of essential cookies so that signing in and your session work correctly, for example to remember that you are signed in. We also use Google reCAPTCHA to protect our forms. We do not use advertising cookies or cross-site tracking.

12. 12

    Your rights under POPIA

    POPIA gives you rights over your personal information. Subject to the conditions in the Act, you have the right to:

    • be told when we collect your information and what we do with it;
    • ask us for a copy of the personal information we hold about you;
    • ask us to correct or update information that is inaccurate or incomplete;
    • ask us to delete or destroy information where we no longer have a lawful reason to keep it;
    • object, on reasonable grounds, to certain processing of your information;
    • withdraw any consent you have given, without affecting processing already carried out; and
    • lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your information lawfully.

    To exercise any of these rights, please use our contact page. We may need to confirm your identity before we act on a request, and we will respond within the time the law allows.

13. 13

    Children and students under 18

    The service is designed for high-school students, and we know that some users are under 18. If you are under 18, please review this policy with a parent or guardian and use the service with their permission. A parent or guardian may contact us at any time to ask what information we hold about their child, or to ask us to correct or delete it. We do not knowingly use a child’s information for any purpose other than providing and improving the service.

14. 14

    Changes to this policy

    We may update this policy from time to time as the service and the law change. If we make a material change, we will let users know through the service or by another appropriate method before it takes effect, and we will update the date shown at the top of this policy. We encourage you to review it from time to time.

15. 15

    How to contact us

    If you have any questions about this policy, about how we handle your information, or if you would like to exercise your rights, please get in touch through our contact page, where you can also reach our Information Officer. If you are not satisfied with our response, you may contact the Information Regulator of South Africa.