How ExamGuard handles your personal data

ExamGuard is exam-allocation and identity-verification software used by educational institutions ("institutions") to manage exam halls, seating, and attendance verification for their own students, invigilators, and staff.

Under the DPDP Act, each institution using ExamGuard is the Data Fiduciary for its own students and staff — it decides why and how their personal data is processed, and is responsible for having lawful basis (including parental consent for any student who is a minor) before enrolling them. ExamGuard acts as the Data Processor: we process data only on an institution's instructions, through the product, and never independently sell, share, or repurpose it.

For students: full name, roll number, institutional email, department, and a photo used solely to let an invigilator visually confirm identity at the exam hall door. For an exam: hall, seat, and schedule assignment.

For invigilators and institution admins: full name and institutional email, used to authenticate them and scope their access to their own institution's data.

Verification records: a timestamped log of each identity check at the hall (who, when, which invigilator, outcome) — kept as the institution's audit trail for exam integrity and dispute resolution, and to satisfy the Act's own accountability requirements.

We do not collect biometric templates, do not track location or behavior outside the product, and do not use any of this data for advertising.

Because students and staff are enrolled by their institution rather than signing up directly, the institution is responsible for informing them (and, for minors, their parents/guardians) about this processing and obtaining the necessary consent before uploading their data — this is a condition every institution affirms when they set up their ExamGuard account.

Consent can be withdrawn at any time by contacting your institution's administrator, who can deactivate or remove your account.

Practical measures already built into the product:

• Row-level database security scoping every institution's data to itself — no cross-institution access is possible even at the database layer.
• Photos are stored in private object storage and only ever served via short-lived signed links, never a public URL.
• Exam pass barcodes rotate every 90 seconds and are cryptographically signed — a screenshot stops working almost immediately.
• Password reset links are single-use, expire in 30 minutes, and are stored as a one-way hash — even a database compromise can't be turned into a working reset link.
• The verification audit trail is append-only: corrections are recorded as new entries referencing the original, never edits or deletions, so the record can't be silently altered.

If a security incident affects personal data, we will notify the affected institution(s) without undue delay so they can meet their own notification obligations to the Data Protection Board of India and their Data Principals.

Exam and verification records are retained for the institution's exam cycle plus a reasonable period afterward for audit and dispute-resolution purposes, after which an institution may request their deletion. A student or staff member may request earlier deletion of their own data at any time (see below) — an institution may decline a request while a specific record is still needed to resolve an active dispute, consistent with the Act's own retention exceptions.

Under the DPDP Act you have the right to:

• Access a summary of the personal data held about you.
• Correct inaccurate or outdated data.
• Erase your data once it's no longer needed for the purpose it was collected for.

Students can view their own stored data and submit any of these requests directly from the Privacy page inside the Student Portal. Admins and invigilators can request the same by contacting their institution's administrator or Grievance Officer directly.

Some institutions on ExamGuard are schools whose students are minors. For those institutions we require verifiable parental/guardian consent to be obtained by the institution before a minor's data is uploaded, and we do not permit behavioral tracking or targeted advertising involving any student account, minor or otherwise.

Each institution publishes its own designated Grievance Officer's contact details to its students inside the Student Portal, as required under the Act. For matters concerning ExamGuard itself as the Data Processor, contact:

yadamdheeraj64@gmail.com

The DPDP Act, 2023 is enforced by the Data Protection Board of India. This policy will be updated as the Act's rules and compliance timelines (final compliance across all provisions is scheduled by 13 May 2027) come into effect.