Trust Center
We record children’s voices. That obliges us to be precise.
Everything below is how the product actually behaves, not a statement of intent. Where something isn’t built yet, we say so on this page rather than leaving you to find out.
Consent
Nothing is recorded before a parent agrees.
On every channel, a student cannot begin a viva until a parent or guardian has given consent. The check runs before the homework is even read, so nothing belonging to a child without consent is processed or stored at all.
The consent screen declines as prominently as it agrees. A refusal is recorded and answered with “that’s completely fine” — a consent a parent felt nudged into is not one we could defend, or would want.
We record which version of the notice a parent actually saw, so we can always show what they agreed to. If the wording changes in a way that changes the meaning, that’s a new version and a fresh agreement.
Retention
Everything has a death date, and it’s enforced by a machine.
These are the defaults. A school can agree different periods in its data-processing agreement — and where those affect what a parent was told, the notice is updated and consent is taken again rather than quietly extended.
| Data | Default | Notes |
|---|---|---|
| Voice recordings of answers | 28 days | Deleted automatically. This is the default in the notice parents see. |
| Homework files and photos | 365 days | Deleted automatically. |
| Transcripts and parsed homework | 365 days | Deleted automatically by a nightly job. |
| Score, rubric and teacher decision | Term of the contract | This is the school’s academic record, and far less identifying than a recording. |
| De-identified research copy | 3 years | Opt-in only, and separately from consent to use Viva. Stored without name, number or school attached. |
Expiry runs nightly and has no button. Retention that a person can skip isn’t retention.
Rights
Asking us to delete a child’s data.
Requests come through the school. Under our agreement the school is the controller — it holds the enrolment records and knows which adult belongs to which child, which we cannot verify from a phone number. Google Workspace for Education, Canvas and Clever route it the same way.
A named person at your school can ask us for everything we hold on a student, or for its erasure. Erasure revokes consent first, then deletes the recordings, the homework files and any research copy, and redacts the transcript.
We keep a record that the request happened — who asked, how they were verified, what was destroyed — after the data itself is gone, because it is what proves the request was honoured. When a school leaves, the same process runs for every student.
Parents: contact your school first. If they can’t help, write to admin@examstutor.ai and we will work with them.
Who processes it
The complete list, and what each one sees.
Processing happens in the United States. The lawful basis for that transfer is the explicit, informed consent of a parent, supported by contracts with each processor. You get 30 days’ notice before we add anyone to this list, and you may object.
- Amazon Web Services
- Hosting and storage (United States)Sees: Everything, encrypted at rest under keys we control
- Anthropic, via AWS Bedrock
- Reading the homework, generating questions, evaluating answersSees: Homework content and answer transcripts
- OpenAI
- Speech-to-textSees: The audio of a spoken answer
- Meta Platforms
- WhatsApp deliverySees: Messages and media on the WhatsApp channel only
- Google LLC
- Google Classroom channelSees: Classroom course and roster data, on that channel only
What we don’t do
The list that matters most is the short one.
- Give a school an “AI detection” score, or tell you a student cheated
- Rank or compare students
- Sell data, or share it with anyone outside the processors listed above
- Advertise to students, or to their parents
- Let software decide anything about a child — the teacher always does
- Use a child’s recording in our own marketing
Being straight
What we’d rather you heard from us.
Speech recognition is weak on Nigerian-accented English. Every transcript can be wrong, which is exactly why the teacher receives the audio and why no score is a verdict.
Deletions cannot be edited out of backups. If we ever restore from one, outstanding erasures are re-run against it.
We are a small Nigerian company, not a multinational. What we have is a data-protection assessment, signed processor contracts, automated deletion, and an audit trail — not a wall of certification logos. We’ll show you all of it.
Documents, on request — before you commit, not after.
The data-processing agreement, our privacy impact assessment, the parent privacy notice, and the data-lifecycle procedure. Ask and we’ll send all four.