Your data, on your terms.

• Account information: email address, full name, role category, optional LinkedIn URL, optional location. Collected at signup.
• Assessment data: your answers to assessment questions, resulting scores, percentile ranks, and credential URLs. Collected when you take an assessment.
• Integrity telemetry: during an assessment — tab switches and fullscreen exits, paste / copy / clipboard attempts, keyboard shortcuts, keystroke timing (when keys are pressed, never what is typed), mouse-movement patterns, per-question timing, your IP address and browser, an environment fingerprint (screen, CPU, timezone), and optional webcam snapshots (only if you consent to proctoring). Used to validate the integrity of your attempt.
• Usage telemetry: which pages you visit, which assessments you start, time on task. Used to improve the funnel.
• Sign-in and signup records: each time you sign in, the method (email link, Google, Microsoft or GitHub), your approximate location (country and region, worked out from your network by our host; we don't store your IP address for this) and your browser. When you sign up, also the website that referred you and the page you first landed on. Used to show you your recent sign-ins, warn you about a sign-in from a new country, and understand how people find Provyn.
• Payment information: card details are collected and stored by Stripe, our payment processor. Provyn never sees or stores your card number; we only see the Stripe customer ID and subscription status.
• Email log: every email we send to you with timestamps for sent / delivered / opened / clicked / bounced. Used to debug deliverability and respect your opt-out preferences.

• Deliver the service: render dashboards, score assessments, mint credential URLs, surface verified candidates to recruiters.
• Detect fraud and uphold credential integrity. Webcam snapshots and behavioral telemetry are only ever reviewed by admin reviewers, never by recruiters.
• Send transactional email (sign-in links, credential confirmations, billing receipts). You cannot opt out of these because they are how the service works.
• Send marketing email (lifecycle nudges, product updates). You can opt out at any time from /settings -- Email Preferences or via the unsubscribe link at the bottom of any marketing email.
• Improve the product. We aggregate anonymized usage patterns to decide which assessments to add and which parts of the funnel to fix.

We do not sell or rent your data.

Verified candidates appear in the recruiter directory by default once they pass at least one assessment. Approved recruiters can save you to a shortlist and contact you via the LinkedIn URL on your profile. You can opt out of directory visibility at any time by contacting provyn.app@outlook.com.

We share data with the following processors for service delivery:

• Airtable (database: accounts, assessments, results and records): account and profile details, answers, scores, integrity signals, audit records.
• Netlify (hosting, server functions and file storage): all data in transit; webcam snapshots (proctored attempts), backups, campus pilot records.
• Stripe (payments and subscriptions; optional identity verification): billing details (we see only IDs and status); ID documents when identity verification is used.
• Resend (email delivery): email addresses, names, email content.
• Upstash (sign-in tokens, session revocation and rate limits): email addresses, sign-in tokens, IP-based counters.
• Together AI (automated grading of written and code answers): answers and grading rubrics (no names or emails are sent).
• Sentry (error tracking): technical error details, which can include an email address or ID.
• Google, Microsoft and GitHub (sign-in, if you choose to sign in with them): name, email address and profile picture from that account. Only when you use that sign-in option.
• Slack (notifications to our team and to recruiters who connect Slack): names and email addresses of new signups; candidate updates a recruiter has subscribed to.
• Judge0 (running code in a sandbox during code questions): the code you run (no names or emails are sent). Only when code running is turned on.
• Greenhouse, Lever and Ashby (sending results to a recruiter's own hiring system): your profile and credential details that the recruiter chooses to send. Only when a recruiter connects their hiring system.

The same list, with where each vendor stores data, is at /subprocessors.

Our heading font is served by Fontshare, so your browser requests it from their servers (which see your IP address, as with any web request). Other fonts are served by us.

Each processor handles this data under its own terms and privacy policy. If you want to know which terms apply to a particular processor, ask us at the address above.

• Account data: kept until you delete your account. Deleting signs you out everywhere at once, and has a 7-day recovery window. After 7 days a daily job deletes your account, anonymises your assessment attempts (your answers, integrity telemetry and reviewer notes are erased; the unlinked score is kept only so other people's percentiles don't shift), and deletes your webcam snapshots, proctoring events, shortlist entries, integrity contests, email log and funnel events, sponsored-code grants, campus cohort memberships and verified-student record, and any recruiter client folders you are filed in.
• Webcam snapshots: deleted 90 days after the attempt is graded, or when your account is deleted, whichever comes first.
• Backups: daily database snapshots (a full one weekly) are kept for up to 12 weeks, for disaster recovery only. Deleted data ages out of backups within those 12 weeks and is never restored into live systems except to recover from data loss, with deletions re-applied first.
• Email log: retained 90 days for deliverability debugging.
• Funnel events: retained 90 days for product analytics.
• Client share links (recruiters' read-only links to a client folder): removed 30 days after they expire or are revoked.
• Adaptive exam routing records (which questions an adaptive attempt drew, and your first-block answers they were chosen from): deleted 90 days after the attempt is submitted and graded.
• Sponsored-code batches: reminder records are deleted 90 days after a batch expires. The batch and its codes are kept and are not deleted automatically. Your own sponsored-code grant is deleted if you delete your account.
• Stripe billing data: retained per Stripe's policies; we cannot delete records on Stripe's side because they are tax records.

• Right to access: download a JSON export of all your data via Settings -- Account -- Download my data. Includes your account row, every assessment attempt, your email log and funnel events, sponsored-code grants, campus cohort memberships, and (for recruiters) your shortlists, saved searches and client folders.
• Right to deletion: delete your account from Settings -- Account. Hard delete after the 7-day grace period.
• Right to opt out of marketing: unsubscribe link in every marketing email or Settings -- Email Preferences. Transactional email keeps flowing because it is how the service works.
• Right to data portability: the JSON export above is machine-readable and yours to take anywhere.
• Right to correction: edit your name, LinkedIn URL, location, etc. from /profile/edit. For email changes, contact support.

Apart from the campaign cookie described below, we use strictly-necessary cookies only: the sign-in session cookie (NextAuth JWT) and, while you take an assessment, an attempt cookie that authorises saving your answers. Your browser's local storage keeps your in-progress attempt id (so a refresh doesn't lose your work) and any referral code you arrived with; its session storage keeps the site that referred you and the page you landed on until you close the tab. If you arrive through one of our campaign links (provyn.app/join?c=...), a first-party cookie keeps that link's campaign code for 30 days, and if you sign up the code is saved on your account so we can tell which outreach worked. It holds only the code, nothing about you. No third-party advertising or analytics cookies. We do not use Google Analytics, Facebook Pixel, or any cross-site tracking.

Webcam access is requested only when you start a proctored assessment, and only if you grant consent. You can decline; your credential will simply not carry a Proctored badge.

Provyn is not intended for users under 16. Do not sign up if you are under 16. If we discover an account belongs to a minor we will delete it and contact a parent or guardian.

Data is stored in the United States (Airtable, Resend, Upstash, Netlify all in US East regions). If you are in the EU / EEA / UK, by using the service you acknowledge this transfer. If you have a question about the safeguards for a particular transfer, contact us at the address above.

If we make material changes, we will notify you via email at least 30 days before they take effect. Minor clarifications go live on the page; the "Last updated" date at the top reflects the most recent change.

Privacy questions? Email provyn.app@outlook.com. Data subject access requests get a one-business-day acknowledgment and a substantive response within 30 days.

Related: see /terms for the service agreement and /refund-policy for billing-specific terms.