Privacy Policy
Straightforward about how we handle your data.
Candidate data carries real weight — it influences hiring decisions and careers. This policy explains what information AssessIQ collects, why we collect it, how it is used, and what rights data principals have under India's Digital Personal Data Protection Act 2023.
Who we are
AssessIQ and the organisation operating it.
AssessIQ is a candidate and team assessment platform. It allows organisations to create, administer, and grade assessments for hiring, internal evaluation, and skill-gap analysis.
The platform is operated by AssessIQ, based in India at Bommanahalli, Bangalore 560068, India. References to "AssessIQ", "we", "us", or "our" in this policy refer to that entity.
Information we collect
What data we process, and where it comes from.
Candidate data
Name, email address, and assessment responses are collected when a candidate accepts an invitation to take an assessment. We also record attempt details (such as start and submit times and timing) and technical data such as IP address and browser or device information. Except for a real exam with the camera on (see below), AssessIQ does not record webcam, microphone, or screen content.
During an attempt, the application can record integrity events: fullscreen exits, tab switches, and blocked copy or paste actions. These events are shown to the organisation that runs the assessment. Also: photos and low-size video from a real exam with the camera on; the result of the readiness check (device type, screen size, browser, camera permission, network speed); and activity events.
Admin and account data
When a company administrator logs in to AssessIQ, we process their name, work email address, and role within the platform. Administrators are invited by their organisation; they do not self-register through a public sign-up flow.
Usage and platform logs
We maintain server logs of platform activity — page loads, API requests, errors — for security monitoring and debugging. Logs include IP addresses and timestamps. These are retained for a limited operational period and are not used for analytics or marketing profiling.
What we do not collect
We do not collect payment card details (the platform does not take card payments). We do not collect sensitive personal data — such as caste, religion, health status, or financial account numbers — and our assessment packs are reviewed to avoid questions that solicit such information.
How we use data
Purpose-limited processing.
Delivering and grading assessments.
Candidate data is used to administer the assessment the candidate was invited to take and to produce a scored result. Grading is performed on behalf of the hiring organisation. The result and any rationale are made available to that organisation's administrators once released. Multiple-choice answers are scored automatically by fixed rules.
AI-assisted evaluation of written answers.
Written answers may be evaluated by AssessIQ staff with AI assistance (Anthropic Claude). The text of the answer (and the question and rubric it is graded against) is sent to Anthropic for this purpose; candidate names and email addresses are not part of what is sent. Evaluation is run by AssessIQ staff, not automatically in the background, and results are reviewed before they are released to the hiring organisation. Assessment outcomes, band scores, and supporting rationale are compiled into reports that the hiring organisation uses to make hiring or evaluation decisions. We do not add our own interpretation beyond what the rubric produces.
Platform security and support.
Usage logs and metadata are used to detect abuse, investigate reported incidents, and respond to support requests. Data is not used for behavioural advertising, sold to data brokers, or shared with third parties for their independent marketing purposes. Photos and video from a real exam with the camera on are used to review the exam for cheating. We do not identify a person by face and we do not judge emotion.
Legal basis
India DPDP Act 2023 and our role in processing.
India's Digital Personal Data Protection (DPDP) Act 2023 governs the processing of digital personal data of individuals in India. AssessIQ operates in this framework in two capacities depending on context.
For candidate data, the hiring organisation (the company or institution that invited the candidate) is the Data Fiduciary — it determines the purpose of the assessment and bears primary obligations to the data principal under the Act. AssessIQ acts as a Data Processor, processing candidate data only on that organisation's instructions and for the purpose of delivering the assessment.
For administrator account data, AssessIQ acts as a Data Fiduciary with respect to the personal data of the administrators it onboards on behalf of their employer organisations.
In both cases, processing is purpose-limited: candidate data is processed to conduct and grade the assessment; it is not repurposed for unrelated activities. We continue to monitor DPDP rulemaking as subsidiary rules and guidance are issued under the Act.
Data residency
Where data is stored and processed.
Assessment data, candidate records, and attempt logs are stored in the platform's database on a virtual private server operated by Hostinger, with Cloudflare in front of it. Cross-border transfer: when written answers are evaluated with AI assistance, the answer text is processed by Anthropic, which operates in the United States, so that data leaves India for that purpose. Transactional emails (invitations, sign-in codes, results notices) are sent through Brevo. See the trust centre and the security page for the full infrastructure posture.
Data sharing
Who can see candidate data.
The hiring organisation.
The organisation that invited a candidate to take an assessment can view that candidate's result, band score, and supporting rationale. Access within the organisation is further limited by role (administrators and candidates see different things). No organisation can see data belonging to another. People at the organisation who review flagged events can also see that candidate data.
Sub-processors under contract.
We use a small number of sub-processors: Hostinger (server hosting), Cloudflare (network proxy and security), Brevo (transactional email), Google (optional sign-in with a Google account), and Anthropic (AI-assisted evaluation of written answers, processed in the United States). We limit what each receives to what its service needs, and we do not authorise sub-processors to use personal data for their own purposes.
On the public marketing website we use Cloudflare Web Analytics (see the website analytics section below). The website fonts are served by Google (Google Fonts), so your browser sends a request, including your IP address, to Google when a page loads. Cloudflare Web Analytics is not loaded on the assessment or administration application.
We do not sell data.
Candidate data, assessment responses, and account data are never sold to third parties, shared with data brokers, or used for advertising profiling. Disclosure to law enforcement or regulatory authorities occurs only where required by applicable law and, where permitted, after notifying the relevant Data Fiduciary.
Cookies & sessions
Essential cookies, plus marketing analytics.
AssessIQ uses session cookies solely to maintain a logged-in state during a platform session. These cookies are essential for the platform to function — without them, neither candidates nor administrators can authenticate.
On the assessment and administration application we run no third-party analytics, advertising, or session-recording scripts — no Google Analytics, no Meta Pixel, or anything equivalent. The only cookies there are the essential session cookies described above.
This public marketing website uses Cloudflare Web Analytics, a page-view counter from our network provider. It records the page you view, where you came from, your country, your browser and device type, and how fast the page loaded. Cloudflare says Web Analytics uses no cookies and no other browser storage, and does not follow you across sites or over time. Cloudflare keeps the full data for 7 days, then keeps aggregated data, and shows us up to six months of history. Cloudflare says its no-personal-data statement does not cover visits from the European Union and the United Kingdom. We run no advertising tool and no session-recording tool. The public demo page at /try is included, but the assessment and administration application never loads Web Analytics: we switched it off for the paths /admin, /candidate, /take, /embed and /api. See the Cloudflare Privacy Policy for Cloudflare's practices.
Data retention
Kept as long as needed, no longer.
Candidate data is retained for the lifecycle of the assessment engagement and for as long as the hiring organisation's account remains active on the platform. When a customer terminates their contract, candidate data associated with their account is deleted or anonymised within a reasonable period, subject to any legal hold obligations. Photos from a real exam with the camera on are deleted 90 days after they are taken, and video 7 days after it is recorded. For schools, photos and video are kept 7 days. If an attempt is flagged and a candidate appeals, the photos and video stay until the appeal closes, up to 90 days for schools and up to 1 year for other organisations. On an erasure request they are deleted sooner.
Organisations can request deletion of specific candidate records at any time via the admin interface or by contacting us. We will fulfil deletion requests subject to any mandatory retention period required by applicable Indian law.
Server and audit logs are retained for a defined operational period for security and compliance purposes and are then purged.
Your rights
Rights of data principals under the DPDP Act.
Access
You have the right to know what personal data is held about you, the basis on which it is processed, and who it has been shared with. Requests should be directed to the hiring organisation that administered your assessment, as it is the Data Fiduciary for that data. We will support the organisation in responding.
Correction
You have the right to request correction of inaccurate or incomplete personal data. If your name or contact details recorded in the platform are incorrect, contact the hiring organisation or reach us at the grievance address below.
Erasure
You have the right to request erasure of your personal data where the purpose of processing is fulfilled and no legal obligation requires retention. Erasure requests are processed in accordance with the DPDP Act and subject to any applicable legal hold.
Grievance redressal
You have the right to raise a grievance about how your personal data has been handled. See the grievance-redressal section below for contact details. We aim to acknowledge grievances within 48 hours and resolve them within the period prescribed under the DPDP Act.
Grievance redressal
How to raise a complaint.
If you have a grievance about how your personal data has been handled — consistent with the grievance-redressal expectations of the Digital Personal Data Protection Act 2023 — you can reach us using the details below:
Email:
[email protected]
Organisation: AssessIQ
Address: Bommanahalli, Bangalore 560068, India
Grievances should be submitted in writing with a clear description of the concern, the data involved, and the relief sought. We will acknowledge receipt and respond within the period prescribed by applicable law.
Eligibility
Not directed at children under 18.
AssessIQ is a professional and institutional assessment platform. It is not directed at children under the age of 18. We do not knowingly process the personal data of children in a consumer context.
Where an educational institution administers assessments to students who may be under 18, it is the institution's responsibility — as Data Fiduciary — to ensure that appropriate parental or guardian consent is obtained in accordance with the DPDP Act and any applicable institutional policy before inviting those students to take an assessment on the platform. A school or other organisation that tests children is responsible for the consent that the law requires. For schools the camera is off unless the school admin turns it on.
Policy updates
Changes to this policy.
We may update this policy as the platform evolves, as regulatory guidance under the DPDP Act develops, or as our data practices change. Material changes will be communicated to active account holders via the email address on record. The updated policy will be published at this URL with a revised effective date.
Continued use of the platform after a material change constitutes acceptance of the revised policy. If you do not accept the revised terms, you should cease using the platform and contact us to request deletion of your data.
Effective date: October 2026
Questions about how we handle your data?
If you have a specific privacy or data-protection question — about your candidate data, our DPDP Act posture, or a deletion request — reach out. We'll give you a plain answer.
Related policies