Privacy Policy

This Privacy Policy describes how Aiseptor Inc. (“Aiseptor,” “we,” “us,” or “our”) collects, uses, stores, and discloses personal data when you:

• visit or interact with aiseptor.com or any Aiseptor-branded subdomain;
• use the Aiseptor platform as an assessment administrator, institution, or enterprise customer; or
• participate in a proctored exam session as a candidate through a platform that has embedded Aiseptor.

This policy does not cover third-party websites or services that link to or from our properties. We encourage you to review the privacy policies of any third-party services you use.

2.1 Website visitors

When you browse aiseptor.com, we collect standard server and analytics data, including:

• IP address (truncated to /24 subnet before storage)
• Browser type, operating system, and screen resolution
• Referring URL and pages visited
• Date and time of visit

This data is processed in aggregate to understand how the site is used and to improve our content. We do not build individual behavioral profiles from visitor traffic.

2.2 Accounts and inquiries

When you create an account, submit a contact form, book a call, or sign up for the waitlist, we collect:

• Name
• Work email address
• Organization name and role
• Any message or information you voluntarily provide

2.3 Platform customers

Enterprise customers and assessment administrators who use the Aiseptor dashboard provide us with:

• Billing contact details
• Exam configuration data (exam codes, policy templates, whitelisted domains)
• Proctor actions and notes taken during a session

2.4 Exam candidates

See Section 4 (“Candidate exam data”) for the full disclosure specific to candidates.

We use the data we collect to:

• Provide and operate the service: provisioning exam sessions, generating audit reports, and delivering the proctor dashboard.
• Improve the product: analyzing aggregate usage patterns to prioritize features and fix defects.
• Communicate with you: responding to inquiries, sending transactional messages (session receipts, security alerts), and, where you have opted in, product updates.
• Comply with legal obligations: retaining records as required by applicable law and responding to lawful government requests.
• Detect and prevent abuse: identifying anomalous patterns that indicate fraud, unauthorized access, or policy violations.

We do not sell personal data. We do not use personal data to train machine-learning models beyond the scope of AI-cheating signal detection described in Section 4.

The Aiseptor agent collects the following data only for the duration of an active exam session. Data collection begins when the candidate joins (VPN tunnel established) and ends when the session closes (tunnel torn down). No persistent agent remains on the device after session close.

4.1 Network-layer telemetry

• Network access request records and timestamps (for policy enforcement; no payload contents are captured)
• Session cryptographic identifier (derived per session; rotated each exam)
• Assigned ephemeral VPN IP address
• Outbound connection destinations that fall outside the exam whitelist

4.2 Device security signals

• Running process names (checked against a known-AI-tool denylist; full process list is not transmitted)
• GPU VRAM utilization delta (used to detect on-device LLM inference; raw readings are not stored)
• Presence of known AI model file extensions (.gguf, .safetensors) at standard install paths
• Access policy and network configuration integrity status

4.3 What we do NOT collect

• Webcam or microphone streams
• Screen recordings or screenshots
• Keystrokes or clipboard content
• Browser history outside the exam session
• Personal files, documents, or application data

4.4 Purpose and legal basis

Candidate exam data is collected solely to generate a per-session integrity report (the “Aegis report”) delivered to the administering institution. The legal basis for processing is legitimate interest: specifically, the integrity of the assessment that the candidate voluntarily enrolled in; and, where applicable, performance of a contract between Aiseptor and the platform customer.

Candidates are informed of Aiseptor's involvement by the administering institution before the session begins. If you were not informed, contact the institution that administered your exam.

4.5 AI signal processing

Device security signals are analyzed in real time by automated classifiers to produce integrity flags (e.g., AI_LOCAL_LLM, GPU_VRAM_ANOMALY), the same class of on-device AI detection signals documented on our AI-overlay detection page. No individual signals are shared with external AI model providers. Classification occurs on Aiseptor-controlled infrastructure.

We share personal data only as described below:

• Platform customers (institutions). Exam integrity reports, session telemetry summaries, and proctor audit logs are shared with the institution that contracted for the exam. Candidates agree to this sharing when they accept the exam terms.
• Infrastructure subprocessors. We use Amazon Web Services (EC2, S3) for compute and storage, and Vercel for web hosting. These providers process data under our instructions and are bound by data processing agreements.
• Analytics. Aggregate, anonymized website analytics are processed by a privacy-preserving analytics tool. Individual visitor data is not shared.
• Legal requirements. We may disclose data where required by law, court order, or regulatory authority with jurisdiction over our operations. We will notify affected parties where legally permitted to do so.
• Business transfers. In the event of a merger, acquisition, or asset sale, personal data may be transferred to the successor entity under terms no less protective than this policy.

We do not sell, rent, or broker personal data to advertisers, data brokers, or any third party for commercial purposes.

We use a minimal set of cookies:

The Google Analytics and Microsoft Clarity cookies are non-essential and only set once you consent to analytics. Visitors in the EU, UK, and Switzerland see nothing fire until they explicitly accept; everywhere else, analytics runs by default with an immediate opt-out. We do not use advertising cookies, ad-network tracking pixels, or cross-site behavioral retargeting, and we do not share this data with ad networks.

You can review or change your choice anytime using the Cookie preferences link in the site footer.

On account deletion or contract termination, we delete or anonymize all associated personal data within 30 days, except where retention is required by law or audit obligation.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (subject to legal retention obligations)
• Restrict processing of your data in certain circumstances
• Port your data to another service in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent where processing is consent-based

To exercise any of these rights, contact privacy@aiseptor.com. We will respond within 30 days. For candidate data requests, we may require verification through the administering institution.

California residents (CCPA/CPRA). You have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as defined under CCPA. To submit a request, email privacy@aiseptor.com with the subject line “CCPA Request.”

EEA, UK, and Switzerland residents (GDPR / UK GDPR). You have the right to lodge a complaint with your local supervisory authority if you believe we have processed your data unlawfully.

The Aiseptor platform is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, contact privacy@aiseptor.com and we will delete it promptly.

For institutions that administer exams to minors under a contractual arrangement, separate data processing addendum terms apply.

We may update this policy to reflect changes in our practices, legal requirements, or product features. When we make material changes, we will:

• update the effective date at the top of this page;
• notify active platform customers by email at least 14 days before the change takes effect; and
• for significant changes, provide a summary of what changed.

Your continued use of Aiseptor after the effective date constitutes acceptance of the revised policy.

For privacy inquiries, data subject requests, or questions about this policy:

If you are a candidate who participated in an Aiseptor-secured exam and have questions about your session data, please contact the institution that administered your exam first. They are the primary data controller for your assessment record.