Your exam data belongs to you and your institution
Tomax is used by your university to run and grade exams. This page explains, in plain language, what we collect, why we collect it, who can see it, and what you can ask us to do with it.
Only what the exam needs
We collect the minimum required to deliver, secure and grade your exam. Nothing beyond the session.
You know what is happening
Before an exam starts you are told which measures are active and what will be recorded. No hidden monitoring.
Your institution owns the data
Tomax processes exam data on behalf of your university. They set the rules, including how long anything is kept.
Never sold, never trained on
Your work and your session data are not sold, shared with advertisers, or used to train commercial AI models.
What we collect
Only what the exam needs
Your institution decides which of these apply to your exam. Nothing here is collected outside the exam session.
Identity details
Name, student ID and institutional email, plus (where remote proctoring is used) a photo of you matched against an approved picture ID, so your paper is matched to you and your identity is confirmed before the exam starts.
Your exam responses
The answers you submit, plus timestamps and version history needed for grading and appeals.
Session integrity signals
Where your institution enables monitoring: your camera, microphone and screen activity during the exam window, recorded and reviewed only if there's a genuine integrity concern.
Defense responses
Where Smart Defense is used: your short explanations of your own reasoning, graded alongside the submission.
Technical logs
Device, browser and connection data, used to keep your session running smoothly and to evidence and resolve a technical failure during your exam.
What we never do
- Sell your data or share it with advertisers.
- Use your exam work to train commercial AI models.
- Monitor you outside the exam session.
- Access your files, camera or microphone once the exam ends.
- Make an integrity decision automatically. A human at your institution always reviews and decides.
Who sees what
Access is limited by role
You
Your own submissions, grades and feedback, through your institution's exam portal.
Your lecturer
Your submission and any flags raised for the exams they teach and grade.
Exam administrators
Session records for the exams they run, for scheduling, invigilation and appeals.
Tomax staff
No routine access. Support engineers access data only when your institution requests it, and every access is logged.
Your rights
You can ask what we hold, and ask us to change it
Under GDPR, FERPA and equivalent local laws, you have rights over your own records. Your institution is the data controller, so requests usually start with them, and we support them in fulfilling every one.
Contact our privacy teamKnow what we hold
Request a copy of the exam data associated with you.
Correct it
Ask for inaccurate details, such as identity records, to be fixed.
Ask for erasure
Request deletion once your institution's retention and appeal periods have passed.
Object or restrict
Raise an objection to a specific processing activity through your institution.
Contest a flag
Any integrity flag is reviewed by a person. You can respond before a decision is made.
Ask for accommodations
Request adjustments to how an exam is delivered or monitored, arranged with your institution.
How your data is protected
Certified, encrypted, and stored in your region
Tomax is GDPR compliant and supports regional data residency, so exam data can stay in the jurisdiction your institution requires. Data is encrypted in transit and at rest, and access is logged.
שאלות נפוצות
Questions students ask us
Something not covered here? Write to privacy@tomax.io.
Read our full Privacy Notice →Only if your institution has enabled proctoring for that exam, and you will be told before it starts. Monitoring runs for the duration of the exam session and stops when you submit. It never runs outside the session.