Privacy Policy

Prowiser ("Platform", "we", "us", or "our") is an academic management platform accessible at prowiser.in, designed for use by educational institutions, faculty members, and students across India. We operate as a data processor on behalf of subscribing Institutions and as a data controller for information we collect directly during Platform operation.

This Privacy Policy ("Policy") describes how we collect, use, store, share, and protect personal information when you interact with the Platform in any capacity — as an Administrator, Faculty member, or Student. It also describes your rights with respect to that information.

This Policy should be read alongside our Terms of Use, which govern your use of the Platform.

This Policy applies to all individuals whose personal data is processed through the Prowiser Platform:

• Master Administrators: Prowiser system operators who manage institutional subscriptions and platform-wide configuration.
• Institute Administrators: Designated administrators of a subscribed educational institution who manage faculty accounts and institution settings.
• Faculty Members: Academic staff who use the Platform to create quizzes, record attendance, manage grades, and initiate feedback campaigns.
• Students: Enrolled learners who access the Platform via quiz or feedback links shared by their faculty, using their institution-registered email address for verification.
• Visitors: Anyone who browses the public pages of prowiser.in (Home, Features, About, Contact, Terms of Use, Privacy Policy) without logging in.

If you are an employee or representative of a subscribing Institution providing personal data on behalf of students or other users, you confirm that you have the appropriate authority and consent to do so under applicable law.

The data we collect varies by your role on the Platform. The following table summarises what is collected from each user type:

Image uploads. Faculty may upload images (JPEG, PNG, GIF, WebP, max 8 MB) as part of quiz questions. These files are stored on the Platform server under a randomly generated UUID filename and served at /uploads/<uuid>.

We do not collect payment card data, government ID numbers, biometric data, or any sensitive personal categories as defined under Indian data protection law.

We collect information through the following means:

• Direct input by Administrators: When an Institution is onboarded, the Master Administrator enters the institution's name, domain, administrator name, and administrator email. Faculty accounts are created by Administrators who enter the faculty member's name and email.
• Direct input by Faculty: Faculty enter quiz content (questions, options, correct answers, marks), attendance records (present/absent/late per student per session), grade data (component-wise marks), and feedback campaign details.
• Direct input by Students: When a student accesses a quiz link, they enter their registered email address to verify enrollment. During the quiz, their selected answers, navigation behaviour, and submission timestamp are captured automatically.
• Student roster uploads: Faculty or Administrators may upload student email lists via CSV or Excel files to enroll students in a quiz or class. This data is provided by the Institution and Prowiser processes it solely as directed.
• Automated collection: Session cookies, quiz timing data, and tab-switch events are collected automatically as part of platform operation during an active quiz session.
• Server logs: Standard HTTP request logs (IP, path, timestamp, user-agent) are generated automatically for all requests.

We use the information collected for the following purposes, all of which are necessary to operate the Platform or fulfil our contractual obligations to subscribing Institutions:

• Authentication & access control: Verifying identity at login for Administrators and Faculty; verifying student enrollment at quiz entry using email addresses against the enrolled roster.
• Quiz delivery & grading: Generating and serving each student's unique question set; recording answers in real time; computing scores server-side upon submission; providing instant results to students and the Faculty live-monitor dashboard.
• Academic integrity monitoring: Recording tab-switch events during active quiz sessions and surfacing them to the assigned Faculty on the live monitor. These logs are stored as part of the quiz session record.
• Attendance management: Storing per-session attendance records (present/absent/late) and computing cumulative attendance percentages per student for each class.
• Semester grading: Storing component-wise marks entered by Faculty, applying configured grading formulas, assigning grade boundaries, and generating result sheets.
• Faculty feedback: Collecting anonymous student responses via feedback links; computing weighted scores per question; presenting aggregated results to the Faculty who initiated the campaign.
• Email communications: Sending account credentials to newly created Faculty and Administrators; sending quiz access codes and score reports (with PDF attachments) to enrolled students.
• Platform security: Rate-limiting login and quiz-login attempts per IP address and per email/entity pair to prevent brute-force attacks; enforcing session expiry; applying Content Security Policy headers.
• Institutional reporting: Providing Administrators with access to institution-wide academic data (faculty list, quiz activity, subscription validity) for management purposes.

Prowiser uses strictly necessary session cookies only. No advertising, analytics, or third-party tracking cookies are set.

• Authentication cookie: Set when an Administrator or Faculty member logs in. Keeps your session active and expires automatically after 24 hours or when you log out.
• Quiz session cookie: Set when a student begins a quiz. Authenticates the active quiz session and expires shortly after the quiz ends.

All session cookies are protected so that they cannot be read by browser scripts, are blocked on cross-site requests, and are transmitted only over encrypted connections. No passwords or personal details are stored within cookies — cookies hold only a secure session reference.

Public pages (Home, Features, About, Contact, Terms of Use, Privacy Policy) do not set any cookies. Cookies are only created upon a successful login or quiz session initiation.

Prowiser sends the following categories of transactional emails. All emails are sent only in direct response to a specific academic action — we do not send marketing or promotional emails.

• Account credential emails: Sent to newly created Faculty members and Institute Administrators containing their email address and a temporary password. These are triggered by an Administrator action and are sent once at account creation (or on request for a password reset).
• Quiz access code emails: Sent to enrolled students when a Faculty member initiates code distribution for an active quiz. Contains the student's unique one-time access code, the quiz title, duration, and a direct link.
• Score report emails: Sent to students upon quiz submission (when score release is enabled by the Faculty). Contains the student's score, percentage, and a PDF attachment of their detailed response sheet.

Email addresses used for credential and code delivery are provided by the Institution. Prowiser does not independently verify or validate these addresses beyond what is required to deliver the email.

Where data is stored. Prowiser stores data in secure server-side systems:

• User and institutional records — institution details, administrator and faculty accounts, and quiz session records are stored in a secure relational database that may be hosted on a managed cloud platform.
• Academic records — question banks, quiz configurations, attendance records, and grade data for each faculty member are stored as structured files on the application server. Uploaded images are stored under system-generated filenames.
• Temporary operational data — certain in-memory data used for platform operation (such as rate-limit state) is not persisted and is cleared when the server restarts.

Security measures. We implement the following safeguards to protect your data:

• All passwords are hashed using an industry-standard one-way algorithm before storage. Plaintext passwords are never stored or logged anywhere on our systems.
• Session tokens are cryptographically signed and carry a defined expiry. They are invalidated immediately upon logout.
• All traffic is served over HTTPS in production. Unencrypted connections are automatically redirected to HTTPS.
• Standard HTTP security headers are applied on all responses to protect against common web vulnerabilities.
• Rate limiting is applied to authentication endpoints to protect against automated credential attacks.
• File uploads are restricted to permitted image formats with a maximum file size, and are stored under system-generated filenames.

Prowiser does not sell, rent, or trade personal data with any third party. We share data only with the sub-processors listed below, strictly to operate the Platform:

We may also disclose data if required by applicable Indian law, a court order, or a lawful request from a government authority, or to protect the rights, property, or safety of Prowiser, its users, or the public.

Prowiser is purpose-built for educational use and applies particular care to student data:

• No student accounts. Students do not create accounts on Prowiser. They access specific features (quizzes, feedback forms) only through time-limited links shared by their faculty, verified against an institution-supplied email roster. This minimises the personal data collected to only what is necessary for the academic activity.
• Quiz data minimisation. During a quiz session, only the student's email address, selected answers, answer timestamps, and tab-switch events are recorded. No device fingerprinting, camera access, microphone access, or geolocation data is collected.
• Score visibility. A student's quiz score and response sheet are visible to the assigned Faculty member and to the Administrators of the subscribing Institution. Score release to the student (via email) is controlled by the Faculty and is not automatic.
• Tab-switch data. Tab-switch event counts are recorded per quiz session and are visible to the Faculty on the live monitor and in the session record. This data is used solely for academic integrity purposes and is not shared outside the Platform.
• Student data as Institution data. Student email lists and academic records entered or uploaded by the Institution are the Institution's data. Prowiser processes this data on the Institution's behalf and does not use it for any purpose unrelated to delivering the quiz, attendance, grading, or feedback service.

The Faculty Feedback module is designed with anonymity as a core principle:

• Students are informed upfront, before they begin the feedback form, that their identity will not be visible to the Faculty member.
• The Platform stores which students have submitted a response (to prevent duplicates), but the link between a student's email and their specific ratings or remarks is never exposed to the Faculty. Faculty see only aggregated weighted scores per question and an unattributed list of remarks.
• Administrators with database-level access could, in principle, join submission metadata with responses. Prowiser does not provide any UI for this, and doing so would be a violation of the Terms of Use.
• Feedback response data is stored as part of the Faculty's campaign record on the server. It is retained for as long as the Faculty's account is active.

Prowiser does not process feedback data for any purpose other than computing and displaying the weighted score report to the Faculty who initiated the campaign.

Active accounts. Data associated with active Administrator and Faculty accounts is retained for as long as the account exists and the Institution's subscription is valid.

Faculty deletion. When an Administrator deletes a faculty account, the faculty's question bank, quizzes, attendance records, and grade data stored in the server file system are permanently deleted. Quiz student and session records associated with that faculty member are deleted from the database.

Institution termination. Upon termination of an Institution's subscription, all data belonging to that Institution — including all faculty accounts, student records, quiz sessions, and institutional configuration — is retained for 30 days to allow for a data export request. After 30 days, all data is permanently and irreversibly deleted.

Student quiz data. Student quiz session records (answers, scores, tab events) are retained as long as the Faculty member's account is active. They are deleted when the Faculty account is deleted or when the Institution's subscription is terminated.

Server logs. Standard HTTP request logs are retained for a maximum of 90 days for security and diagnostic purposes, then deleted automatically.

Rate-limiting data. IP address and email-based rate-limiting counters are held in application memory only and are cleared every 15 minutes or on server restart.

Subject to applicable Indian data protection law and contractual limitations, you have the following rights with respect to your personal data held by Prowiser:

• Right to access: You may request a copy of the personal data we hold about you.
• Right to correction: You may request correction of inaccurate personal data. Faculty members and Administrators can update their display name via their account settings; email changes require Administrator action.
• Right to deletion: You may request deletion of your personal data. For Faculty and Administrator accounts, this is processed by the Institution Administrator or by contacting us directly. For student data, requests should be directed to the Institution first.
• Right to data portability: Institutions may request an export of their data in a machine-readable format (JSON/CSV) during the 30-day window following account termination.
• Right to restrict processing: In cases of disputed accuracy or unlawful processing, you may request that we restrict processing of your data while the matter is resolved.
• Right to object: You may object to processing that you believe lacks a legitimate basis. We will assess and respond within a reasonable timeframe.

To exercise any of the above rights, contact us at admin@prowiser.in with your name, email, Institution name, and a description of your request. We aim to respond within 15 business days. We may require identity verification before processing certain requests.

If you believe your data rights have not been adequately addressed, you may escalate to the relevant data protection authority under applicable Indian law.

Prowiser is designed for use in college and university settings and is intended for users who are at least 18 years of age. We do not knowingly collect personal data from individuals under 18.

If a subscribing Institution deploys Prowiser in an educational context that includes students under 18 (for example, a junior college or vocational institute), the Institution bears responsibility for obtaining appropriate parental or guardian consent as required by applicable law prior to enrolling such students in the Platform.

If you believe that a user under 18 has had their personal data collected without appropriate consent, please contact us at admin@prowiser.in and we will take prompt steps to investigate and, where applicable, delete the data.

We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the features of the Platform. When we make material changes, we will update the "Last Updated" date at the top of this page and notify active Institution Administrators via the registered institutional email address where reasonably practicable.

Your continued use of the Platform after the effective date of any update constitutes your acknowledgement of the revised Policy. We encourage you to review this page periodically.

A history of significant changes to this Policy is available on request by contacting us at admin@prowiser.in.

For any privacy-related queries, data access requests, or concerns about how we handle your personal information, please reach out to us:

We aim to respond to all privacy-related requests within 5 business days. For data deletion or portability requests, please allow up to 15 business days for processing.

This Privacy Policy is governed by the laws of India. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of Lucknow, Uttar Pradesh.