Privacy Policy

This Privacy Policy explains how MockPlaces collects, uses, and stores personal data when you use mockplaces.com as an educator, organisation member, platform admin, or candidate taking a test through the Test Center.

Depending on how you use MockPlaces, we collect:

• Account information — name, email address, and mobile number (collected during onboarding), and a hashed password if you use email/password sign-in.
• Organisation information — organisation name, type, logo, contact email, phone, and country, if you create or belong to an organisation.
• Exam and attempt data — exams and questions you create, licence codes, exam answers, submission timestamps, and scores.
• Screen Integrity Monitoring events — during a timed exam we log suspicious browser and screen behaviour (e.g. tab switches, window focus loss, fullscreen exits, copy/paste attempts) associated with that attempt. See Section 4 for the full detail of what this covers.
• Camera and microphone check — if an exam includes a video or audio response question, we record that a device check was completed (and whether audio/video were verified) before the timer starts. No preview footage is recorded or uploaded at this step.
• Video and audio responses— for exams with video- or audio-response questions, the candidate's recorded answer is uploaded to our storage provider and linked to that attempt so the educator can review it.
• Delivery logs — records of emails and SMS messages sent to you (recipient, type, and delivery status), so we can retry failed deliveries.

• To create and authenticate your account, and keep your session signed in.
• To operate exams: validating licence codes, running timed attempts, and calculating results.
• To send verification codes, results, testimonials, and certificates by email (and optionally SMS).
• To detect and log suspicious behaviour during a timed exam via Screen Integrity Monitoring.
• To generate draft exam questions with AI assistance, when an educator requests it.
• To maintain platform security, prevent abuse, and comply with legal obligations.

MockPlaces monitors suspicious browser and screen behaviour during timed exams. We do not claim this prevents all forms of cheating, and browser-based detection cannot reliably confirm the presence of additional monitors or devices — monitoring is limited to signals the browser itself can observe.

While an exam is in progress, we log the following event types against your attempt:

• Copy, paste, and right-click attempts
• Print and other suspicious keyboard shortcuts
• Tab switches and browser visibility changes
• Window focus loss (switching to another application or window)
• Fullscreen exit
• Browser or screen window resizing

Each logged event stores the event type, a timestamp, and safe technical metadata: viewport and screen dimensions, device pixel ratio, fullscreen state, document visibility state, and elapsed exam time. We do not capture raw screen recordings, screenshots, webcam footage (outside of video-response questions you are explicitly asked to record), keystroke content, or other invasive device data.

Our default policy shows a warning on the first flagged event, a final warning on the second, and holds the attempt for the exam's educator to review after a third. If an attempt is held for review, the educator sees the logged event types and timestamps — never your screen content — to decide whether to release the result.

When an educator uses AI-assisted question generation, the topic or lesson notes they submit are sent to whichever configured provider (DeepSeek, OpenAI, or Anthropic) is available to generate draft questions. Candidate answers and personal data are never sent to an AI provider — this feature only processes the educator's own input content. Generated questions are drafts; the educator must review and save them before they become part of a live exam.

We share the minimum data necessary with the following providers to operate MockPlaces:

• MongoDB Atlas — hosts our database.
• Resend — delivers verification, result, and certificate emails.
• Africa's Talking — delivers optional SMS notifications.
• DeepSeek, OpenAI, and/or Anthropic — generate draft exam questions when requested by an educator.
• Google — supports Google sign-in, if you choose that method.
• Vercel — hosts the application and scheduled background jobs.

We retain account, exam, and attempt data — including Screen Integrity Monitoring event logs and device-check records tied to an attempt — for as long as your account is active, or as needed to keep issued certificates verifiable. Verification codes and password reset tokens are short-lived and expire automatically. You may request deletion of your account by contacting us, subject to any records we're required to retain for security or legal reasons.

Passwords are stored as salted hashes, never in plain text. Platform-level service credentials are encrypted at rest. We use rate limiting on licence validation and verification endpoints, and access to organisation data is scoped so educators cannot see another organisation's exams, candidates, or results.

You can request access to, correction of, or deletion of your personal data by contacting us at the email below. Candidates can review their own results and certificates at any time from their MockPlaces dashboard.

MockPlaces is used by schools to administer tests to students. Where a candidate is a minor, we expect the inviting educator or organisation to have appropriate parental or institutional consent in place before issuing a licence code to that candidate.

We may update this Privacy Policy as MockPlaces evolves. Material changes will be reflected by updating the date at the top of this page.

Privacy questions or data requests can be sent to support@mockplaces.com.