Examinex Privacy Policy

1. Data Controller & Platform Scope

This Privacy Policy applies to the official Examinex educational platform (accessible via examinex.lk and associated subdomains), our official student Telegram bot (@examinexQuizbot), verified tuition teacher portals, and related educational services.

The data controller responsible for your personal information under the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) and international data standards is:

2. Information We Collect

We collect only the minimum necessary personal and academic information required to operate timed examinations, personalize AI tutoring, track syllabus progress, and provide instructor services.

2.1 Student Account & Demographic Data

• Identity Details: Full student name, preferred display name, and optional profile photo.
• Contact Details: Verified email address and mobile phone number (used for SMS OTP verification, password resets, and critical exam alerts).
• Academic Profile: Examination year (e.g. 2026 A/L), study stream (Physical Science / Maths, Biological Science, Commerce, Technology, Arts), selected subjects, and home administrative district (out of Sri Lanka's 25 districts).
• Security Credentials: Passwords stored strictly as one-way salted cryptographic hashes using standard bcrypt algorithms (never stored in readable plain text).

2.2 Examination Attempts & Performance Records

• Exam attempts taken (timed full exams, lesson practice quizzes, tournament trials).
• Submitted answers, correct/incorrect option breakdowns, and earned scores/percentages.
• Time elapsed per question and total examination duration.
• Lesson accuracy rates, historical progress trends, and district/island leaderboard positions.

2.3 Technical, Device & Connection Metadata

• IP address and geolocation country/city estimate (for anti-cheat integrity and DDoS prevention).
• Browser user-agent string, operating system version, and screen resolution.
• Authentication session tokens, CSRF tokens, and security access logs.

3. Examinex AI & Study Coach Privacy

Examinex AI powers the 24/7 personal study coach, providing weak-area diagnostics, daily study timetable generation, and step-by-step problem explanations.

4. Telegram Quiz Bots Data & OTP Security

Examinex provides two distinct Telegram bot workflows: our official platform bot (@examinexQuizbot) and private instructor bots.

Account Unlinking: You can disconnect your Telegram bot linking at any time from your Student Profile settings, immediately revoking all bot access tokens.

5. Instructor & Tuition Teacher Data

When tuition teachers and educators register on the Examinex Instructor Portal, we process specialized professional information:

• Verification Data: Full name, national identity verification, educational qualifications, degree certificates, and teaching subjects.
• Public Profile Details: Teacher biography, profile picture, tuition center locations, physical and online class schedules, YouTube/social handles, and student hall of fame rankings.
• Academic Assets: Custom question papers, lesson notes, and marking schemes authored by the instructor.
• Classroom Batch Analytics: Aggregated attempt metrics, class average scores, and topic difficulty ratings for enrolled students.
• Instructor Bot Tokens: Telegram BotFather API tokens are stored with strong database encryption and used exclusively to broadcast the instructor's own quiz content.

6. Payment & Financial Data Security

Examinex offers paid student memberships, tournament tickets, and subscription plans through secure, certified payment pipelines.

Processed Transaction Records:

• OnePay Online Gateway: Gateway transaction reference ID, payment timestamp, currency, amount paid, and verified payment confirmation status.
• Bank Transfer / Cash Deposit: Uploaded bank receipt image/PDF, bank branch name, deposit date, and staff verification approval timestamp.

7. How We Use Your Information

All data collected is used strictly for legitimate educational, operational, and security purposes:

• Online Exam Delivery & Auto-Grading: Generating dynamic MCQ papers, tracking server-side countdown timers, calculating marks, and displaying step-by-step solutions.
• District & National Leaderboards: Computing subject rankings across all 25 Sri Lankan districts. (Only display names and marks are shown publicly; phone numbers and emails are never exposed).
• Personalized AI Tutoring: Enabling Examinex AI to formulate tailored revision timetables and target lesson weaknesses.
• Account Security & Verification: Verifying accounts via OTP, preventing credential stuffing, and resetting passwords.
• System Notifications: Sending essential SMS/email alerts regarding exam results, membership renewals, and scheduled maintenance.

8. Anti-Cheat & Exam Integrity Monitoring

To preserve academic honesty in competitive exams and island-wide tournaments, Examinex utilizes non-invasive anti-cheat telemetry:

9. Cookies & Session Storage

Examinex uses lightweight, secure HTTP cookies and browser LocalStorage strictly for functional and security purposes:

Note: We do not use intrusive third-party cross-site tracking cookies for behavioral advertising.

10. Data Sharing & Third-Party Processors

We do NOT sell, rent, or trade your personal data. We share information only with trusted infrastructure partners bound by strict data protection agreements:

• Cloud Hosting & Database Infrastructure: Enterprise-grade cloud servers with encrypted data storage at rest and in transit.
• Payment Processors: OnePay Sri Lanka (for encrypted card payments) and banking partners.
• Messaging & SMS Gateways: Certified telecommunication SMS providers for delivering single-use OTP codes.
• Telegram Open Platform: Telegram API (strictly for users who explicitly opt-in to link their Telegram accounts).
• Legal Authorities: Only when strictly required by enforceable court orders or national law enforcement under the laws of Sri Lanka.

11. Security Safeguards & Encryption

Examinex implements multi-layered security controls to protect your data from unauthorized access, alteration, or disclosure:

12. Data Retention & Account Deletion

We retain your personal and examination records as long as your account remains active to provide continuous revision progress tracking across your A/L preparation years.

Right to Erasure (Account Deletion):

You may request the permanent deletion of your Examinex account at any time. When an account is deleted:

• Your personal contact information, passwords, and profile details are permanently purged from active databases.
• Historical exam attempts are either anonymized for statistical reporting or permanently deleted.
• Financial transaction records are retained only for the legally mandated period required by Sri Lankan tax and auditing legislation.

13. Your Legal Privacy Rights

Under the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) and international standards, you have the following rights:

14. Student & Minor Protections

Examinex is dedicated to high school and G.C.E. Advanced Level students, many of whom are between 16 and 19 years old. We enforce strict safety principles:

• We collect only educational data required to evaluate exams, generate lesson drills, and track curriculum progress.
• We never display students' private phone numbers, home addresses, or email addresses publicly on leaderboards or search engines.
• Parents and legal guardians may contact our Data Protection Officer at any time to review or request the removal of their child's account data.

15. Contact Our Data Protection Officer (DPO)

If you have any questions, privacy requests, data export inquiries, or wish to exercise your legal rights under the Sri Lanka PDPA, please contact us: