Privacy Policy
Effective: October 17, 2026 · Operator: Auralen Holdings LLC, doing business as MapMyExam ("we," "us") · Contact: hello@mapmyexam.com
This policy says what we collect, why, how long we keep it, and what we never do. It is written to be read.
1. The short version
- You upload exam statistics. We strip student names and IDs before the file leaves your browser.
- We store only what the report needs, and we delete response-level data on a schedule.
- We never sell data, never run third-party analytics on upload or report pages, and never use your items or reports to serve other customers.
- A human educator reviews every report. No report is sent without that review.
2. What we collect
Account information. Your email address, name, institution and role, provided when you sign in. Sign-in uses email magic links or Google; we do not store passwords.
Exam files. Item-analysis exports from your testing software. Before upload, your browser removes every sheet containing student-level data and blanks instructor names. What reaches us: item text, answer options, response counts and percentages, item statistics (difficulty, discrimination, reliability), blueprint tags, and the course and exam name you choose.
Course information you choose to add. Learning objectives, module names, minutes taught, and lecture or topic excerpts, used for alignment analysis. We store at most a text excerpt of uploaded content, never the whole file.
Integrity Screen data (opt-in only). If you add the Integrity Screen, your browser replaces every student identifier with a one-way hash and gives you a lookup key that stays on your computer. We receive the hashed per-student response pattern and, where your export includes it, timing data. We never receive names, IDs or emails.
Purchases. Processed by Stripe. We store the product, amount, date and Stripe reference; we never see or store card numbers.
Service logs. Standard server logs (time, status, error messages). Logs never contain item text or report text beyond a 40-character error excerpt.
3. How we use it
To produce your reports; to run the Leak Check (a distinctive fragment of each item is sent as a search query to our search provider — no student data is sent); to classify items and map objectives (item text is sent to our model provider, which does not use it for training); to send you account and report emails; to bill you; and to maintain the issued-item registry described in §6.
We do not use your data for advertising, and we do not share it with your institution or anyone else unless you ask us to or the law requires it.
4. FERPA
MapMyExam is designed so that no personally identifiable student education record reaches us: identifiers are removed or hashed in your browser. Where an institution engages us under a contract, we act as a "school official" with a legitimate educational interest, use the data only for the contracted purpose, and do not re-disclose it. If you believe a file you uploaded contains student identifiers, email hello@mapmyexam.com and we will delete it.
5. Retention
| Data | Kept for |
|---|
| Account information | Until you delete your account |
| Stripped exam files and item statistics | Until you delete the exam or your account |
| Delivered reports | Until you delete them; you can download them at any time |
| Integrity Screen response data | Deleted 30 days after the report is delivered; findings are kept with the report |
| Generated item text (Revision Packs, Previews) | Our copy is deleted 90 days after delivery |
| Issued-item registry (hashes and fingerprints, no text) | Indefinitely, so no item is ever issued twice |
| Purchase records | 7 years, as required for accounting |
Deleting your account removes your exams, reports, course data and response data. Purchase records and item hashes remain.
6. Your items and reports
Reports and generated items are prepared for your course only. We never reuse one customer’s items, reports or course data as examples for another. Generated items are checked against every item we have ever issued and regenerated if they match. Copyright and licensing are covered in the Terms of Service.
7. Who else touches the data
- Supabase — database, authentication and file storage (United States).
- Stripe — payments.
- Resend — transactional email.
- Anthropic — item classification and objective mapping; item text only; not used for training.
- A search provider (SerpAPI or equivalent) — Leak Check queries; item fragments only.
- Netlify — hosting.
Each is bound by its own terms and processes data only to provide its service to us. We do not use advertising or analytics trackers on upload, workspace or report pages.
8. Security
Data is encrypted in transit and at rest. Access is restricted by row-level security so one customer can never read another’s data. Analysis logic runs only on our servers. Secrets are never stored in the application code. We are a small company and do not hold a SOC 2 report; if your institution requires one, email us before purchasing.
9. Your rights
You can see, download, correct or delete your data from your account at any time, or by emailing hello@mapmyexam.com. Residents of states with privacy laws (including California, Texas and others) may exercise the rights those laws provide by the same email; we respond within 30 days and do not discriminate for exercising them. We do not sell personal information.
10. Children
MapMyExam is for educators and is not directed at anyone under 18. We do not knowingly collect information from minors; student data we receive is de-identified before it reaches us.
11. Changes
We will post changes here with a new effective date and, for material changes, email account holders.