Privacy Policy

• We collect what an exam needs: your name, your email, and your answers.
• Your writing is sent to OpenAI to be assessed automatically, and a Fennec360 reviewer may read it too.
• Paid proctored attempts take one photo of you at the start, after asking, and it stays private.
• We run no advertising. Google Analytics counts page visits so we can see which pages help people, and nothing we send it is used to target you with ads.
• Ask us and we will send you your data or delete it.
• News-and-tips email is opt-in, and every one carries a one-click unsubscribe.

Your account. First name, last name, and email address. If you sign up with a password, we store it hashed, which means we cannot read it and neither can anyone who steals the file. If you sign in with Google instead, Google tells us your name and email address and we never see a password at all.

The optional profile answers. Where you are from, your native language, and what brings you here. You can skip these, and you can change them later in your account.

Your exam work. Every answer you save, the essays you write, your section scores, your CEFR level, and the times you started and finished. Your answers are saved as you go so a lost connection does not cost you the exam.

Your certificates. If you earn one, we keep the certificate record: your name as printed, language, level, issue date, and status.

Payments. If you buy a certificate we store the order: amount, currency, method, status, and the payment provider's reference. We never see or store your card number.

Your feedback. If you answer our one-question email, we store the score you clicked, tied to your account.

Writing is assessed automatically. When you submit, the exam question and the text you wrote are sent to OpenAI, the company behind GPT, which returns a score and short feedback. Your name and your email are not sent with it. Your certificate is then issued off that score. That is the honest description of the arrangement, and we are not going to dress it up with promises about OpenAI's own retention that we have not confirmed.

A Fennec360 reviewer reads what you wrote when something holds your result back, when we sample an issued certificate as a check on ourselves, and any time you ask us to. You can ask at any point, for free, from your results page or your certificate page. Your level is never left to an automated score alone if you would rather a person decided it.

One practical consequence: do not put anything in a writing task you would not want a stranger to read. Our exam questions never require true personal details, and inventing an answer is explicitly allowed.

This applies only to paid certified attempts. Free exams have no camera, no photo, and no proctoring.

Before the exam starts, we ask for your camera and take one photo. You see it and confirm it before it is sent. It is stored privately, never published, and only staff reviewing your attempt can open it, through a link that expires within minutes. It exists for one reason: so a certificate cannot be earned by someone sitting the exam in your place. We do not run face recognition on it and we do not use it for anything else.

On the same attempts we log activity signals while the exam is open: leaving fullscreen, switching away from the tab, and paste attempts in a writing box. It is a plain event log, never scored and never an automatic verdict. A person reads it when your attempt is one we review.

Certificate verification pages are public. When one is opened we record which certificate was checked, when, which country the visit came from, the visitor's user-agent string, which is the line a browser sends naming itself, and the page they arrived from. Our staff can see all of it. This tells you your credential is being looked at, and helps us spot abuse.

To work out the country, the visitor's IP address is checked against a geolocation service. We keep only a masked address, never the full one, and the whole verification record, country, user-agent, referring page and masked address alike, is deleted after 90 days.

We set one cookie when you log in. It holds your session, it is httpOnly, meaning no JavaScript on the page can read it, and it lasts 14 days. Staff logins get an equivalent one. Without it you cannot stay logged in, so there is nothing to consent to and nothing to switch off.

Your browser also remembers your light or dark theme choice, and briefly remembers a pending order number while you are away at the payment page. Both stay on your device.

We use Google Analytics, which sets its own cookies, the ones whose names start with “_ga”. They give your browser a random ID so a second visit is not counted as a second person. What we look at is which pages people open, which steps of the exam they reach, which practice drills they open and whether an answer was right, and where they give up. We do not send your name, your email, anything you wrote in an exam, or the answers you type in practice, and we do not use any of it for advertising.

We run no advertising cookies and no ad-network pixels. The other monitoring tool on the site is error reporting (see the next section), which activates when something breaks.

We do not sell your data and we do not share it for advertising. We do use a small number of companies to run the service:

• OpenAI scores your writing, as described above.
• Google, only if you choose to sign in with Google.
• Google Analytics, which receives the pages you open, the funnel steps you reach, and whether a practice answer was right, so we can tell which parts of the site actually help. It never receives your name, your email, your exam work, or what you type in practice, and we do not run advertising on any of it.
• Our hosting and database providers, which is where the site runs and where your account, answers, and files are stored.
• Our email provider, which delivers account, results, and certificate emails.
• A geolocation service, to turn a visitor's IP address into a country on verification pages.
• An error-monitoring service (Sentry), which receives a technical report when something on the site breaks: what failed, on which page, and the browser type. It exists so we can fix problems, not to follow you around, and we do not send it your name, your email, or your writing.
• Our payment provider and its bank, if you buy a certificate.

We will also hand over data if the law genuinely requires it, and we will tell you unless we are forbidden from doing so.

Nothing about you is public by default. Taking a free exam publishes nothing anywhere.

A certificate is different: its verification page is public to anyone holding the link, the code, or the QR, and shows your name, language, level, issue date, and status. The certificate wall and your public profile page are both opt-in switches in your account, off until you turn them on, and reversible.

Account email is part of the product: results, certificates, password resets, and notices about your own certificates. It arrives for as long as you have an account.

News and tips are different: you only get them if you ticked the box asking for them, at sign-up or later from your account page. We record when you agreed, and not ticking it changes nothing about your exams.

Every news email carries a one-click unsubscribe that works without logging in. It stops the news; your results and certificate emails still arrive, because those are not marketing.

• Your account and exam history: while your account exists, so your levels and past results stay yours to look back at.
• Certificate records: kept as long as the certificate is verifiable, which is the whole point of a credential someone can check years later.
• Verification records: 90 days.
• Proctoring photos and event logs: kept with the attempt they belong to, and deleted when you ask us to delete your account.
• Feedback scores: kept with your account.

Ask us and we will tell you what we hold about you, correct anything wrong, or delete your account and its data. You can also withdraw from the parts that are optional: turn off your public profile, leave the wall, or simply stop taking exams.

Deleting your account does not automatically pull down a certificate that other people may be checking. Tell us what you want to happen to it, and read the Terms of Service for how revocation works.

When what we do changes, this page changes with it, along with the date at the top. If the change is significant, for instance a new company processing your work or a new kind of data, we will email you rather than quietly editing a paragraph.