Privacy Policy

1. Introduction

TunnelQuiz (referred to as "TunnelQuiz," "we," "us," or "our") is an online multiple-choice assessment platform. Employers and other organizations use TunnelQuiz to create tests, invite candidates, run those tests with AI-assisted proctoring, and review the results.

This Privacy Policy explains what personal information we collect when you use TunnelQuiz, why we collect it, how we protect it, how long we keep it, and what choices you have about it.

The policy applies to everyone who interacts with TunnelQuiz, organizations that buy and use the platform, the team members an organization invites, the candidates an organization tests, and visitors to our website.

By using TunnelQuiz, you agree to this Privacy Policy. If you do not agree, please do not use the platform.

2. Definitions

For clarity, some terms are used with a specific meaning throughout this document.

• "Platform" means the TunnelQuiz software, website, dashboards, APIs, and any related services we provide.
• "Organization" means the company or entity that has an account with TunnelQuiz and uses the Platform to create and run assessments.
• "Organization User" means an individual (for example, an administrator, recruiter, or HR team member) that an Organization invites into its TunnelQuiz account.
• "Candidate" means an individual who takes an assessment through TunnelQuiz, usually because an Organization invited them.
• "You" means the person we are addressing at any point, the Organization, the Organization User, the Candidate, or a website visitor, depending on context.
• "Personal Information" means any information that identifies a natural person, alone or when combined with other data. Local laws (like the GDPR or CCPA) may use similar terms such as "personal data" or "personal information."
• "Assessment Data" means the information generated when a Candidate takes an assessment, including questions shown, answers given, timing, scores, and proctoring signals.
• "Proctoring Data" means information collected during an assessment that helps TunnelQuiz and the Organization detect cheating or verify integrity. This can include browser signals (like tab switches), device information, and, only where enabled, webcam, microphone, or screen data.
• "Credit" means a unit of usage on the Platform. Organizations buy Credits and spend them when they invite Candidates or add features to an assessment. Credits are the Platform's pricing unit and are not currency.
• "Data Controller" and "Data Processor" carry the meanings given in the EU General Data Protection Regulation (GDPR). In most Candidate contexts, the Organization is the Data Controller and TunnelQuiz is the Data Processor.

3. Information We Collect

We collect information in the ways described below. We collect only what we need to operate the Platform and to help Organizations run fair, secure assessments.

3.1 Information Candidates Provide

When a Candidate accepts an invitation to take an assessment, we collect:

• Identity details, first and last name, email address, and (where required by the Organization) phone number, unique ID, or reference code.
• Verification data, the one-time password (OTP) sent to the Candidate's email or phone to confirm identity before the assessment starts.
• Optional details the Organization has asked the Candidate to provide before or during the assessment, for example, a graduation year, a location, or a reference batch.

A Candidate provides this information voluntarily by choosing to take the assessment.

3.2 Information Organizations Provide

When an Organization creates and manages an account with us, we collect:

• Company information, legal or trading name, address, industry, size.
• Account owner and team member information, full name, work email address, job title, phone number (optional), and role permissions inside the Platform.
• Login credentials, email and password (passwords are stored using industry-standard one-way hashing; we cannot read them).
• Custom branding, logo, brand color, and any welcome message that the Organization chooses to show Candidates on the assessment landing page.
• Billing and payment information, company name, billing address, tax ID (where applicable), and Credit purchase history. Card details are handled by our payment processor and are not stored on TunnelQuiz servers.

3.3 Assessment Data

We collect and store the data generated when a Candidate takes an assessment:

• The questions the Organization included in the assessment
• The answers the Candidate selected
• Time spent on each question and on the whole assessment
• Section scores and total scores
• Attempt history (invites sent, opened, started, submitted)
• Any notes or review actions taken by the Organization's team members

Assessment Data is created when a Candidate takes the assessment and belongs to the Organization that created the assessment. TunnelQuiz stores it on the Organization's behalf.

3.4 AI Proctoring Data

If the Organization has enabled any proctoring signals for an assessment, we collect information intended to detect possible cheating and to protect the integrity of the assessment. This may include:

• Tab-switching events (when the Candidate leaves the assessment window)
• Full-screen exit events
• Copy, paste, and clipboard events
• Detection of developer tools being opened
• Detection of multiple monitors connected
• Detection of screen-sharing applications running on the device
• Loss of window focus
• Right-click actions on the assessment page
• Failed identity checks (for example, an OTP entered incorrectly)

We collect each signal only if the Organization has enabled it for that assessment. Signals are labeled with the time they occurred and the session they belong to.

3.5 Browser & Device Information

Every device that connects to TunnelQuiz automatically shares some technical information with us so we can serve the correct experience and detect problems. This includes:

• Browser type and version
• Operating system and version
• Device type (desktop, tablet, phone)
• Screen resolution
• Language preference
• Anonymized usage events (for example, "the pricing page was opened")

We use this information for reliability, security, and to understand how the Platform is used.

3.6 Webcam, Microphone, and Screen Monitoring (Only When Enabled)

If the Organization has enabled any of these signals for an assessment, TunnelQuiz will collect the corresponding data:

• Webcam snapshots, periodic still images captured from the Candidate's webcam during the assessment.
• Screen captures, the Candidate is asked to share their screen with the browser, and TunnelQuiz takes periodic screenshots of what is shared.
• Microphone / ambient audio events, where enabled, the Platform records events such as loud noises detected during the assessment.

These signals are collected only when the Organization has explicitly enabled them for a specific assessment. Before the assessment starts, the Candidate is clearly told which signals will be active, and the Candidate must consent by choosing to proceed. If a Candidate does not consent, they can refuse to start the assessment and no such data is collected.

TunnelQuiz does not perform biometric facial recognition, does not track eye gaze, and does not create biometric identifiers of the Candidate.

3.7 IP Address and Location Data

We record the IP address a device connects from. From that IP address, we can approximate the general location (country, region, and sometimes city). We use this information for security, fraud prevention, and, where the Organization has enabled it, for basic geographic reporting of where Candidates took the assessment from.

We do not track precise GPS location, and we do not collect location data continuously.

3.8 Cookies and Tracking Technologies

Like most modern websites, TunnelQuiz uses cookies and similar technologies (local storage, session storage). We use them for:

• Essential functions, keeping you signed in, remembering your session, and running the assessment safely.
• Security, detecting suspicious sign-in attempts and preventing abuse.
• Analytics, understanding how the Platform is used, at an aggregated level, so we can improve it.

We do not sell your data to advertisers, and we do not use cookies to build cross-site advertising profiles. You can control cookies through your browser settings, but disabling essential cookies will prevent parts of the Platform from working.

4. How We Use Information

We use the information we collect for these purposes:

• To provide the Platform, to run the tests you create, deliver them to Candidates, score them, and show you the results.
• To verify identity, to make sure Candidates are who they say they are before they start an assessment.
• To protect the integrity of assessments, to detect and record signals that may indicate cheating.
• To communicate with you, service updates, security notifications, and (with your permission) news about the product.
• To support Organizations, to help teams manage their accounts, invite team members, and access support.
• To improve the Platform, to understand how features are used and to make them better.
• To handle billing, to bill Organizations for the Credits they purchase and to keep required financial records.
• To meet legal obligations, to comply with laws, respond to lawful requests, and protect our rights, users, and the public.

We do not use the information we collect to advertise other products to you, and we do not sell your Personal Information to any third party.

5. AI Processing and Automated Decision Support

TunnelQuiz uses automated systems and machine learning to help Organizations run assessments efficiently. Specifically:

• Automated scoring. Multiple-choice answers are scored automatically. Because MCQ scoring is deterministic (there is a right answer and a wrong answer), every score is auditable and explainable, anyone can see why a Candidate scored what they scored.
• Proctoring signal detection. The Platform detects the proctoring signals listed in Section 3.4 and 3.6 using rules that run in the browser and on our servers.
• Question insights. We generate aggregated analytics about how questions perform, for example, which distractors are most commonly chosen, or which questions take longest to answer. This helps Organizations improve their tests over time.

TunnelQuiz does not make final hiring decisions. The results and signals we surface are inputs. A human at the Organization always makes the decision to shortlist, reject, or hire a Candidate.

Under Article 22 of the GDPR, Candidates in the European Economic Area (EEA) and the United Kingdom have the right to not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on them. Because a human at the Organization is always responsible for hiring outcomes, TunnelQuiz does not make Article 22 decisions on its own. However, Candidates can contact the Organization that invited them (the Data Controller) to request human review of any decision that involved TunnelQuiz data.

6. Data Storage

Personal Information collected through TunnelQuiz is stored on servers operated by reputable cloud infrastructure providers. Storage locations are chosen based on the Organization's data residency selection, where available. Today, storage regions include India.

Data at rest is encrypted using AES-256 encryption. Data in transit between your device and our servers is encrypted using TLS 1.2 or higher.

We back up data on a regular schedule and keep backups in a separate physical location for disaster recovery. Backups are encrypted and access is limited to authorized personnel.

7. Data Retention

We keep different types of information for different periods, based on how they are used and what the law requires.

If an Organization asks TunnelQuiz to delete Candidate data earlier than these defaults (for example, in response to a Candidate's deletion request), we will do so, subject to Section 12 below.

After the retention period ends, Personal Information is either deleted or anonymized. Anonymized data (data that cannot identify any individual) may be retained indefinitely for analytics and product improvement.

8. Data Security

We protect Personal Information with a combination of technical and organizational measures:

• Encryption at rest, AES-256 for stored data
• Encryption in transit, TLS 1.2 or higher for all network traffic
• Role-based access control, every Organization User has a role (Admin, Editor, Recruiter, Viewer), and every action is checked against their role permissions at the API layer, not just in the interface
• Access limitation, TunnelQuiz staff only access Personal Information when it is necessary for support, security, or compliance
• Audit logging, every significant action is logged with the actor's identity and timestamp
• Vulnerability management, regular internal reviews and independent security testing
• Incident response, a documented plan to detect, contain, and investigate security incidents
• Secure development, code review, dependency scanning, and separation between staging and production environments

No system is perfectly secure. If we become aware of an incident that has materially affected your Personal Information, we will notify affected Organizations without undue delay and, where required by law, within 72 hours of becoming aware of the incident.

9. Third-Party Services

We use a small number of trusted third-party service providers to run the Platform. Every provider is bound by a written data-processing agreement and is only given the minimum data they need to perform their role.

Categories of providers include:

• Cloud infrastructure, servers, storage, and networking
• Email delivery, sending transactional emails such as OTPs and password resets
• SMS delivery, sending OTPs to phone numbers where the Organization has enabled SMS auth
• Payment processing, collecting payment for Credits (card data never touches our servers)
• Customer support tooling, managing tickets and conversations
• Analytics, measuring product usage in aggregate

A current list of our sub-processors is available on request. When we add or change a sub-processor, we will update that list.

We do not sell your Personal Information to any third party, and we do not share it with third parties for their own marketing purposes.

10. International Data Transfers

TunnelQuiz operates globally. Depending on where you and the Organization are located, your Personal Information may be transferred to, stored in, or processed in a country other than the one you are in.

Where Personal Information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized by the European Commission as offering an equivalent level of protection, we rely on approved safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Addendum, where the transfer originates in the UK
• Where required, additional technical and organizational measures such as encryption of the data being transferred

You can request a copy of the safeguards used for a specific transfer by contacting us at [email protected].

11. Children's Privacy

TunnelQuiz is not designed for use by children. We do not knowingly collect Personal Information from anyone under the age of 16, and Organizations should not invite Candidates under that age unless local law permits it and the appropriate consents are in place.

If we discover that we have collected Personal Information from a child under 16 without proper consent, we will delete it as soon as possible. If you believe we hold information about a child, please contact us at [email protected].

12. User Rights

You have rights over the Personal Information we hold about you. These rights depend on where you live. The most common rights are listed below.

12.1 Rights Under the GDPR (European Economic Area, UK, Switzerland)

You have the right to:

• Access, ask us for a copy of the Personal Information we hold about you
• Rectify, ask us to correct information that is wrong or incomplete
• Erase, ask us to delete your Personal Information (subject to legal exceptions)
• Restrict processing, ask us to limit how we use your information in certain cases
• Object, object to certain kinds of processing, including direct marketing
• Data portability, receive your information in a structured, machine-readable format
• Withdraw consent, where we rely on consent, you can withdraw it at any time
• Complain to a supervisory authority, you can lodge a complaint with your local data protection authority

For Candidate data, please note that in most cases the Organization that invited you is the Data Controller. You may need to contact the Organization directly to exercise some of these rights.

12.2 Rights Under the CCPA / CPRA (California)

If you are a California resident, you have the right to:

• Know what Personal Information we have collected about you and where we got it from
• Delete the Personal Information we have collected from you, subject to legal exceptions
• Correct inaccurate Personal Information
• Opt out of the sale or sharing of your Personal Information (TunnelQuiz does not sell your Personal Information)
• Limit the use of sensitive Personal Information
• Non-discrimination, we will not discriminate against you for exercising any of these rights

12.3 Rights Under the Digital Personal Data Protection Act, 2023 (India)

If you are located in India, you have the right to:

• Access the Personal Information we process about you
• Correct or update your Personal Information
• Erase your Personal Information, subject to legal exceptions
• Nominate another individual to exercise your rights in the event of death or incapacity
• Grievance redressal, raise a grievance with our Data Protection Officer and, if unresolved, the Data Protection Board of India

12.4 Data Deletion Requests

To request deletion of your Personal Information:

• Organization Users can delete their account from Settings, or contact the Organization Admin
• Candidates should contact the Organization that invited them. If the Organization is unresponsive, contact us at [email protected] and we will help mediate the request
• Anyone can email [email protected] to request deletion directly

We will respond to a valid deletion request within 30 days of receiving enough information to verify your identity. Some information (for example, financial records) may be retained where the law requires us to keep it.

13. Candidate Privacy

We take special care with Candidate Personal Information because Candidates typically do not have a direct commercial relationship with TunnelQuiz, the Organization does.

• Before an assessment starts, Candidates are told what will be collected during that assessment, including any proctoring signals the Organization has enabled.
• Candidates must consent by choosing to proceed. They can refuse and no assessment data will be collected.
• Candidates can request access to their assessment data, request corrections, or request deletion, through the Organization first, and through us if needed.
• Candidates are not shown other Candidates' data.
• If an Organization deletes its account, TunnelQuiz retains only the anonymized aggregate metrics needed for our own service; identifiable Candidate data is deleted within 30 days.

14. Organization Responsibilities

Organizations that use TunnelQuiz have responsibilities under this policy and under applicable law.

Each Organization is responsible for:

• Obtaining any consents required by local law to invite specific Candidates and to collect the assessment and proctoring signals they enable
• Providing Candidates with accurate information about how their data will be used
• Configuring the proctoring signals only to the level needed for the role being tested
• Managing Organization User access, inviting, removing, and setting the correct role for each team member
• Responding to Candidate requests to exercise their rights (access, correction, deletion, and so on)
• Ensuring the questions and content uploaded to TunnelQuiz do not violate any third party's intellectual property or privacy rights

Where TunnelQuiz acts as a Data Processor for an Organization's Candidate data, the terms of our Data Processing Agreement (DPA) apply. Organizations can request a signed DPA at [email protected].

15. Security Practices

We describe our security measures in Section 8 above. A summary of our security practices, including the certifications we hold and the audits we complete, is available on request. We update that summary when our practices change.

If you discover a security vulnerability in TunnelQuiz, please report it responsibly by emailing [email protected]. We will acknowledge your report within 5 business days.

16. Limitation of Liability

To the extent permitted by applicable law:

• TunnelQuiz is not responsible for events outside our reasonable control, such as network failures on the Candidate's side, third-party services we do not operate, or misuse of an Organization's account by an authorized user.
• TunnelQuiz's total liability arising from this Privacy Policy is limited as set out in our Terms of Service, which govern the commercial relationship between us.

Nothing in this Privacy Policy limits liability that cannot be limited under applicable law (for example, liability for fraud or for the rights that data protection laws grant to individuals).

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example, when we add features, when the law changes, or when we improve how we protect information.

If the change is material, we will notify Organizations by email and post a prominent notice on the Platform at least 14 days before the change takes effect. Continued use of the Platform after the effective date means you accept the updated policy.

Every version of this policy is dated. Previous versions are available on request at [email protected].

18. Contact Information

If you have any questions about this Privacy Policy or want to exercise your rights, please contact us:

• Email (general privacy): [email protected]
• Email (security reports): [email protected]
• Email (Data Processing Agreements): [email protected]
• Data Protection Officer: [email protected]
• Company: TunnelQuiz
• Registered address: Surat, Gujarat, India
• Grievance Officer (India): [email protected]

For candidates who took an assessment through TunnelQuiz: please contact the Organization that invited you first. If you cannot get a response from the Organization, contact us and we will help.

This document is Version 1.0, dated 14 July 2026. It replaces any previous privacy notice.