Privacy policy

Last updated 20 September 2026

1. Introduction and scope

This privacy policy explains how MeritCount collects, uses, stores, shares and protects personal data, and the rights you have over it. It covers:

• the marketing website at meritcount.com;
• the application at exams.meritcount.com (the "app"), including sign-in, the paper builder, quizzes, exams, the live room, marking, results, the student roster and the library;
• email we send you, and support conversations with us.

It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, and India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it. Where those laws use different words for the same idea, we say both. Where a local law gives you more protection than this policy, the law wins.

2. Definitions

3. Who we are and how to reach us

MeritCount is operated by MeritCount Pvt Ltd, Bin Ali Complex, Floor 4, Baramulla, Kashmir, India ("MeritCount", "we", "us").

• Privacy and data requests: hello@meritcount.com, subject line "Privacy".
• Grievance Officer (DPDP Act): Mr Taha Maknoo, reachable at the same address. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
• Data Protection Officer: we are not currently required to appoint one. The Grievance Officer performs the role. If we are required to, we will name them here.
• EU and UK representative: if we begin offering the service to schools in the EU or UK on a regular basis, we will appoint a representative under GDPR Article 27 and UK GDPR Article 27 and name them here.

4. Who is responsible for what

Responsibility depends on whose data it is and who decided to collect it.

Where a teacher or school is the controller, they decide why student data is collected, must tell students and parents that MeritCount is used, and must obtain any consent their law requires (see section 8). We process the data only on their instructions, as set out in section 20, and never for our own purposes beyond running and securing the service.

Where the same student is added by several teachers at the same school, the school is the controller for all of it. Where the school is not on a sign-up code, each teacher is the controller for their own papers and roster.

5. What we collect, from whom, and why

5.1 Teachers

5.2 Students

5.3 Everyone (technical data)

5.4 What we deliberately do not collect

• No biometric data. We do not run face recognition, eye tracking, emotion detection or keystroke analysis.
• No recordings of camera, microphone or screen.
• No location beyond what an IP address implies.
• No data from other apps, files or browser tabs on a student’s device.
• No advertising identifiers, and no tracking across other websites.

6. Camera, microphone and screen: how exam checks work

A teacher can turn on up to five checks for a paper. Each one is optional, and a quiz normally has none.

• Camera and microphone. Before the paper opens, the browser asks the student to allow each one. If the student does not allow a check the paper asked for, the paper does not open. During the paper, the teacher can press Watch the room, which shows each student’s camera live; clicking a student lets the teacher hear them and see their screen. This is a direct, live connection between the student’s browser and the teacher’s browser. Nothing is recorded, stored or kept, by MeritCount, by the teacher’s browser or anywhere else. When the paper ends or the student hands in, the browser releases the camera and microphone.
• Screen sharing. Works the same way: live, direct, not recorded. The student chooses what to share; the paper requires the entire screen.
• Full screen. The paper fills the screen. Leaving full screen is flagged with the time.
• Block copy and paste. Copy-paste inside the paper is disabled; attempts are flagged.

Flags are the only thing kept from a check: a short record of the event and its time. The student is told when a flag happens. A teacher can set a number of warnings after which the paper is handed in automatically; the student is told this before starting.

Watching is something the teacher switches on for a paper that asked for it, not something that happens because a page is open. Students cannot be watched outside a paper, and cannot be watched on a paper that did not ask for the camera or screen.

Because some school networks block the direct browser-to-browser connection, watching may not work on every network. It falls back to nothing: no relay server sees the picture.

7. AI features

Teachers can ask the AI to draft questions, and can accept an AI-suggested mark for a written answer. When they do, the following is sent to our AI provider for the duration of the request:

• the teacher’s instructions and settings;
• the files the teacher selected from their library, or the transcript they pasted;
• for marking suggestions, the question, the rubric and the student’s written answer, without the student’s name.

Our AI provider is contractually prohibited from using this content to train its models and from retaining it beyond what is needed to return a response. No student roster data, results, flags or account data are ever sent to the AI provider. Nothing the AI writes reaches a student unless a teacher chooses to keep it, and no AI suggestion is saved as a mark until the teacher clicks.

8. Consent: students, parents and teachers

8.1 What the law requires

• India (DPDP Act): processing a child’s personal data requires verifiable consent from a parent or lawful guardian, and a Data Fiduciary must not undertake tracking, behavioural monitoring or targeted advertising directed at children. The rules under the Act allow educational institutions to process children’s data for educational activities, including safety and monitoring in the child’s interest, within limits.
• EU and UK (GDPR): where consent is the legal basis for an online service offered directly to a child, it must come from a parent or guardian for children under the applicable age. Schools usually rely on their public task or legitimate interests rather than consent, and must still inform students and parents.

8.2 How this works in MeritCount

• The school or teacher is responsible for consent and notice for the students they add, because they decide to use MeritCount and for what. We provide template notices and a parent information sheet on request, and our terms require teachers to obtain any consent that applies to them before adding a student or running a paper with checks.
• Students are told, every time, before a paper with checks opens. The screen names each check the paper asks for, in plain words ("Camera: your teacher can see it while you write"), states that nothing is recorded, and states the warning rules. The student allows each check individually. Sitting the paper is not possible without allowing the checks it asks for.
• Withdrawing: a student can stop sharing camera, microphone or screen at any time from the browser. The paper treats this as a flag, and the teacher decides what to do; MeritCount itself never penalises a student for withdrawing.
• Teachers consent to this policy and the terms when they create an account, and can withdraw by closing it.
• Code-only quizzes create no account and collect only the name typed and the answers given. Teachers should not use the code-only route for anything a parent would expect to be told about.

8.3 What consent does not cover

Consent is never used as an excuse to do more than this policy says. We do not use student data for advertising, product research beyond aggregate statistics, or anything unrelated to the paper the student sat, regardless of what consent was given.

9. Legal bases (GDPR Articles 6 and 9; DPDP Act sections 4 to 7)

We never send marketing to students.

10. How we use data, and what we never do

We use personal data to:

• run papers: show questions, save answers, mark, release results;
• let teachers manage classes and see who needs a look;
• show the live room and flags to the teacher during a paper;
• sign people in and keep accounts secure;
• send service emails (invitations, password links, results-released notices, receipts);
• answer support requests;
• bill Pro and school plans;
• keep the service working, find and fix bugs, and prevent abuse;
• understand usage in aggregate (how many papers were run this month), never per student.

We never:

• sell, rent or trade personal data;
• show advertising, or share data with advertisers or data brokers;
• build profiles of students, rank students across schools, or use student data to train AI models;
• make automated decisions with legal or similarly significant effect about anyone (GDPR Article 22). Automatic marking of tick and short-answer questions applies the teacher’s own answer key; the teacher can override any mark; written answers are marked by a person;
• use camera, microphone or screen data for anything other than showing it live to the teacher during that paper;
• contact students for any purpose other than the papers their teacher set.

11. Who we share data with

We share personal data only with the people and providers below.

11.1 People

• Teachers see the roster, answers, marks and flags for their own papers and students.
• Schools on a sign-up code can see the same across their teachers, through whoever administers the code.
• Students see their own answers, hand-in time, and, once released, their own marks.
• Other students see, on a quiz with a scoreboard turned on, the names and scores on that scoreboard, and anything posted in the room chat.
• MeritCount staff access data only to provide support, investigate abuse or fix a fault, and only as far as needed. Access is logged.

11.2 Service providers (sub-processors)

Each provider is bound by a contract that limits them to processing on our instructions, requires appropriate security, and prohibits use of the data for their own purposes. We will update this table before adding a provider that processes student data, and schools on a sign-up code may ask to be notified of changes.

11.3 Legal requirements

We disclose data where the law requires it: a valid order from a court or authority with jurisdiction. We check every request, disclose only what is required, and tell the affected teacher or school unless the law prohibits it.

11.4 Business changes

If MeritCount is acquired or merges, personal data may transfer to the new owner under this policy. We will tell account holders by email before that happens and give teachers time to export or delete their data.

12. Where data is stored and international transfers

Our providers store data in the regions shown in section 11.2. For teachers and students in India, this means some data is stored outside India, which the DPDP Act permits unless the government restricts a particular country. For teachers and students in the EU or UK, any transfer outside the EEA or UK is covered by the European Commission’s Standard Contractual Clauses (or the UK International Data Transfer Addendum), or by an adequacy decision where one exists, together with the security measures in section 14. Copies of the relevant clauses are available on request.

Live camera, microphone and screen streams travel directly between the student’s and teacher’s browsers and are not stored anywhere.

13. How long we keep data

Where the DPDP Act requires it, we will notify the teacher or school before erasing data they might need and give a reasonable period to export it.

14. Security

• All traffic is encrypted in transit (TLS). Data is encrypted at rest with our providers.
• Passwords are hashed with a modern algorithm; we cannot read them and never send them by email.
• Access to production data is limited to named staff, uses multi-factor authentication, and is logged.
• Teachers can only see their own papers and students; schools can only see their own teachers. This is enforced in the database, not only in the interface.
• Camera, microphone and screen streams are peer-to-peer and never touch our servers.
• Files in a teacher’s library are private to that teacher and are served only through authenticated links.
• We keep dependencies up to date and review changes to anything that touches personal data.

Breach notification

If we become aware of a personal data breach, we will notify affected teachers and schools without undue delay, and the Data Protection Board of India and, where the GDPR applies, the competent supervisory authority within 72 hours where the law requires, with what happened, what data was involved, what we have done, and what you should do.

15. Your rights and how to use them

15.1 Rights under the GDPR and UK GDPR

• Access (Art. 15): a copy of your personal data and information about how we use it.
• Rectification (Art. 16): correction of inaccurate data.
• Erasure (Art. 17): deletion, where there is no overriding reason to keep it.
• Restriction (Art. 18): pausing processing while a dispute is resolved.
• Portability (Art. 20): your data in a machine-readable format. Teachers can download any paper as Excel and any student’s paper as a PDF at any time.
• Objection (Art. 21): to processing based on legitimate interests, and to any direct marketing.
• Not to be subject to automated decisions (Art. 22): see section 10; we make none.
• Withdraw consent at any time where consent is the basis, without affecting earlier processing.
• Complain to a supervisory authority: in the EU, the authority of your country; in the UK, the Information Commissioner’s Office.

15.2 Rights under the DPDP Act

• Access (s. 11): a summary of your personal data, the processing activities, and the identities of Data Fiduciaries and Processors it has been shared with.
• Correction, completion, updating and erasure (s. 12).
• Grievance redressal (s. 13): through the Grievance Officer in section 3, and then the Data Protection Board of India.
• Nominate (s. 14) another person to exercise your rights if you are unable to.
• Withdraw consent (s. 6(4)) as easily as it was given.

15.3 How to make a request

Students and parents: ask the teacher or school first, since they control the data and can act immediately in the app. You can also write to us directly. Teachers: most of this is available in the app (edit or remove a student, delete a paper, download data, close your account); for anything else, write to us.

Email hello@meritcount.com with "Privacy" in the subject, the name of the school and teacher if you are a student or parent, and what you would like done. We may ask you to confirm your identity so we do not release data to the wrong person. We respond within 30 days, or sooner where the law requires; if a request is complex we will tell you why and when to expect an answer. Requests are free unless they are clearly repetitive or excessive.

16. Children and students: extra protections

Most students using MeritCount are under 18. Beyond everything above:

• Students never sign up for MeritCount on their own. A student account exists only because a teacher created it or invited it.
• We do not track students across websites, do not build behavioural profiles, and do not show or target advertising. This applies to every student regardless of age.
• Camera, microphone and screen are never recorded, and are only ever shown to the student’s own teacher, live, during a paper the student agreed to.
• Scoreboards on quizzes show names and scores to classmates; a teacher can turn the scoreboard off in the paper’s settings for any class where that is inappropriate.
• The room chat during a paper is visible to everyone sitting it and to the teacher. Teachers can turn student chat off.
• We respond to a parent’s or guardian’s request about their child’s data with the same speed and care as a request from the student, after checking with the school where needed.
• If we learn that data about a child was collected without the consent or notice the law requires, we will delete it and tell the school.

17. Cookies, local storage and the consent banner

17.1 meritcount.com (this website)

That is all. The website sets no advertising or third-party cookies, and loads no scripts from advertising networks. The banner you see at the bottom of every page until you make a choice records whether you accept optional analytics. We do not currently run any analytics; if we add a privacy-respecting analytics tool, it will run only for visitors who chose Accept all, and this table will list it. You can reopen the banner at any time from Cookie settings in the footer.

17.2 exams.meritcount.com (the app)

These are strictly necessary to run the service and do not require consent under the ePrivacy rules. The app sets no analytics or advertising cookies.

18. Marketing website, contact form and email

• The contact form on meritcount.com is handled by Netlify. What you type (name, email, role, organisation, topic, message) is stored in our Netlify account and emailed to us. We keep it for 2 years or until you ask us to delete it.
• Service emails from the app are sent to the address on the account. Students only receive emails their teacher triggers (an invitation, a password link, a results notice).
• We do not currently send marketing emails. If we start, they will go only to teachers who opted in, with an unsubscribe link in every email, and never to students.

19. Links to other services

Signing in with Google takes you to Google, under Google’s privacy policy. Teachers may share a paper’s link through WhatsApp, Google Classroom or email; those services handle the link under their own policies. YouTube transcripts pasted into the AI feature are handled as described in section 7. We are not responsible for the privacy practices of services we do not operate.

20. For schools: our commitments as your processor

Where a school or teacher is the controller, MeritCount commits, as required by GDPR Article 28 and the DPDP Act, to:

• process student data only on your documented instructions, which are: to run the papers you create, for the students you add, with the settings you choose;
• ensure staff with access are bound by confidentiality;
• apply the security measures in section 14;
• use only the sub-processors listed in section 11.2, tell you before changes, and give you the chance to object;
• help you respond to student and parent requests, and to any data protection impact assessment you carry out for proctored exams;
• delete or return student data at the end of the service, at your choice, subject to legal retention;
• make available the information needed to show compliance, and allow audits on reasonable notice;
• notify you of a personal data breach without undue delay.

A signed data processing agreement containing these terms is available on request for any school. Because proctored exams involve monitoring of children, we recommend every school carry out a short data protection impact assessment before its first exam with checks turned on; we can supply a template.

21. Changes to this policy

We may update this policy as the product or the law changes. The date at the top always shows the current version. For material changes, we email account holders at least 14 days before the change takes effect, and schools on a sign-up code receive the notice through their administrator. Earlier versions are available on request.

22. Contact

hello@meritcount.com · MeritCount Pvt Ltd, Bin Ali Complex, Floor 4, Baramulla, Kashmir, India · Grievance Officer: Mr Taha Maknoo