Privacy Policy

1. Overview

This Privacy Notice for NextSolves (“Company,” “we,” “us,” or “our”) describes how and why we might collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you access the Practical Workflow System (PWS) website or related software products.

2. What Information Do We Collect?

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

• Personal Information Provided by You: Names, phone numbers, email addresses, job titles/designations, college/institution names, and passwords for authenticated access.
• Student & Examination Data: Student roster identifiers, enrolled practical subjects, examination submissions (code scripts, MCQ responses), and grading records uploaded by designated college faculty.
• Log & Heartbeat Telemetry: Device metadata, IP addresses, browser types, session timestamps, and server-enforced monotonic heartbeat activity during active examination sessions.

3. How Do We Process Your Information?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation, authentication, and Role-Based Access Control (RBAC).
• To deliver, administer, and maintain the digital practical and internal examination lifecycle.
• To safeguard examination integrity through Safe Exam Browser enforcement and tab-switch anomaly detection.
• To generate and provide authorized administrators and faculty with instant scorecards and attendance records.

4. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These include multi-tenant database isolation, scoped Firestore security rules, Firebase ID token verification, path traversal prevention, CORS restrictions, rate-limiting on sensitive endpoints, and tamper-proof server-side audit logs.

5. Data Retention

We will only keep your personal information for as long as it is necessary for the academic and legal purposes set out in this notice, unless a longer retention period is required or permitted by law. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information.

6. Your Privacy Rights

Depending on your jurisdiction, you may have the right to request access to the personal information we collect from you, review or correct inaccuracies, withdraw consent, or request deletion. You may exercise these rights at any time by contacting our Data Protection Officer.