International Privacy Notice

1 Who we are

TestDoodle is operated by Mbali Expeditions trading as TestDoodle Pty (Ltd), registration number [registration number to be confirmed], at [registered address to be confirmed]. In this notice, "we", "us" and "our" refer to that entity. Contact mbaliexpeditions@gmail.com for privacy matters or mbaliexpeditions@gmail.com for service support. Effective date: 6 November 2026.

2 When this notice applies

This notice covers our website, launch enquiries, accounts, assessments, submissions, reports and support. It explains how we handle personal information and how you can exercise relevant rights. Your institution may provide an additional notice explaining its educational decisions and retention requirements.

3 Our role and your institution's role

For account administration, customer communications, billing and our own service-security purposes, we determine the relevant purposes and means of processing and act as controller or the equivalent under applicable law. When an institution uses the platform to administer education records, it normally determines those educational purposes and we process the information on its documented instructions. The institution decides who may access its records, how assessments are used and the applicable educational retention schedule.

Where a lecturer / teacher operates independently, the responsible controller and any institutional authority must be identified during setup. Contact us if you are unsure where to direct a request.

4 Information we handle

• Account and contact information: name, email address, institution, role, approved identifiers, authentication records and account settings. When you choose Google sign-in, we receive the authorised identity information; we do not receive your Google password.
• Education records: class membership, assessments, answers, uploaded files, marking feedback, released grades, authorised report references and relevant review/appeal records.
• Assessment activity: the specific events enabled for your assessment, such as start/submission times, page visibility changes, attempted paste events, timer events and authorised grade-change history.
• Technical and service records: IP address, device/browser information, security events, essential cookie identifiers, support correspondence and necessary payment/order references. Payment-card details are handled by the named payment provider when payment is enabled.
• Optional information: waitlist details, feature suggestions and separately authorised marketing or analytics information. Do not include unnecessary sensitive information in free-text fields or uploads.

5 Where information comes from

Information comes from you, your institution or authorised lecturer / teacher, your interactions with the service, and the providers identified in the processing schedule below. An institution may supply your class membership, identifier and educational records. Enabled integrity providers return report information for submitted work.

6 Purposes and legal grounds

We use personal information only for the purposes described below and in the processing schedule. Where a legal-basis framework applies, we identify the appropriate basis for each activity rather than relying on blanket consent.

Necessary account or assessment information may be required to provide the requested service or comply with institutional rules. Optional fields are marked optional. If you cannot use the ordinary process, contact your institution for an appropriate alternative.

7 Assessment monitoring and AI

Before an assessment begins, we show which activity events are recorded and which integrity checks are enabled. This release does not use webcam, microphone, biometric or emotion-recognition monitoring, record other websites, or capture your clipboard contents. Page/paste events are contextual records, not proof of misconduct.

Where enabled and disclosed, an approved provider may analyse submitted work for similarity or possible AI-generated writing. Such indicators can be wrong and do not independently determine misconduct or a final grade. An authorised lecturer / teacher reviews relevant evidence and applies the institution's policies. You may contact the institution to request explanation, correction or review. We do not use student submissions or identifiable education records to train general-purpose AI models or for advertising.

8 Recipients

Information is available to authorised institutional staff and to the relevant student according to permitted release settings. We use the providers listed in the processing schedule for functions such as hosting, authentication, transactional email, payments and enabled integrity checks. We limit access to what is needed and use appropriate contracts. We may disclose information when legally required, to protect legal rights, or in a lawful business transfer subject to appropriate protections and notice. We do not sell personal information or share it for cross-context behavioural advertising.

9 Turnitin and international processing

Turnitin similarity and AI-writing checking is not enabled in this release. If your institution enables it later, a pre-submission notice will identify the work and metadata sent, the checks requested, report visibility and repository setting, and any required Turnitin user terms will be presented separately.

We and our providers may process information outside your country. Where required, we use a recognised adequacy mechanism or appropriate contractual safeguards. Contact mbaliexpeditions@gmail.com for information or a copy of relevant safeguards, subject to lawful redactions.

10 How long we keep information

We retain information only for a documented purpose and the period in our processing schedule. Institutions may require a different lawful education-record period, disclosed before processing. The following service defaults apply unless that schedule states a justified alternative.

11 Your choices and rights

Depending on applicable law, you may request access, a copy, correction, deletion, restriction or portability of your information, object to certain processing, or withdraw consent for an activity that relies on consent. Withdrawal does not affect earlier lawful processing. Some education records or records required by law cannot be deleted immediately; we explain any applicable limit.

Contact mbaliexpeditions@gmail.com. We verify identity proportionately, avoid unnecessary identity-document collection and respond within applicable legal time limits. For institution-controlled records, we forward the request promptly to the institution and assist it. You may complain to the competent privacy authority in your jurisdiction without first contacting us.

12 Children and institutional accounts

Students below the applicable age for independent consent or contracting use the service only through an authorised institutional or guardian-supported arrangement that satisfies local law. We do not use children's education data for unrelated commercial purposes. Parents or guardians may contact the institution or mbaliexpeditions@gmail.com about access, correction, deletion or concerns, subject to the rights of the student and applicable law.

13 Cookies and similar technologies

Essential technologies support sign-in, security and requested service functions; they are listed in our Cookie Notice. This release uses no nonessential analytics, advertising or optional tracking technologies, so no optional consent is required. We do not use behavioural-advertising trackers.

14 Security and incidents

We use access restrictions, encryption, logging, secure development and recovery controls appropriate to the information and risks. No system can guarantee absolute security. If a personal-data incident occurs, we investigate, take appropriate action and notify the institution, affected individuals or authorities where required by law or contract. Please report suspected security issues to mbaliexpeditions@gmail.com.

15 Changes and contact

We publish the current version and effective date of this notice and notify you of material changes through an appropriate channel. Where a new use requires consent or other authorisation, we obtain it before starting that use. For privacy questions, contact mbaliexpeditions@gmail.com or write to [registered address to be confirmed].

Processing schedule

Processing locations and transfer safeguards for each provider are confirmed with the operator before launch and added to this schedule.