Privacy Notice

This notice explains what personal data GyaniX (operated by Xelium Labs Private Limited) collects, why, and the choices you have. We collect only what we need to provide assessments and capability intelligence.

What we collect

• Account: name, email address, password (stored only as a secure hash by our authentication provider), and your GyaniX ID.
• Profile: the information you choose to give — your journey stage, location (state and optionally city), education, work history, goals and interests.
• Assessments: your answers, timings, scores and the skill evidence derived from them. When you start an assessment we keep a copy of your profile context at that moment, so the result always reflects who you were when you took it.
• Proctoring: with your consent for each proctored assessment — camera snapshots when specific events occur, face-presence signals computed in your browser, and events such as leaving the assessment window. We do not record continuous video or audio.
• Payments: order details and payment references from our payment partner. We never receive your full card or bank details.
• Service records: what you do in the service itself — signing up, starting and finishing assessments, purchases, refunds and credits, and opening your own report — plus security records (see “Analytics, cookies and your choices”).
• Visitor analytics, only if you allow it: which kinds of pages you open, the website that sent you and campaign tags in the link (see “Analytics, cookies and your choices”).

How we use it

• To run assessments, score them, keep them fair and produce your reports and capability profile.
• To build benchmarks from integrity-eligible results. Benchmarks are shown only as aggregates, and only when enough people are in a group; individual results are never shown to other individuals.
• To send you service emails (verification, receipts, assessment and report notifications).

Who can see your data

• You can see your own profile, results, reports and capability profile.
• An organisation that invites you to its assessment sees the results of that assessment. Assessments you take on your own are not visible to any organisation unless you choose to share them.
• Authorised GyaniX staff access data only to operate and secure the service. Our service providers (hosting, authentication, email, payments) process data on our behalf.
• Analytics records can be read only by GyaniX’s platform administrators. Organisations cannot see them.

Analytics, cookies and your choices

GyaniX measures how the service is used in two ways. One is optional and needs your permission. The other is part of running the service.

1. Visitor analytics (optional, off until you allow it). When you first visit, we ask whether we may count how visitors use the site. The buttons “Allow analytics” and “Decline” are equal, and the site works the same either way. If you allow it, we record:

• the kind of page you opened (for example “an assessment page” or “the pricing page”) — numbers, codes and other identifiers in the address are removed, and the rest of the address after “?” is not kept;
• for the first page of a visit: the name of the website that sent you (for example a search engine, never the full address of the page you came from) and the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), with anything that looks like an e-mail address or a phone or account number removed;
• the date and time; and, if you are signed in, your account, so we can understand how people use GyaniX;
• if you create an account during a visit you allowed us to count, where that visit came from (the website or campaign), kept with your account.

Pages you open on the same day are grouped by a code made from your network address and browser details mixed with a random value that is replaced every day and deleted after two days. Your network address and browser details are not stored, and once that day’s random value is deleted the code cannot be traced back to you or your device. We use no analytics cookie, no advertising cookie and no outside analytics or advertising company, and we do not sell analytics or use it to make decisions about you.

We use visitor analytics to see which pages, websites and campaigns help people find GyaniX, and how many visitors start and finish assessments. We may share totals that identify nobody (for example “visits per month”) with Xelium Labs’ management, advisers or prospective investors. We do not share visitor analytics about you with anyone.

If you decline, do not choose, or your browser sends a “Global Privacy Control” or “Do Not Track” signal, none of this is recorded. We then only add your page to a daily count of pages served, which says nothing about who opened it. The same daily count records how many people pressed “Allow analytics” or “Decline”.

2. Service records (part of the service, not optional). The records listed under “Service records” above are needed to provide the service, keep your account and payments correct and handle refunds, appeals and support. We also use them, with test and staff accounts left out, to produce totals about how GyaniX is doing (for example completed assessments or revenue). To protect the service we use your network address briefly, for example to limit repeated sign-in attempts; where anything derived from it is kept, it is only a one-way hash. When abuse protection is switched on, sign-in and sign-up forms use Cloudflare Turnstile, which checks that a person is filling them in.

Cookies and storage on your device. GyaniX uses only:

• sign-in cookies, to keep you signed in (necessary);
• gx_locale and gx_locale_suggested, to remember the interface language you chose and that we already suggested one (necessary for your choice to stick). We use your browser’s language and, where our hosting provides it, your country only to suggest a language; neither is stored;
• gx_analytics, to remember your analytics choice (“granted” or “denied”) for 180 days. It contains nothing else;
• during an assessment, your chosen text size and, if your connection drops, your unsent answers, stored in your browser until they are sent.

How long. Page-level visitor analytics is deleted after 400 days. The source of a sign-up is kept with the account. The daily counts identify nobody and are kept. Service records are kept as described under “Retention and your rights”.

Changing your mind. Use “Privacy choices” at the bottom of any page, or here: Privacy choices. A new choice applies from then on. If you are signed in when you press “Decline”, the visitor analytics already linked to your account is deleted as well. Your choice is remembered in this browser only (on gyanix.io and app.gyanix.io), so on another browser or device you will be asked again. For anything else about analytics, contact us (below).

Children

Self-service accounts are for adults. We do not sell assessments to people under 18 until a parent or guardian consent process is in place, and we ask school students only the minimum needed.

Retention and your rights

We keep assessment records while your account is active and as needed for integrity and legal obligations. You can ask to access, correct or delete your personal data, or withdraw consent, by contacting us. Some records (for example, completed payment records) must be kept for legal reasons.

Security

Data is encrypted in transit, access is restricted by role and organisation at the database level, and sensitive actions are logged in an audit trail that cannot be altered.

Contact

For privacy questions or requests, e-mail Xelium Labs Private Limited at info@xeliumlabs.com.