Privacy Notice

About this notice

What this notice covers

This notice covers this website and the Verexa assessment platform (the Verexa web application and the Verexa Secure Browser). It does not describe how Seviact handles information; see the Seviact section below.

Institutions and their own notices

Verexa is used by institutions and lecturers to deliver assessments to their own students and candidates. The institution decides which assessments are run, which optional integrity features are enabled for each assessment, and how long its records are kept, and it has its own privacy obligations and notices to its students. This notice describes what Verexa itself collects and does. A notice specific to an exam is shown to students before they begin it.

Our approach

We aim to handle personal information in line with privacy-by-design practice and, where they apply to us, Australian privacy law and the Australian Privacy Principles. This is a statement of intent about how we work, not a claim of certification, of any particular regulatory status or of any legal obligation that has not been confirmed.

Purpose of website enquiry data

Information you choose to send us by emailing a contact, pilot or support address on this website is used to respond to and manage your enquiry, and for related commercial discussion. It is not used for marketing campaigns, and emailing us does not subscribe you to anything.

Changes to this notice

We may update this notice. The effective date above shows when the current version took effect. Where a change is material we will say so on this page.

Verexa

Verexa is an assessment platform used by institutions and lecturers to deliver assessments to students and candidates, and to support human-led review of those assessments. What is collected depends on how the institution configures each assessment. This section describes the categories of information Verexa handles.

Account information

For staff (lecturers and administrators) and students: name, email address, role, the institution or workspace the account belongs to, and a password stored only as a protected one-way hash, never in readable form. Accounts may also carry identifiers supplied by the institution or its learning-management system, such as a student number or a learning-management-system user identifier.

Assessments, answers and results

Questions, answers (including autosaved drafts), marks, feedback and comments, timing for each attempt, and, for assessments that use them, accommodations such as extra time. Marks can be returned to a connected learning-management system (for example Canvas) where the institution has set that up.

Integrity and session events

During an attempt Verexa records events that support review by authorised staff, such as the browser window losing focus, leaving full-screen, copying or pasting, interruptions to a connection or device, and whether the Verexa Secure Browser was used. These are review signals only. Verexa does not decide that anyone has cheated: the institution's authorised reviewers make that decision.

Device and network information

Browser and operating-system type, device and installation identifiers for the Verexa Secure Browser, and an IP address (which may be kept in raw or hashed form) with, where enabled, approximate location, used to review whether a session stayed continuous.

Optional camera and screen features

An institution can switch on, for a particular assessment, optional features that use the student's camera or screen. They are off unless enabled for that assessment, and students are shown a notice describing what is collected before they begin. Depending on the settings:

• Camera: checks run on the student's own device look for conditions such as the camera being blocked or too dark, and whether a person, a second person or a possible phone is visible. These checks produce event records (not images). Only if the institution has separately enabled evidence capture for the assessment, and the on-device check flags a possible phone or additional person, a single low-resolution still image can be captured and stored for authorised reviewers.
• Screen: where an assessment requires the student to share their whole screen, Verexa records when sharing starts, stops or is interrupted. Only if the institution has separately enabled screen evidence, low-resolution still images of the shared screen are captured at set intervals (no more often than every 30 seconds) up to a per-attempt limit, and around interruptions, and stored for authorised reviewers. A still image of a shared screen can show whatever was visible on it at that moment.
• Student verification: where enabled, the student's confirmation is recorded as an event; no image is stored for it.

What Verexa does not do

Verexa does not record or store video of a student or of their screen. It does not record audio during an assessment, does not use face recognition or any biometric identification, and does not automatically determine misconduct. The optional pre-exam system check can briefly test whether a camera or microphone is available; it does not record or upload audio or video.

Optional AI features

Verexa has optional AI features. When one is used, the content listed here is sent to an AI model provider (Anthropic) to produce the result. Verexa does not add student names, email addresses or student numbers to what it sends (though a person can type such details into free text):

• Generating questions: the source material, subject and question settings a lecturer supplies, and the titles of existing questions.
• AI-assisted draft marking: the question, the marking guide and the student's answer. A person finalises the marks.
• AI-assisted review of answers (lecturer-initiated): bounded question and answer text with an anonymous reference.
• Controlled AI assistance for students (only where an assessment allows it): the question text, what the student types as their request, earlier approved replies in that conversation and, where the assessment's settings allow, the student's current draft reasoning. The correct answer is never sent. These interactions are recorded so they can be reviewed.

Emails

Verexa sends email only for account functions such as password-reset links. To do that, the recipient's email address and the link are passed to an email delivery provider (Resend). We do not send marketing email through Verexa.

Security and audit records

Security-relevant actions, such as completing a password reset, or connecting or disconnecting a sign-in method, are recorded in audit logs. Sign-in attempts are rate-limited and may be temporarily refused after repeated failures.

Why we use this information

To provide Verexa: to authenticate users, deliver and mark assessments, support integrity review by authorised staff, return results to the institution, provide support, keep the service secure and prevent misuse, and meet legal obligations. We do not sell personal information and we do not use it for advertising.

Service providers, cloud infrastructure and overseas processing

Service and infrastructure providers

We use third-party providers to operate Verexa and this website. The ones that handle information for Verexa are:

• Vercel, which hosts the Verexa web application and this website;
• Supabase, which hosts the Verexa database and a private file store for evidence images, where an institution enables them;
• Resend, which delivers account emails such as password-reset links;
• Anthropic, an AI model provider, only when an AI feature is used (see Optional AI features above);
• Google, only when a user chooses Google sign-in.

Other services you may come into contact with

The Verexa Secure Browser installer is a file hosted on GitHub. Verexa does not send GitHub any account, student or assessment information; when you download the installer, GitHub receives standard request information (such as your IP address) under its own policies. Where an institution connects a learning-management system such as Canvas, Verexa exchanges launch details, course and student identifiers and marks with it as the institution has set up, and that system is the institution's own.

Overseas processing

Some of these providers are based in, or may process information in, countries outside Australia, including the United States. We do not control every location a provider uses. Where an institution connects its own systems, the location of those systems is the institution's.

Disclosure

We disclose personal information only to: the institution or lecturer whose assessment it relates to; the providers listed above, to the extent needed to provide the service; where the law requires it or a court or regulator lawfully asks; to protect the security of the service or prevent fraud or misuse; or with the person's consent. We do not sell personal information.

Information security

Measures we use

We use reasonable measures to protect information, including:

• encrypted connections (HTTPS) between your browser and our services;
• passwords stored only as protected one-way hashes;
• role-based access, with each institution's data separated from other institutions;
• rate limiting and temporary refusals on sign-in and password-reset attempts;
• audit records of security-relevant actions.

No guarantee

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim any security certification. If we become aware of a data breach affecting personal information we hold, we will assess it and notify affected people and regulators where the law requires.

Seviact

This notice does not describe how Seviact handles information. Seviact is provided to customers under its own agreement and privacy terms. Questions about Seviact and personal information can be sent to privacy@wasific.com.