Privacy Policy

Prova’s Privacy Policy

Privacy Statement

Effective Date: 04/23/2026

Table of Contents

• Introduction
• Data Protection Officer
• How we collect and use (process) your personal information
• Use of the prova.education website
• Cookies and tracking technologies
• Use of Prova services
• When and how we share information with third parties
• Transferring personal data to the U.S.
• Data Subject rights
• Security of your information
• Data storage and retention
• Questions, concerns, or complaints

Introduction

Prova is an AI-native assessment platform for higher education that enables instructors to evaluate student understanding through interactive assessments, including oral exams and recorded workflows.

We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes Prova’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.

Data Protection Officer

Prova is headquartered in Utah, in the United States. Prova has appointed an internal data protection officer for you to contact if you have any questions or concerns about Prova’s personal data policies or practices. If you would like to exercise your privacy rights, please direct your query to Prova’s data protection officer. Prova’s data protection officer’s name and contact information are as follows:

Leandro Cabranes Prova [e-mail]

How we collect and use (process) your personal information

We collect personal information only from users of our platform (students, instructors, and institutional users).

This information may include:

• Name
• Email address
• Audio recordings (oral assessments)
• Video recordings (assignment sessions)
• Screen recordings
• AI interaction data (inputs, prompts, responses)

We collect and process this information solely to:

• Provide and operate Prova’s assessment services
• Evaluate student understanding and performance
• Generate insights and reports for instructors
• Ensure integrity and proper use of the platform

We do not sell personal data. We do not use user data to train AI models.

Use of the Prova Platform

Prova enables students to complete assignments and participate in AI-powered oral assessments.

As part of this process:

• Sessions may be recorded (audio, video, screen)
• AI systems may process submitted work and responses
• Structured evaluation outputs are generated for instructors

Before any recording is stored or processed by third-party AI systems, Prova runs a proprietary privacy-preserving preprocessing step in a secure cloud virtual machine.

This process includes:

• Detecting and blurring sensitive information
• Filtering potential personal or irrelevant data
• Ensuring privacy before downstream processing

Use of the prova.education website

Prova does not currently collect or store personal data from website visitors.

We do not use:

• Tracking cookies
• Analytics tools
• Behavioral tracking technologies

Cookies and tracking technologies

Prova does not use cookies or tracking technologies for data collection at this time.

Use of Prova services

Use of AI Systems

Prova uses third-party AI providers, including:

• OpenAI
• Anthropic
• Google (Gemini)

These systems are used strictly to process user inputs and generate responses as part of the platform’s functionality.

Important:

• User data is not used to train third-party AI models
• Data is processed only for the purpose of delivering the service
• We apply preprocessing safeguards before sending data to any AI provider

When and how we share information with third parties

Prova uses trusted third-party service providers to operate its platform, including:

• Cloud infrastructure providers (Google Cloud Platform)
• AI processing providers (listed above)

These providers only process data on our behalf and do not have permission to use it for their own purposes.

We do not share personal data with third parties except:

• To provide our services
• To comply with legal obligations
• To protect rights, safety, or security
• With authorized institutional partners (e.g., universities)

We do not otherwise reveal your personal data to non-Prova persons or businesses for their independent use unless: (1) you request or authorize it; (2) it’s in connection with Prova-hosted and Prova co-sponsored conferences as described above; (3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) to address emergencies or acts of God; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers, and/or other third parties for marketing or promotional purposes.

Data Ownership and Educational Context

Prova operates within an educational context and works with universities and instructors.

Student data is processed as part of institutional use of the platform. Prova acts as a service provider to educational institutions.

We align our practices with educational privacy expectations (including FERPA principles), ensuring that data is used only for educational purposes and platform functionality.

Transferring personal data to the U.S.

Prova has its headquarters in the United States. Information we collect about you will be processed in the United States. By using Prova’s services, you acknowledge that your personal information will be processed in the United States. The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. Pursuant to Article 46 of the GDPR, Prova is providing for appropriate safeguards by entering binding, standard data protection clauses, enforceable by data subjects in the EEA and the UK. These clauses have been enhanced based on the guidance of the European Data Protection Board and will be updated when the new draft model clauses are approved.

Depending on the circumstance, Prova also collects and transfers to the U.S. personal data with consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Prova in a manner that does not outweigh your rights and freedoms. Prova endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Prova and the practices described in this Privacy Statement. Prova also enters into data processing agreements and model clauses with its vendors whenever feasible and appropriate. Since it was founded, Prova has received zero government requests for information.

For more information or if you have any questions, please contact us at [e-mail] or visit our Trust Center for additional security and compliance information.

Data Subject rights

The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws provide certain rights for data subjects. Data Subject rights under GDPR include the following:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right of data portability
• Right to object
• Rights related to automated decision making including profiling

This Privacy Notice is intended to provide you with information about what personal data Prova collects about you and how it is used.

If you wish to confirm that Prova is processing your personal data, or to have access to the personal data Prova may have about you, please contact us.

You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Prova might have received the data from Prova; what the source of the information was (if you didn’t provide it directly to Prova); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Prova if it is inaccurate. You may request that Prova erase that data or cease processing it, subject to certain exceptions. You may also request that Prova cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Prova processes your personal data. When technically feasible, Prova will—at your request—provide your personal data to you.

Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, Prova will provide you with a date when the information will be provided. If for some reason access is denied, Prova will provide an explanation as to why access has been denied.

For questions or complaints concerning the processing of your personal data, you can email us at [e-mail]. Alternatively, if you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or with your nation’s data protection authority.

Security of your information

[This section was not included in the provided privacy statement but is referenced in the table of contents. You may want to add content here.]

Data storage and retention

Your personal data is stored by Prova on its servers, and on the servers of the cloud-based database management services the Prova engages, located in the United States. Prova retains service data for the duration of the customer’s business relationship with Prova and for a period of time thereafter, to analyze the data for Prova’s own operations, and for historical and archiving purposes associated with Prova’s services. Prova retains prospect data until such time as it no longer has business value and is purged from Prova systems. All personal data that Prova controls may be deleted upon verified request from Data Subjects or their authorized agents. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at: [e-mail]

Children’s data

We do not knowingly attempt to solicit or receive information from children.

Questions, concerns or complaints

If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at:

Prova Leandro Cabranes [e-mail]

For additional security and compliance information, visit our Trust Center.