Privacy Policy

Imtihan is an AI-powered exam generation service for teachers in Lebanon and internationally. We are operated by an independent developer based in Beirut, Lebanon. We are committed to protecting your personal data and being transparent about how we use it.

Adult accounts. Account creation requires confirmation that you are at least 18. No date of birth is requested. Teacher generation does not require student identities. If you use the student practice portal, we process its account profile and saved practice attempts.

• Account data — your name, email address and profile information. Firebase Authentication manages passwords and sign-in credentials.
• Exam data — the exam descriptions and parameters you enter (subject, level, duration, etc.), and the exercises generated for your library.
• Uploaded documents — course notes or past exams you upload to ground AI generation. These are processed in memory and never stored on our servers after the request completes.
• Usage data — optional analytics about pages and feature usage when you accept analytics; operational error logs help us maintain the service.
• Device data — browser and network information for security; account creation may use a device fingerprint to prevent repeated free-trial abuse.

• To generate, save, and export your exams.
• To send transactional emails (password reset, subscription renewal reminders).
• To send promotional messages, subject to your email preferences. Promotional emails include an unsubscribe link; preferences apply across our promotional email senders.
• To detect and prevent abuse, fraud, or API quota violations.
• To improve the product based on aggregated, anonymised usage patterns.

We never sell your data. We do not share your personal data with advertisers, data brokers, or any third party for commercial purposes.

We use infrastructure providers that may process data outside Lebanon. Storage and retention depend on the service and configuration:

• Firebase / Google Cloud — authentication, account profiles, exam library and practice data.
• Vercel — hosting and serverless functions.
• Anthropic and Google AI — descriptions and selected source documents during analysis and generation. Provider retention is governed by their service terms and our account configuration; we do not promise immediate provider deletion.
• Brevo — email delivery. Google Analytics, Plausible and Vercel Analytics process optional analytics after acceptance.

Do not upload identifiable student records or confidential school materials to the generator. The separate adult student practice portal stores profiles and attempts needed for practice features; teacher access is governed by account and school permissions.

Schools can discuss data processing requirements by emailing admin@imtihan.live before submitting institutional data.

• Account data — retained while your account is active, deleted within 30 days of a deletion request.
• Exam library — retained until you delete individual exams or your account.
• Uploaded documents — not retained; purged from memory immediately after generation completes.
• Usage logs — retained for 90 days for security and debugging, then automatically deleted.

As a user, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Correction — correct inaccurate data in your profile.
• Erasure — request deletion of your account and all associated data ("right to be forgotten").
• Portability — receive your exam data in a machine-readable format (JSON/docx).
• Restriction — restrict processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.

To exercise any right, email admin@imtihan.live with subject line "Data Request". We will respond within 30 days.

Essential session cookies keep you signed in; a temporary redirect cookie preserves your destination. We store your analytics choice locally in your browser. Optional analytics scripts, including Google Analytics cookies, load only after acceptance. You can reject them or withdraw acceptance using “Privacy choices”. We do not integrate session replay or keystroke recording. Our fonts are served by Imtihan rather than loaded from Google Fonts servers in your browser.

Data is transmitted over HTTPS/TLS. Firebase Authentication manages passwords. Firebase Security Rules and server authorization checks control data access. GitHub CodeQL scans help identify code security issues.

If you discover a security vulnerability, please disclose it responsibly to admin@imtihan.live before public disclosure. We will acknowledge within 48 hours.

We will notify registered users by email of any material changes at least 14 days before they take effect. Minor clarifications may be made without notice. The date at the top of this page always reflects the last update.

Questions or requests regarding your privacy can be sent to: admin@imtihan.live