levelexams

Privacy Policy

Here you can find out which personal data we process when you use Level Exams (levelexams.com), what we need it for, who processes it on our behalf and what rights you have.

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website and in the application is:

OSAR Global Trading DOOGavra Vukovića bb81000 PodgoricaMontenegro

Represented by
Olcay Sari, Executive Director (Izvršni direktor)
E-mail
info@levelexams.com
Phone
+382 68 297 398

For any questions about data protection, you can reach us at info@levelexams.com.

2. Which data we process

  • Account: e-mail address, password (only as an encrypted hash – we cannot read it) and the language you chose. When you log in, technical log data is generated at our sign-in service (e.g. time and IP address).
  • Exam and learning data: your answers, scores and results in mock exams and lessons, your progress in the vocabulary module and the AI progress report on your exam result.
  • Writing texts: texts you write in the Writing part and the corresponding evaluation.
  • Voice recordings in the Speaking part: in Speaking tasks (in mock exams and lessons) your voice is recorded through your device's microphone after you have allowed access in your browser. The recording is stored in a non-public storage area at Supabase and sent to Groq for transcription. The transcript and the evaluation are saved with your exam attempt. Recordings are deleted automatically 90 days after the start of the respective exam or lesson attempt; the transcript and the evaluation are kept. On request we delete them earlier (see section 8).
  • Support messages: subject, message, your e-mail address and the page you wrote to us from.
  • Reviews: if you submit a review, we store your display name, target exam, star rating and comment. It appears publicly on the home page only after we have approved it.
  • Technical details at exam start: when an exam attempt starts, we store a rough device description (browser and operating system, e.g. “Chrome · Windows”) and the country that our hosting provider derives from the connection. We do not store your IP address for this. The details serve to protect against misuse, such as sharing access with others.
  • Payment data: for each purchase we store the package, amount, currency, status and time, the technical response from the payment service provider and your billing address (street, city, postcode, country). The bank requires the billing address for card payments; it is passed to the payment service provider together with your e-mail address and the amount, and used for your invoice. You enter your card details directly on the payment service provider’s payment page; we neither receive nor store them.
  • School codes and sharing of results: If you redeem a code from your language school, we store which account redeemed the code and when. If you explicitly consent when redeeming the code or later in your dashboard, the teachers of that school see your name, email address and exam result reports (scores, your answers, writing and speaking assessments – including correction examples from your text – and weak topics); they do not see your audio recordings. Without your consent the school only sees that the code was used, not who used it.

3. Purposes and legal bases

  • Providing the service (account, exams, lessons, evaluation, support, payment processing): Art. 6(1)(b) GDPR (contract or pre-contractual measures).
  • Security and protection against misuse, stable operation and cookie-free audience measurement: Art. 6(1)(f) GDPR (legitimate interest in a secure and economically operated service).
  • Statutory retention obligations, e.g. for invoices and accounting records: Art. 6(1)(c) GDPR.
  • Publishing a review you have submitted: Art. 6(1)(a) GDPR (consent); you decide whether to submit a review and can withdraw your consent at any time.
  • Sharing your exam results with your language school: Art. 6(1)(a) GDPR (consent); consent is optional and can be withdrawn at any time in your dashboard, which ends the school's access immediately.

4. AI-assisted evaluation

Your writing and speaking performance is evaluated by an AI model, which also prepares a progress report on your exam result. The evaluation serves only as practice feedback and has no legal effect for you; it is not an automated decision within the meaning of Art. 22 GDPR. Only your answer texts or transcripts, task content and results are sent to the AI service – no account data such as your e-mail address.

5. Service providers (processors)

We use the following service providers, who process data on our behalf. Where legally required, we conclude data processing agreements with them pursuant to Art. 28 GDPR.

Vercel Inc. (USA) – hosting
Delivery of the website and the application. Server region: Dublin (Ireland). Technical access data is generated in server logs (e.g. IP address, time, page requested).
Supabase Inc. – database, sign-in, file storage
Storage of account, exam and learning data, sign-in, and storage of voice recordings. Region: eu-west-1 (Ireland).
Google Ireland Limited – “Continue with Google”
Only when you click “Continue with Google” on the sign-in or sign-up page is Google’s sign-in script loaded and your browser connects to Google (Google then receives, for example, your IP address and can read its own cookies). Nothing is sent to Google before that click. If you sign in with Google, the name, e-mail address and profile picture of your Google account are passed to us. We never see your Google password.
Resend Inc. (USA) – sending e-mails
Sending of confirmation, password and support e-mails. Your e-mail address and the content of the respective e-mail are processed.
Cloudflare Inc. (USA) – DNS and e-mail forwarding
Name resolution for levelexams.com and forwarding of incoming e-mails to our mailboxes. Connection data and the content of e-mails you send us are processed.
Anthropic PBC (USA) – AI evaluation
Evaluation of writing and speaking and preparation of the progress report. Answer texts or transcripts, task content and results are sent – no account data.
Groq Inc. (USA) – speech recognition
Transcription of the voice recordings in the Speaking part. The audio recording is sent, no account data.
Umami Software, Inc. – audience measurement
Counts page views and individual clicks (e.g. on “Sign up”) without cookies, without storing your IP address and without cross-device tracking. URL parameters and fragments are not transmitted; your browser’s “Do Not Track” setting is respected.
NLB Banka a.d. Podgorica / Bankart – payment processing
Processing of card payments including 3-D Secure. The amount, your e-mail address and your billing address are passed on. You enter your card details directly on the payment page; they are not stored by us.
Frankfurter (frankfurter.app) – exchange rates
Our server retrieves the European Central Bank’s EUR/TRY reference rate in order to convert prices. No personal data is transmitted in the process.

6. Transfers to third countries

Several service providers are based in the USA or process data there. The transfer relies on the EU-US Data Privacy Framework where the provider is certified, and otherwise on EU standard contractual clauses (Art. 46 GDPR). We ourselves are based in Montenegro and access the data stored in the EU from there.

7. Cookies and audience measurement

We use only technically necessary cookies: sign-in/session cookies so that you stay logged in, and cookies for your language setting (NEXT_LOCALE and PUBLIC_LOCALE, stored for up to one year). The legal basis is § 25(2) no. 2 of the German TDDDG. There are no advertising or tracking cookies; audience measurement works without cookies. Fonts are delivered from our own server, not from third parties. If you arrive through an invite link, we store the invite code in a cookie (LE_DAVET) for 30 days so that it can be matched to the inviting person when you sign up; the invitation relationship is stored with your account. Your name and e-mail address are not shown to the inviting person.

8. Retention period

We store account, exam, learning and writing data as well as the transcripts and evaluations of speaking tasks until your account is deleted. Voice recordings are deleted automatically 90 days after the start of the respective exam or lesson attempt. You can request deletion of your account at any time by e-mail to info@levelexams.com; we will then delete the account and the associated data, including any remaining voice recordings, unless statutory retention obligations prevent this. We keep invoices, accounting records and the related payment data (including the billing address) for the statutory retention periods. Server logs at the hosting provider are deleted after a short time.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future. To do so, contact info@levelexams.com.

Right to lodge a complaint: you can complain to a supervisory authority. In Montenegro this is the Agency for Personal Data Protection and Free Access to Information (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama). Users in the EU can also contact the supervisory authority of their member state.