Examplary Privacy Policy

1. Who we are and when this policy applies

1.1 Examplary is provided by Examplary B.V. (Examplary or we), Zijpendaalseweg 17, 6814 CB Arnhem, the Netherlands, Chamber of Commerce number 98672118. You can reach us about privacy at support@examplary.ai.

1.2 We are the controller for personal data that we process for our own purposes. That is the case when:

• you visit our website;
• you create an individual account and use Examplary;
• you contact us, sign up for our newsletter or do business with us.

1.3 In other situations, we process personal data on behalf of someone else, who is then the controller:

• When a school or other organisation uses Examplary, the organisation is the controller for the data of its teachers and students. We are its processor and follow its instructions under a data processing agreement. If you use Examplary through your school, your school’s privacy information applies, and you can contact your school with questions.
• When a teacher with an individual account invites students to take a test or to practise, the teacher, or their school, is the controller for the students’ data. We process that data on their behalf, under Annex 1 of our Terms of Service.

1.4 This policy also describes, in general terms, how we handle data as a processor, so that everyone can see how Examplary works.

2. What data we use, why, and on what legal basis

This table covers the data we process as controller. We don’t sell personal data and we don’t use it for advertising.

You need to give us your account data to use Examplary; without it, we can’t provide the service. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

3. How our AI features handle data

3.1 When you use the AI features, we send the content needed for the task to an AI model: learning materials, questions, rubrics and students’ answers. Before we send typed content, we remove names, email addresses, student numbers and other direct identifiers. For scanned paper tests, we send the whole scan, so a name that a student wrote on the paper can be included.

3.2 An answer can still contain information that a student wrote in it themselves. That’s why we treat this content as personal data, and why our AI provider is bound by an agreement with us. The provider processes the content only for us and doesn’t use it to train or improve its models. For organisations based in the European Economic Area, this happens within the European Union by default. For individual accounts and other organisations, it happens at the fastest available location, preferably in the EU but possibly outside the European Economic Area (see section 5). It keeps the content in temporary memory (a cache) for up to 24 hours and may log it to detect abuse of its service.

3.3 Our default AI provider is Google Cloud (Vertex AI, with Gemini models). Organisations can ask for a different model; if possible, we then list that provider in their data processing agreement.

3.4 Output from the AI features is a suggestion. A teacher reviews and approves grades and feedback before they become final. We log the use of the AI features to monitor quality and safety, and we keep personal data in these logs to a minimum.

4. Who we share data with

We use service providers that process data on our behalf. They may only use it for us and are bound by a data processing agreement.

For quotes and invoices to organisations, we also use accounting software. This only involves the business contact data of contact persons at those organisations, not data of users.

For some purposes, such as preventing fraud and meeting its own legal obligations, Stripe acts as an independent controller. Stripe’s privacy policy then applies. If you or a student signs in with Google or Microsoft, we receive a name and email address from them; their own privacy policy applies to that login.

We only share data with authorities if the law requires it. If Examplary is sold or merges with another company, data may pass to the new owner, who must respect this policy.

5. Where we store data and transfers outside the EU

5.1 We store data in the European Union. The AI features can process content outside the European Economic Area: for individual accounts and organisations outside the European Economic Area at the fastest available location, and for organisations in the European Economic Area only if they switch off the setting “EU only”, which is on by default for them.

5.2 Some of our providers are based in, or belong to groups based in, the United States: Amazon, Google, Stripe, Front and PostHog. If a US company can access data, we rely on the EU-U.S. Data Privacy Framework, under which these companies are certified, or on the EU standard contractual clauses. EmailOctopus is based in the United Kingdom, for which the European Commission has adopted an adequacy decision. Ahrefs is based in Singapore; for Ahrefs, we rely on the EU standard contractual clauses.

6. How long we keep data

7. How we protect data

We take technical and organisational measures that fit the sensitivity of the data, including:

• encryption of data in transit and at rest;
• access for our team members only where their work requires it;
• logging and monitoring of access and security events;
• daily backups and tested recovery procedures;
• regular security tests, including an external penetration test;
• confidentiality agreements with everyone who works for us.

We assess our security against ROSA, the information security and privacy framework of the Dutch education sector. If a data breach occurs, we follow our breach procedure. We inform the people affected and the supervisory authority where the law requires it.

8. Children and students

8.1 Individual Accounts are for people aged 18 and over. Students use Examplary through their teacher or school: with a link or code, with a student login, or by signing in with Google or Microsoft. A student login only gives access to what their teacher or school shares with them.

8.2 We process students’ data only on behalf of their school or teacher. We don’t use it for our own purposes, such as marketing, and we never show advertising.

8.3 Students and parents with questions about their data can contact the school or teacher. If they contact us, we pass the request on.

8.4 If you think a child has created an Account with us, let us know and we’ll delete it.

9. Your rights

9.1 You have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted;
• restrict how we use your data;
• receive your data in a common format, or have it sent to another organisation;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time, without affecting processing that took place before.

9.2 You can export or delete much of your data yourself in your account settings. For everything else, email support@examplary.ai. We respond within one month and may ask you to confirm your identity first.

9.3 Do we process your data on behalf of a school or teacher? Then contact them; if you contact us, we forward your request.

9.4 You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in the country where you live. We’d appreciate it if you contacted us first, so we can try to resolve the issue.

10. Cookies

10.1 Our website and Examplary use cookies and similar technologies:

• Necessary cookies, to log you in, keep you signed in, protect your Account and remember your settings. These don’t require consent.
• Analytics on our website, without cookies: privacy-friendly analytics from Ahrefs that don’t set cookies, don’t track you across websites and don’t identify you.
• Analytics cookies in Examplary: we use PostHog to see how features are used. PostHog processes this data only for us and within the EU, and we don’t share it with anyone else.

10.2 We don’t use advertising or tracking cookies.

10.3 We only use necessary cookies and analytics cookies that have little impact on your privacy. These don’t require consent, so we don’t show a cookie banner. You can delete cookies in your browser settings at any time.

11. Changes and contact

11.1 We may update this policy, for example when we add features or use new providers. If we make important changes, we tell registered users by email or in Examplary before the changes take effect.

11.2 Questions about this policy or your data? Contact us at support@examplary.ai or write to Examplary B.V., Zijpendaalseweg 17, 6814 CB Arnhem, the Netherlands.

11.3 This policy was last updated on the 8th of October, 2026.