Privacy notice

How your assessment data is handled

Version 2026-09-22

This notice explains what is collected while you take an assessment, who is responsible for it, why it is collected, how long it is kept, and what you can ask for.

Who is responsible

The organization that invited you decides that the assessment happens, what it asks, and what is done with the result. Under India's Digital Personal Data Protection Act, 2023, they are the Data Fiduciary.

Tricon Infotech LLC operates Tuglu, the software the assessment runs on, and is the Data Processor. It processes your data only on that organization's instructions and for no other purpose. It does not sell your data, does not use it for advertising, and does not use it to train AI models.

Questions about your data go to the organization that invited you. Their contact details are on your invitation email and on the page where you started.

Who these assessments are for

Assessments are for candidates aged 18 or over. If you are under 18, do not start the assessment — tell the organization that invited you. We do not knowingly process the data of children, and the proctoring described below is not used on anyone under 18.

What is collected

Identity — your name and email address, given to us by the organization that invited you, and a job or client reference if they used one.
Your work — your answers, any code you write, which question you were on and for how long, and the fact that you flagged a question.
Technical — your browser and operating system, and connection interruptions during the assessment.
Proctoring events, if the assessment is proctored — switching away from the assessment tab, leaving full screen, pasting a block of text, right-clicking, and whether a face is visible to the camera. Each is a timestamped event, not a recording.
Camera snapshots, if the assessment uses the camera — occasional still images, taken at the start, at intervals, and when an event is raised.

What is not collected

No video or audio is recorded. Camera frames are analysed in your browser and discarded; only occasional still images are uploaded.
No face recognition and no biometric identifier. The check detects whether a face appears to be present. It never computes a face template or anything that could identify you from a photograph. It is an imperfect check: it can fail to see a face that is turned away or partly out of frame, which is why a person reviews the images rather than relying on the signal.
Nothing outside the assessment page. No browsing history, no other tabs, no files, no keystrokes outside the answer fields.
No special category data is asked for. If you volunteer some in a written answer it is treated as part of your answer.

Why, and on what basis

Your data is processed to run the assessment, to score it, to produce a report for the organization that invited you, to keep that decision auditable, and to keep the assessment fair to every candidate.

Under the DPDP Act, the organization that invited you relies on your consent for this processing. You give it on the welcome page before the assessment starts, and the assessment will not start without it. Consent is asked for separately for the camera and snapshots where they are used.

You can refuse, and you can withdraw. Tell the organization that invited you and ask about an alternative. Withdrawing consent stops further processing; it does not undo what happened before you withdrew, and the organization may still keep what it needs to justify a decision already made.

How AI is used

AI wrote and checked the questions before you saw them.
AI scores written answers against a marking guide, and reviews submitted code.
AI writes a short summary of the result for the reviewer.
A person decides. No score, summary or proctoring signal advances or rejects anyone on its own. A reviewer sees the reasoning behind every AI score, can change it, and is the only one who records a decision. You can ask the organization that invited you how your result was reached, and ask for it to be looked at again.

How long it is kept

Camera snapshots and proctoring events — deleted automatically after a period the organization that invited you sets. The welcome page you saw before starting names the exact number of days.
Your answers, scores and the report — kept by the organization that invited you for as long as they need to justify the hiring decision, and deleted on request or when their retention period ends.
The fact that an assessment happened — kept after erasure, with your personal details removed, because a decision has to remain auditable.

Who it is shared with

The organization that invited you.
Their client, if they are hiring on a client's behalf — usually as a report shared by link, which can be set to hide your name and contact details.
The service providers Tuglu runs on, as processors under contract: hosting and database, object storage for snapshots, email delivery, the AI provider that scores written work, and the code runner below. No one else.
Judge0, reached through the RapidAPI marketplace, if your assessment has a coding question — to run the code you write in an isolated sandbox and report whether it produced the expected output. It receives only the source code you submit or run and the test input it is run against. It never receives your name, your email address or anything else about you.

Where it is stored

Your data is stored and processed on servers in the United States.

Under section 16 of the DPDP Act the Government of India may restrict transfers to particular countries by notification. The United States is not currently subject to such a restriction. The organization that invited you remains responsible for your data wherever it is processed, and Tricon Infotech LLC processes it only on their instructions under a written agreement.

What you can ask for

Under the DPDP Act you may ask to:

Know what personal data of yours is being processed, what it is used for, and who it has been shared with.
Correct data that is wrong, complete data that is incomplete, and update data that is out of date.
Erase your data when it is no longer needed for the purpose it was collected for.
Nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
Withdraw consent at any time, as easily as you gave it.

Where to ask. Send your request to the organization that invited you, at the address on your invitation. Tricon Infotech LLC acts only on their instruction, so a request made to them reaches everything. They will respond within 30 days.

Erasure removes your name, contact details, answers, code and snapshots, and leaves only the fact that an assessment happened and what was decided.

The DPDP Act also asks you not to make a false or frivolous request, and not to impersonate anyone else when making one.

If something goes wrong

First, tell the organization that invited you. Their grievance contact is on your invitation and on the page where you started. They will acknowledge your grievance and respond within 30 days.

If you are not satisfied, you may complain to the Data Protection Board of India, which handles complaints digitally. Details of how to do so are published by the Board.

If there is a data breach

If personal data held for an assessment is affected by a breach, the organization that invited you will inform you and the Data Protection Board of India, as the DPDP Act requires, with a description of what happened and what you can do about it. Tricon Infotech LLC will inform them without delay so that they can.

Languages

This notice is published in English. You may ask the organization that invited you for it in any language listed in the Eighth Schedule to the Constitution of India, and they will arrange it.

India

This notice is written to the DPDP Act throughout: the sections above on who is responsible, the basis for processing, what you can ask for, grievances and breach notification all describe your rights under that Act.

United States

State privacy laws differ; where they apply, requests go to the organization that invited you, which will respond within the time its state law requires. Your data is not sold and is not shared for cross-context behavioural advertising. Because a person makes every hiring decision, this is not intended to be solely automated decision-making.

Some states and cities regulate automated tools used in hiring. New York City, for example, requires an employer using one to publish a bias audit summary and to notify candidates at least ten business days before use. That notice comes from the employer, not from Tuglu; if they have supplied one it appears on the welcome page above the consent boxes. Tuglu can produce the score data an employer's bias audit needs, on request to the organization that invited you.

No face template or other biometric identifier is created at any point, which is the concern several state biometric laws address.

Other countries

Where the law of another country applies to you, nothing in this notice narrows the rights it gives you. In the European Economic Area and the United Kingdom you may have rights of access, rectification, erasure, restriction, objection and portability, and a right to complain to your national supervisory authority.

Changes to this notice

If this notice changes in a way that affects you, the new version applies to assessments started after its date. The version you agreed to is recorded with your assessment, and the organization that invited you can tell you which one that was.

Version 2026-09-22. Questions about this notice go to the organization that invited you.