Version 2026-07-30

Privacy notice

Two situations are covered separately here, because they work differently: what you do on your own practice account, and an assessment a company assigned to you.

1. Who is responsible for your data

For your own practice account, we decide what is held and why: DEVECE Aviation Services by Cesare Paolo De Vecchi, ul. Farbiarska 65G, 02-862 Warszawa, Poland, NIP 9512447039. Contact us at cesare@hexacrewtools.com.

For an assessment a company or school assigned to you, that organisation decides what is held and why, and we hold and process it on its instructions under a written agreement. If you want that data changed or removed, ask them; tell us as well and we will pass it on.

We have not appointed a data protection officer, and we are not required to. We are established in the European Union, so no Article 27 representative is needed. Write to the address above about anything in this notice.

2. What we hold about a candidate

From your account: your name, your email address, when the account was created, whether the email address has been confirmed, and your password as a one-way hash. We never hold the password itself.

From every test you take: your answers, including the full text of any written answer, your section and overall scores, when you started and finished, and the IP address the attempt was started from. For the tasks that have integrity measures we also hold a summary of them: blocked paste attempts, times you switched away from the tab, and statistics about your typing rhythm. Typing rhythm is timing only; what you typed is your answer, and no keystrokes are recorded separately from it.

From marking a written or spoken answer: the scores against each criterion, all three marking runs, the model and rubric version used, the level that came out, and any note or correction a human reviewer added. Speaking audio is sent for marking and deleted as soon as marking finishes; we do not keep recordings.

Where a company has approved a result report about you, the report file holds your name, your email address and the IP address the attempt was started from.

3. What we hold about a company user

Your name, your work email address, your role in the company account, when it was created, and your password as a one-way hash. We also record the actions that need to be provable later, such as approving a test or confirming a result, against your account.

4. Why we hold it, and on what basis

To run your account and give you your results, because that is the service you asked for. To keep marking honest and the platform secure, which is our own legitimate interest and covers the integrity summaries, the rate limits and the bot check. To meet an obligation where the law imposes one. For an assessment a company assigned, on that company's instructions and on the basis it relies on.

5. Automated marking, and the human in it

Written and spoken answers are marked by an AI model against a published rubric, three times, and the middle result is used. Nothing on the platform decides anything about you on its own: practice results go only to you, and where a company uses an assessment to select candidates a named person at that company reviews the mark and can change it before any decision. We also send a sample of AI marks to human reviewers of our own.

You can ask how any result about you was produced and we will tell you, and you can ask for a human to review a mark from your result page. How our English marking works sets out the whole method.

6. Who else sees it

The company that assigned you an assessment sees that assessment: your name, your email address, your answers, your result and the integrity summary. Nothing from your own practice account is included.

Google processes written and spoken answers when they are marked, through the Gemini API on paid terms under which prompts and responses are not used to improve Google products. Cloudflare runs the check that tells a person from a bot on our forms. Microsoft carries the email we send you. Our hosting provider holds the database and the stored files. Each of these acts on our instructions and for no purpose of its own.

The hosting provider is Hostinger. The server holding the database and the stored files is in France, and the backups of it are held in Lithuania. Both are inside the European Economic Area.

Marking through the Gemini API may be processed outside the European Economic Area. Google is bound by the standard contractual clauses approved by the European Commission, together with its own supplementary measures, and by paid terms under which prompts and responses are not used to train or improve Google products. We do not currently restrict that marking to servers inside the EEA, and we say so here rather than promise something we would have to keep verifying.

7. Cookies

One cookie holds your session so that you stay signed in; it is sent over HTTPS only, is not readable by scripts, and is not used to track you. The bot check sets its own cookie on the pages it runs on. There is no analytics and no advertising cookie on the platform.

8. How long we keep it

Test attempts and their marks are kept for no longer than 24 months, and shorter where the setting on this platform or an agreement with a company requires it. Account details are kept until you delete the account. Bot-check and rate-limit records hold a one-way hash of an IP address rather than the address itself, and are short-lived.

9. Deleting your account

You can delete a candidate account from your account page. Your name and email address are removed permanently, your attempts are detached from your identity so what is left is anonymous, any stored report file that carried your details is deleted, and your journey progress is deleted. It cannot be undone.

10. Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing we base on our own legitimate interest, and ask for your data in a portable form. Ask at cesare@hexacrewtools.com. You can also complain to a data protection authority. Ours is the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, and you may equally complain to the authority in the country you live in.

11. Changes to this notice

This notice carries the same version date as the terms and conditions, and the version you accepted at registration is stored with your account.