Legal · Your privacy

Privacy Policy & Copyright Notice

We protect the privacy of every teacher and student on Mock. Here is what we collect, why we collect it, who can see it and the choices you have.

Effective date: 4 October 2026 · Platform: Mock (Monitored, Optimized, Compliant, Kernel)

See the key points Read our Terms of Service

The key points

We never sell your data

No advertising, no selling, no renting or trading of anyone's personal information.

Read the details

Teachers stay in charge

AI only helps. The teacher reviews and is responsible for every question and every mark.

Read the details

Students are protected

A student's results are seen only by their own teacher and school. We never market to students.

Read the details

Encrypted and guarded

Encrypted in transit and at rest. A serious breach is reported to the Data Commissioner within 72 hours.

Read the details

Your data, your rights

Ask to see, correct, delete or export your data. We aim to reply within 7 days.

Read the details

Your content stays yours

Teachers keep full copyright of the exams and materials they create or upload.

Read the details

Introduction

At Mock, we are committed to protecting the privacy and security of educators and students. This policy explains what information we collect when you use our online assessment platform, why we collect it, who we share it with, how long we keep it and what your rights are. It is written to meet the Kenya Data Protection Act, 2019 and its regulations, the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and other applicable data protection laws.

1. Who we are and our role

  • Teacher and school accounts: Mock is the data controller for the information educators give us to run their accounts and payments.
  • Student information: the school or teacher who adds a student and sets the exam decides why and how that student's information is used, so they are the data controller. Mock is their data processor and handles student information only on their instructions, to deliver and mark their exams.

2. Information we collect

  • Educator account data: name, email address, password (stored only in a scrambled, one-way form by our sign-in provider) or Google sign-in, country, location, institution type and school name, and the classes and exams you create.
  • Payment information: the plan bought, amount, currency, date and the payment reference. Payments (M-Pesa and cards) are handled by our payment processor, Paystack; Mock never receives or stores your card number or M-Pesa PIN. You can read how Paystack handles your data in its privacy policy (opens in a new tab).
  • Student data: name, email address, class, unit and school, as entered by the teacher or by the student when accepting a teacher's invitation.
  • Assessment data: answers, scores, marks, the teacher's feedback, start and submission times and time taken.
  • Exam integrity data: while an exam is open, we record activity that helps the teacher confirm the exam was sat fairly, such as warnings, pauses and timestamps, together with a device identifier kept in the browser.
  • Security records: limited records that keep accounts and exams safe, such as sign-in records. They are kept only briefly.
  • Support requests: what you send us when you ask for help or request an exam setup, including files you upload.

3. How we use your information, and why we may

  • To provide the service you signed up for (performance of a contract): creating accounts, signing in, delivering exams across time zones, marking and showing results, and sending results and invitations by email when a teacher asks.
  • To keep exams fair and the platform secure (our legitimate interests, and the school's interest in exam integrity).
  • To process payments and send billing messages (performance of a contract and legal obligation).
  • To meet legal obligations and resolve disputes.

We do not use your information for advertising, and we do not sell it.

4. AI tools

Mock offers AI tools that help teachers write questions and suggest marks and feedback. When a teacher uses them, the content needed for that task is processed by our AI service provider only to produce the result. The teacher is always in charge: AI suggestions never replace the teacher's judgement, and the teacher is responsible for every question their students see and every mark they give. A student who disagrees with a mark should ask their teacher to review it.

5. Children and students

Many students are under 18. Schools and teachers who add students are responsible for having a lawful basis to do so, including parental or guardian consent where the law requires it (Kenya Data Protection Act, section 33). We collect only what is needed to sit and mark exams, and we never market to students.

6. Who we share information with

Mock does not sell, rent or trade personal data. We share it only as follows:

  • The student's own teacher or school: a student's answers, results and exam records are visible only to the teacher who set the exam, that teacher's school head (read only) and platform administrators. Each teacher keeps a separate record of each student, which other teachers can't see.
  • Service providers who run the platform for us: cloud hosting and database (Google Cloud and Firebase), our AI service provider, Paystack (payments) and our email delivery provider. They may use the data only to provide their service to us, under their data processing terms.
  • The law: where we are required to by law, a court order or a regulator.

7. International transfers

Our servers run on Google Cloud, including in South Africa, and our providers may process data in other countries. Where data leaves Kenya (or the EU), we rely on safeguards the law recognises, such as our providers' data processing terms and standard contractual clauses, as required by sections 48 to 50 of the Kenya Data Protection Act and by the GDPR.

8. How long we keep information

  • Account information: while the account is open. A teacher can delete their account from their dashboard; their classes, exams, exam results and student records are then deleted.
  • Exam results and records: as long as the teacher or school keeps them, or until the teacher's account is deleted.
  • Sign-in and security records: for a short time only (sign-in records 30 days).
  • Payment records: as long as tax and accounting law requires.
  • Limited anti-abuse records, kept in a form that can't be turned back into your email address, for as long as needed to prevent misuse of the platform.

9. Security

Data is encrypted in transit (HTTPS/TLS) and at rest by our cloud provider, and access is limited by strict server-side controls: a teacher sees only their own students and exams, and a student sees only their own exam. If a personal data breach puts your rights at risk, we will notify the Office of the Data Protection Commissioner within 72 hours and tell affected users without delay, as the law requires.

10. Cookies and browser storage

We use only the browser storage the platform needs to work: staying signed in, saving exam answers if the connection drops, the device check, and settings you choose (such as page size). We do not use advertising or tracking cookies.

11. Your rights

Depending on where you live you have rights under the Kenya Data Protection Act, the GDPR, the CCPA or other laws. We give everyone these rights:

  • Be informed about how your data is used (this policy).
  • Access: ask for a copy of your personal data.
  • Correction: ask us to fix wrong or incomplete data.
  • Deletion: ask us to delete your data, subject to a school's record-keeping duties.
  • Portability: receive your data in a common format.
  • Objection and restriction: object to, or ask us to limit, some uses of your data.
  • A human decision: not to be subject to a decision based only on automated processing; the teacher reviews and is responsible for every mark.
  • No discrimination for using your rights (CCPA).

Students: because your school or teacher controls your exam records, please contact them first; we will help them answer your request. You can also write to us and we will pass it on.

To use any of these rights, or to contact our Data Protection Officer, email support@mockassessment.com. We aim to reply within 7 days, and always within the time the law allows. If you are not satisfied, you may complain to the Office of the Data Protection Commissioner (Kenya) (opens in a new tab) or to your local data protection authority.

12. Changes to this policy

We will post any changes on this page with a new effective date, and tell account holders by email or on their dashboard before an important change takes effect.