Privacy Statement
Effective Date: October 8, 2026 (replaces the statement dated April 23, 2026)Table of Contents
- Introduction
- Data Protection Officer
- Our role: service provider to institutions
- Information we collect
- How we use information
- How we use AI
- Use of the prova.education website
- Cookies, analytics and monitoring
- Subprocessors and other recipients
- Where data is stored and processed
- Data subject rights
- Security of your information
- Data storage and retention
- Children’s data
- Changes to this statement
- Questions, concerns or complaints
Introduction
Prova AI, Inc. (“Prova”, “we”) provides an AI-native assessment platform for higher education. Students complete short, AI-led oral assessments in which they explain and defend their work, and instructors receive AI-generated evaluations that they review before making any academic decision. This Privacy Statement explains what personal data we collect through the Prova platform and website, how we use it, who we share it with, how long we keep it and the rights you have. We update it when our practices change; the effective date above shows the latest version.Data Protection Officer
Prova is headquartered in Utah, United States. Our Data Protection Officer (DPO) is the contact for any question about this statement or to exercise your rights: Leandro Cabranes, Chief Technology Officer and Data Protection Officer Prova AI, Inc. [email protected] · [email protected]Our role: service provider to institutions
Prova provides the platform to colleges and universities under an agreement with each institution. For student and instructor data processed through the platform, the institution is the controller and owner of the data, and Prova acts as its service provider (processor). For US institutions, Prova handles education records as a “school official” under FERPA, under the institution’s direct control, and uses them only for the purposes the institution authorizes. If you are a student, your institution decides whether an assessment is required and is your first point of contact for questions about your education records. We will help your institution respond to your requests.Information we collect
From students, instructors and institutional administrators using the platform:- Account data: name, email address, institution and course membership, role, authentication data (passwords are stored only as salted hashes; MFA factors).
- Optional profile data: phone number and other profile fields a user chooses to provide.
- Assessment content: submitted work (files, code, drawings, text answers), assessment configuration, rubrics and instructor notes.
- Recordings: audio, webcam video and screen recordings of assessment sessions.
- Conversation data: transcripts of the AI-led conversation and the AI’s questions and responses.
- Evaluation data: AI-generated evaluations, scores, feedback and instructor reviews.
- Technical and security data: IP address, browser and device type, timestamps, authentication events, audit logs and error reports.
How we use information
We use personal data only to:- Provide and operate the assessment services requested by the institution.
- Conduct AI-led oral assessments and evaluate submissions against the instructor’s rubric.
- Produce feedback and reports for instructors, who review AI evaluations before any academic decision.
- Secure the platform, prevent abuse and fraud, and troubleshoot errors.
- Measure and improve the quality and reliability of the service for the institution (for example, checking that AI evaluations are accurate), without using personal data to train AI models.
- Comply with legal obligations.
How we use AI
AI is the core of the service and is used to:- Conduct the assessment conversation — a voice agent asks follow-up questions about your work in real time (speech-to-text, a large language model and text-to-speech).
- Analyze your responses — transcripts, recordings, submitted work and drawings are evaluated against the instructor’s rubric.
- Generate reports for instructors, including flags for behaviors the instructor defined.
Use of the prova.education website
Our marketing website uses Vercel Web Analytics, a cookieless service that reports aggregated page views and events without identifying individual visitors. If you book a demo, our scheduling provider (Cal.com) collects your name, email address and the details you enter, which we use only to contact you about Prova.Cookies, analytics and monitoring
- Essential cookies keep you signed in to the platform. We do not use advertising or cross-site tracking cookies or pixels.
- Vercel Web Analytics (cookieless, aggregated) is used on the website and platform to understand usage.
- Sentry error monitoring captures error reports, including technical details such as IP address, browser type and user identifier, and may record a replay of the session in which an error occurs, so that we can diagnose problems.
- Cloudflare Turnstile checks that sign-in requests come from a real browser.
Subprocessors and other recipients
We share personal data only:- With our subprocessors, who process it on our behalf under written agreements, solely to provide the service. The current list, with purpose, data, location and retention terms, is published at docs.prova.education/subprocessors.
- With the institution that provides you access, and with integrations the institution chooses to enable (for example, gradebook exports or partner platforms).
- When required by law (a valid subpoena, warrant or court order). We review every request, disclose only what is legally required, and notify the institution unless legally prohibited. Prova has received no government requests for data to date.
- To protect the rights, property or safety of Prova, our users or others, or in connection with a merger or acquisition, in which case this statement and our agreements with institutions continue to apply.
Where data is stored and processed
Prova’s platform data is stored in the United States: our database and its backups in Amazon Web Services (us-west-2, via Supabase) and files and recordings in Google Cloud (US regions). AI processing also takes place in the United States: each AI provider processes Prova’s requests in the US, as the subprocessor list states. If you are located outside the United States, your data will be transferred to and processed in the United States. Where required by law (for example, the GDPR), we rely on Standard Contractual Clauses and data processing agreements with our institutions and vendors.Data subject rights
Depending on where you live, you may have the right to:- Be informed about how your data is used.
- Access a copy of your personal data.
- Correct inaccurate data.
- Request deletion (erasure).
- Restrict or object to processing.
- Receive your data in a portable format.
- Not be subject to decisions based solely on automated processing.
Security of your information
We protect personal data with administrative, technical and physical safeguards, including:- Encryption in transit (TLS 1.2+ for web and API traffic, DTLS-SRTP for real-time audio) and at rest (AES-256, managed by our cloud providers).
- Tenant isolation of each institution’s data through database row-level security and server-side authorization checks.
- Access control: multi-factor authentication for platform accounts; single sign-on (SAML 2.0) available to institutions on request; least-privilege, individually assigned staff access with multi-factor authentication enforced on our identity provider and source-code platform; access reviews; and audit logging of authentication events and changes to sensitive records.
- Private storage: recordings and files are stored in private cloud storage and accessed only through short-lived signed links.
- Network protection: restricted database network access, firewalls and intrusion detection for our self-hosted services.
- Secure development: every code change is peer-reviewed and must pass automated tests and static security testing before it reaches a staging branch, and is then promoted to production through a second review; with dependency vulnerability monitoring and secrets management.
- Incident response: a documented incident response plan. We notify affected institutions of a data breach as soon as practical and in line with applicable law.
Data storage and retention
- Institutional data (accounts, submissions, recordings, transcripts and evaluations) is kept while the institution’s agreement is active, unless the institution or user asks us to delete it sooner. After the agreement ends, the institution can export its data for up to 90 days, after which we delete it.
- Backups are kept for a limited, rolling period and are overwritten automatically; deleted data disappears from backups when they expire.
- Security and audit logs are kept for up to 12 months.
- Error reports are kept according to our monitoring provider’s retention period.
- AI providers may keep request data for a limited period (up to 30 days) for abuse monitoring, as described in the subprocessor list.
- Website and demo-request data is deleted when it is no longer needed to respond to you, or on request.