Privacy Policy

Last updated: 12 September 2026

This policy explains what Vyvir does with personal data, why, and what rights you have. We have written it to be read, not to be survived.

Woyono Limited, Manchester, is the data controller for the Vyvir website and for accounts we provide directly. Where an institution or educator uses Vyvir to assess learners, that institution or educator is the controller for assessment data, and we act as their processor.

Our starting position

Three principles shape everything below.

Source work stays where it belongs. Wherever it is technically and operationally feasible, original learner submissions remain within the learner’s or the institution’s environment rather than being copied to us.

We take the minimum we need. Only the information required to conduct meaningful questioning crosses the boundary into our service.

Practice stays private. Practice Mode is a private, developmental space. Practice content never feeds formal assessment.

What we collect

Account information. Name, email address, role, organisational memberships and authentication details.

Assessment information. Assessments assigned to you, questions asked, responses given, evidence provided, transcripts where enabled, attempt and retake records, session timings and outcomes recorded by your educator.

Session integrity information. Where your institution enables it, a small number of still images captured at unpredictable intervals during a formal assessment, together with a session event timeline covering starts, interruptions, reconnections and completion.

Accessibility preferences. Interface settings you choose, and any adjustments authorised by your institution.

Technical information. Device and browser information needed to run the session, diagnose failures and secure the platform.

Website information. Basic, cookie-free analytics about how the public website is used, and anything you send us through a form or email. When you book a demo, the details you enter are delivered to our team through an email or workflow service provider acting on our instructions, and are used only to arrange and follow up the demo.

What we do not do

We do not use captured images for emotion detection, personality analysis, biometric profiling unrelated to assessment or any form of identity analytics beyond confirming the authorised candidate.

We do not sell personal data. We do not use learner assessment content for advertising.

We do not make automated decisions that produce legal or similarly significant effects. Evidence indicators are not decisions. Every academic outcome is recorded by an authorised human being.

Why we process it

To provide the service you or your institution have asked for. To conduct and support assessment. To evidence assessment integrity where your institution’s policy requires it. To keep the platform secure and reliable. To meet our legal obligations. To improve the product using aggregated and de-identified information.

Our lawful bases are performance of a contract, legitimate interests in operating and securing the service, legal obligation, and, where an institution relies on it, the public task or consent your institution has established.

Who can see what

Your educator sees the assessments they own, your responses to them and the associated evidence.

Your institution sees the records it owns, under the roles and permissions it has configured.

Moderators and quality assurers see the evidence your institution authorises them to review.

Other organisations you belong to see nothing. Where you study with more than one institution, those relationships are kept separate, and consolidating accounts never merges data permissions between them.

We access assessment content only where it is necessary to operate, support or secure the service, under controlled and logged conditions.

We use a small number of carefully selected service providers for infrastructure, storage and communications. They act on our instructions and under contract.

How long we keep it

Retention for assessment and integrity records is set by the institution that owns them, under its own policy and any awarding body requirements.

Account data is kept while your account is active. Website enquiry data is kept only as long as needed to deal with the enquiry.

Where we hold data as a processor, we delete or return it on instruction from the controlling institution.

Where it is stored

Data is stored in Europe. Where any transfer outside that region is necessary, we use the safeguards required by applicable data protection law.

Security

We use encryption in transit and at rest, least privilege access, tenant separation, restricted access to integrity evidence, and audit logging of significant events. Access to assessment records is controlled and recorded.

Your rights

Depending on where you live, you may have the right to access your data, correct it, request erasure, restrict or object to processing, obtain a copy in a portable format, and withdraw consent where consent is the basis for processing.

If your data is held by your institution, contact them first, as they control it. If you are unsure, contact us and we will point you to the right place.

You also have the right to complain to your data protection authority. In the UK, that is the Information Commissioner’s Office.

Cookies

The Vyvir website does not set advertising, tracking or other non-essential cookies. Where we measure how the website is used, we use privacy-friendly analytics that work without cookies and do not identify individual visitors. If we ever introduce optional cookies, we will ask for your consent first and give you a way to change your choice at any time.

Children and young people

Where Vyvir is used with learners under the age of majority in their country, the institution or educator providing the account is responsible for the authorisations its law requires. We support institutions in meeting those obligations and apply appropriate safeguards to the data involved.

Changes to this policy

We will update this policy when our practices change and will tell you about material changes before they take effect.

Contact

Privacy enquiries and data rights requests
[email protected]