← Attainly

Privacy Policy

What Attainly stores about students, faculty, administrators and survey respondents — and what it does with it.

Last updated August 2026.

  1. 01Who is responsible for your data

    Your institution decides what goes into Attainly and who may see it. Attainly holds and processes that data on the institution's instructions and does not use it for any purpose of its own. If you are a student or a member of staff, your institution is the first place to raise a question about your record.

  2. 02What is collected

    All of it comes either from your institution or from what you do in the system. Nothing is bought in, and nothing is inferred about you from outside sources.

    • Account details — name, institutional email address, and optionally a phone number and profile picture. Your password is stored only as a bcrypt hash; it is never stored or emailed in readable form.
    • Enrolment — for students, roll number, programme, department, batch, section and enrolment status.
    • Academic records — assessment marks including per-question results, rubric scores, grades, GPA, attendance, transcripts, and CLO, LLO, PLO and PEO attainment calculated from them.
    • Files — attachments uploaded against an assessment or a course file: original filename, type, size, and which account uploaded it.
    • Messages and preferences — in-app notifications, and the display preferences you set.
    • Sign-in security — one-time verification codes, password-reset links and failed-attempt counters. These carry an expiry and stop working once it passes.
    • A record of changes — see the next section.

  3. 03Changes to marks are logged, with your IP address

    When a mark, grade, result or attainment figure is created, changed or deleted, the system records which account did it, what changed, when, and the IP address and browser user-agent the request came from. This exists because accreditation reviews ask who altered a student’s record and when, and an answer that cannot be evidenced is not an answer. It applies to staff acting on records — not to ordinary browsing — and administrators at your institution can read it.

  4. 04Why it is collected

    To run the outcome-based education workflow your institution operates: recording assessments, computing attainment against programme outcomes, and producing the reports an accreditation panel asks for. That is the whole purpose.

  5. 05What is not done with it

    It is not sold, rented or shared for anyone else’s purposes. There is no advertising. There are no analytics scripts, tracking pixels or third-party cookies in the application — the only cookie set is the one that keeps you signed in.

  6. 06Who else receives it

    One external service, and only for the messages it has to deliver: the email provider your institution configures. It receives the recipient’s address and the content of that message — account-created notices, sign-in verification codes, password-reset links, survey invitations, and replies to the contact form. No academic records are sent through it beyond what appears in those messages. Everything else stays inside the deployment your institution controls.

  7. 07Where it is stored

    In a single database, with uploaded files on the same deployment’s storage. Both live wherever your institution has chosen to host the system, which is its decision to make and to tell you about — including whether that location is inside or outside your country.

  8. 08How long it is kept

    Academic records are kept for as long as your institution’s own retention rules require; they are the reason the system exists, and they outlive a student’s enrolment. Deleting an account removes its dependent records with it. Sign-in codes and reset links expire quickly and cannot be reused afterwards. The retention schedule itself is set by your institution, not by us.

  9. 09How it is protected

    The measures below are built into the software. They do not replace the ones your institution is responsible for, such as securing the server it runs on.

    • Passwords are hashed with bcrypt and are never recoverable, by anyone, including administrators.
    • Sign-in requires a one-time code sent to your email address, in addition to your password.
    • The session cookie is httpOnly and same-site, so scripts cannot read it, and it expires after 24 hours.
    • Repeated failed sign-in attempts are rate-limited.
    • Every account has a role, and every request is checked against it — a student cannot reach another student’s record, and a department administrator cannot reach another department’s.
    • Changes to marks, grades and attainments are written to an audit trail.

  10. 10If you are answering a survey

    Alumni and employers are sometimes invited to complete a survey through a link containing a single-use token — no account is created and no password is needed. Giving your name and email address on that form is optional; leave them blank and your answers are recorded without them. The answers are used to calculate programme-level attainment and are visible to staff at the institution that invited you.

  11. 11Your rights over your record

    Because your institution controls the data, requests go to it rather than to us, and we act on what it instructs.

    • Access — students and staff can see their own record in the portal at any time, and students can download their transcript.
    • Correction — ask your department administrator; marks and enrolment are corrected at source so the attainment figures recalculate.
    • Deletion — your institution decides, and may be required to keep academic records regardless of a request.
    • Objection or complaint — raise it with your institution first; you may also contact your local data protection authority.

  12. 12Changes to this policy

    If the system starts collecting something it does not collect today, or starts sending data somewhere it does not send it today, this page changes first and the date at the top changes with it.

Questions about this document — zevoxsolutions@gmail.com