Privacy notice

What we process

Students have no account, no password and no email address in this test. Access is by code, and a code is tied to a name. Teachers and institution administrators have a separate notice: /org/privacy

• Your name — entered by whoever creates the code: a teacher, an institution or platform staff. They can also add a short note to the code.
• Your answers — what you marked or typed on each question, whether it was correct, how long you spent on it and how many times you changed your mind.
• Your listening choice — if you said you cannot hear the audio and took the listening section as written text, that choice is recorded.
• Your essay — the full text you wrote, its word count and the number of paste events.
• Your speaking recordings — if the exam has a speaking section: your audio, its transcript, word-by-word timing, the measured fluency figures and the AI's assessment.
• Exam signals — your answer about using headphones, how many times you played each listening clip, the number of voices heard in a recording, sound events, the language spoken, a reading-from-a-script signal, the number of upload attempts, and whether your response was flagged for review and why.
• Your result — your number correct, section scores and, where there is one, your essay and speaking score. Platform exams add your CEFR level and exam equivalents. An exam the institution wrote itself has no CEFR level and no equivalents such as TOEFL in its result; the result is a number correct, a percentage and a section breakdown.
• A hash of your IP address — your raw IP address is never written to our database. Only a digest produced with a secret key is kept. Someone without the key cannot work out the address from the digest; we hold the key. It is used to rate-limit failed code attempts from the same address. A copy also stays in your exam record; nothing reads that copy.
• Your browser information — browser and operating system, kept so that audio problems can be diagnosed.
• The code you enter — the code you type is written to the rate-limiting log together with your IP hash.

Why we process it

• To measure your level and show you the result.
• To report your result to the teacher or institution that issued your code.
• To measure how well each question discriminates and retire the ones that do not. This analysis is done in aggregate, not per person.
• To look at the reliability of the exam — flags set by the AI (more than one voice in a recording, reading from a script, an off-topic response and so on) and disagreement between the two scoring passes can put your response on the staff review list. Staff also see the paste count during review. These are signals, not proof; they do not change your score on their own. Separately, an essay that is empty or under 10 words, and a speaking recording that is silent or was never made, also go on the list; the essay gets 0 and the speaking task stays unscored.
• To limit abuse — rate-limiting failed code attempts from the same address.

Legal basis: Article 5(2)(c) of the KVKK, as the processing is directly related to establishing and performing a contract, and Article 5(2)(f), the data controller's legitimate interest.

Who we share it with

Your data is not sold, not used for advertising and not passed to anyone for marketing. These are the parties that can see or process it:

• The institution that gave you your code — if an institution gave you your code, its teachers and administrators see your exam in their panel. The section below lists what they can see.
• Apperable staff — can see all codes, results, answer sheets, essays and speaking recordings from the admin panel. They can change essay and speaking scores by hand, have them rescored, and reset and reopen the speaking section. Resetting deletes the earlier recording and its transcript. They can also enter an institution's panel to give support.
• Supabase — database and file storage. Data is held in the Frankfurt (Germany) region.
• Vercel — application hosting and visit statistics. Server region Frankfurt. Statistics are cookieless and do not identify you: which page was opened, which site you came from, country and device type. The result key and exam ID in the page address are masked before anything is sent.
• Anthropic — ESSAY AND SPEAKING SCORING. The essay you write, and the TRANSCRIPTS of your speaking recordings, are sent to Anthropic's AI service to be scored. Your name and your code are not sent with them.
• fal.ai, ElevenLabs, OpenRouter and Google — PROCESSING OF SPEAKING RECORDINGS. If you take the speaking section, your AUDIO RECORDING is sent through fal.ai for two jobs: to the ElevenLabs Scribe model for transcription, and through OpenRouter to the Google Gemini model to assess pronunciation and intonation. Your name and your code are not sent with it.
• GitHub — the nightly backup is taken on GitHub's servers. Before it is encrypted, the dump sits there unencrypted for a short time and is restored there to verify it. The stored file is encrypted, but the encryption key is also in GitHub Secrets. The backup file is kept on infrastructure in the US.

TRANSFER ABROAD. All the servers that hold and process the data, and the nightly backups, are outside Türkiye. Supabase holds your data in Germany (Frankfurt). On Vercel the application server runs in the Frankfurt region; that setting does not decide where visit statistics and platform logs are kept. Anthropic and fal.ai are US-based providers, and your essay text, the transcript of your speaking and your audio recording are sent to them. Your audio recording also goes through fal.ai to ElevenLabs, OpenRouter and Google services. The encrypted database backup sits in the US, on GitHub's infrastructure. Such transfers fall under Article 9 of the KVKK and are made only to run the service, for the purposes set out above.

What the institution that gave you your code can see

This section applies if an institution gave you your code. All of its teachers and administrators can see the following in their panel. You do not have to share anything for that.

• Code and exam details — your name, your code, the note on the code, the exam's title, language and status, your start and submission times and how long you took. If you took the listening section as written text, that choice is shown too.
• Your result — your number correct, section scores, your correct answers by difficulty and how many questions you did not reach. Platform exams also show your CEFR level and how confident that result is.
• Your answer sheet — what you marked on each question, the correct answer, how long you spent on it and how many times you changed your mind.
• Your essay — the full text, its word count, your score and the AI's short assessment.
• Your speaking section — they can listen to your recording in the panel and see its transcript and your score. Once the audio file is deleted it can no longer be played; the transcript and the score stay.
• Your result page — they can open the same result page you see from the panel.
• CSV file — the institution can download results as a spreadsheet file. It holds your name, your code, exam and status details, whether you took the listening section as written text, your start and submission times, how long you took, your number correct, how many questions you did not reach, your CEFR level, confidence level and essay score where there is one, whether your essay was flagged for review, and the address of your result page. The essay text and the answer sheet are not in the file, but the result address opens them.
• Score changes — on an exam it wrote itself, the institution can change your essay and speaking scores by hand and add a note. Your result page then shows the changed score and no longer shows the AI's feedback. The note is not shown to you. On platform exams the institution sees the score but cannot change it.

Your IP hash and browser information are not shown in the institution panel. When the institution downloads the CSV, that is written to the audit log; looking at this information or listening to your recording is not. Files the institution downloads stay with the institution; the retention and deletion rules below do not reach those copies.

How long we keep it

Your name and the note on your code are deleted once 24 months have passed since your last exam on that code. On a code that was never used, the period starts when the code is created.

Free text and browser traces are counted separately for each exam. Once 24 months have passed since that exam, your essay text, the transcript of your speaking and its word timing, the AI's feedback, the note of anyone who changed a score by hand, your IP hash and your browser information are deleted. A job that runs every night does this.

UNNAMED RECORDS REMAIN. Your answers (including short typed answers), your listening choice, scores, bands, timings, fluency figures, word and paste counts and exam signals are not deleted. Your code and result link stay too. Because the file the institution downloaded earlier holds your name and code side by side, whoever keeps that file can still match the record to you.

AUDIO RECORDINGS ARE KEPT FOR A MUCH SHORTER TIME. A scored audio file is deleted 90 days after scoring; rescoring restarts that period. A file that was never scored is deleted 90 days after the exam closes. A recording sent for review waits until it is reviewed. Above all of this there is an absolute limit: 365 days after the recording was made the file is deleted, even if review has not finished. A half-finished upload is deleted at least 7 days after the exam closes. These jobs run every night. When the audio file is deleted the transcript stays and goes with the 24-month period above.

YOUR VOICE IS NOT USED TO VERIFY WHO YOU ARE. No processing identifies you from the recording. The number of voices heard, background speech, sound events such as laughter and the language spoken are marked; pronunciation and intonation are scored.

Rate-limiting logs are deleted much sooner.

BACKUPS. Encrypted nightly backups of the database are kept for 90 days. Data deleted from the records can stay in these backups for that time. Encrypted backups taken by hand are kept on the operator's own computer or disk; those older than 30 days are deleted when a new one is taken. Audio files are not in the backups.

Your result link

YOUR RESULT LINK IS A KEY. The address of your result page contains a long random value and asks for no login, so anyone you give the link to can see your name, your answer sheet and your essay. If an institution gave you your code, it can already reach this link from its panel. Keep that in mind before sharing it.

The link does not expire. It keeps opening after your name is deleted at 24 months. The only way to close it is an erasure request.

Cookies

There are no advertising or tracking cookies on this site. The cookies in use are functional only:

• Exam session — to remember which exam you are taking. It cannot be read by scripts on the page (httpOnly). Once the exam is over it does not let you back in. It is renewed when the exam starts and each time you enter a section. It is removed 3 hours after the last renewal or 1 hour after the exam's end time, whichever is later. During that time the same browser can get your result link again.
• Language preference — to remember which language you are reading the site in.
• Panel session — only for teachers, institution administrators and admin panel users.
• Browser storage — not a cookie, but worth knowing: the code you enter stays in the browser's session storage until the tab is closed, and your theme preference stays in permanent storage. Both remain on this device.

Your rights

Under Article 11 of the KVKK you can contact the data controller to:

• Learn whether your personal data is being processed, and request information about it.
• Learn the purpose of the processing and whether the data is used in line with that purpose.
• Know the third parties to whom the data is transferred, in the country or abroad.
• Ask for incomplete or inaccurate data to be corrected.
• Ask for your data to be erased or destroyed, within the limits of the law.
• Ask that corrections and erasures be notified to the third parties the data was transferred to.
• Object to an adverse result reached solely through automated analysis of your data.
• Claim compensation for damage caused by unlawful processing.

How to reach us

Send your request to info@apperable.com. It will be concluded within thirty days at the latest.

Include your code or your result link in the request. There is no account or email, so we have no other way to verify you.

Erasure and correction requests are handled by hand. The institution panel has no erase function; if an institution gave you your code you can also apply to it, and it will pass the request on to us.

What happens when you ask for erasure

Staff delete the data tied to your code from the admin panel. This cannot be undone.

• Deleted — your name, the note on the code, your essay text, your audio files, the transcript of your speaking and its word timing, the number of voices, sound events, the language spoken, the reading-from-a-script and upload signals, your short typed answers, the AI's feedback, the note of anyone who changed a score by hand, your IP hash and your browser information.
• Link and code — your result link closes and the code can never be reopened. If you have an exam in progress it is closed.
• What remains — the code row, the credit record, your scores, bands, the options you marked, timing and fluency figures, word count, your listening choice, your headphones answer, clip play and paste counts, and review flags and their reason (for example "more than one voice"). Your name is not in these records and they appear without a name in the institution panel. The erasure is written to the audit log without your name.
• Backups — deleted data stays in backups and goes when the backup expires. For nightly backups that is 90 days.
• Providers — content already sent to Anthropic, fal.ai, ElevenLabs, OpenRouter and Google is not deleted by this. The erasure covers only our own database and file store.
• Rate-limiting log — your IP hash and the code you entered are not deleted by this; they go on their own within two days at the latest.
• Files held by the institution and staff — files downloaded earlier are not deleted. They hold your name and code side by side. Because the code stays in the panel, whoever keeps such a file can match the remaining record to you.

This is not an official exam result

A platform exam is a placement test. The TOEFL, IELTS, PTE and Cambridge figures it reports are estimated ranges, not official scores, and cannot be used to apply anywhere. An exam the institution wrote itself does not report these figures at all. We are not affiliated with any examination body.