Privacy policy

1. Overview

This policy describes how Pistachio Technology Inc. (“Pistachio,” “we,” “us,” or “our”) collects, uses, and shares personal information when you use Originis, our secure online exam platform, including our website and desktop applications (the “Service”).

2. Who this policy covers

The Service is offered only to students, faculty, and staff of accredited U.S. higher education institutions who are at least 18 years old and located in the United States. The Service is not directed to individuals under 18 or to users outside the United States.

3. Information we collect

• Account data. When you sign in, we receive identifiers and profile details from our authentication provider (for example, email address, display name, and a unique account identifier).
• Exam and usage data. Information needed to operate exams, including session metadata, answers, submissions, timestamps, and integrity-related signals such as focus events.
• Webcam recordings. Video captured from your webcam during exam sessions, as described in Section 4.
• Technical data. Device, operating system, browser, IP address, and basic network information used to deliver and protect the Service.

4. Webcam capture and exam recordings

The Originis desktop applications for Windows and macOS capture webcam video during exam sessions to support academic integrity. The following describes how that footage is handled.

• When capture occurs. Only during active exam sessions joined through the desktop application. No capture occurs on the marketing website or while the application is idle.
• Purpose. Footage is used solely to review for potential academic misconduct during the associated exam.
• No biometric analysis. We do not perform facial recognition, generate biometric identifiers or templates, or apply any other biometric analysis to the video. Review is performed by authorized Pistachio staff.
• Where it is stored. Recordings are encrypted in transit and at rest and stored in Google Cloud Platform infrastructure located in the United States.
• Who can access it. Access is limited to authorized Pistachio staff with a legitimate need (for example, integrity review or technical support). We may also share footage with your institution, or as otherwise described in Section 7.
• Retention. Recordings are retained for up to 18 months from the date of the exam and are deleted on a rolling basis after that period, unless a longer retention period is required by law, requested by your institution in connection with a pending integrity review, or necessary to defend a legal claim.

5. How we use information

We use the information described above to:

• Provide, maintain, secure, and improve the Service;
• Authenticate users and protect accounts;
• Run exams, generate results, and support instructors;
• Review recordings for potential academic misconduct;
• Detect, investigate, and respond to fraud, abuse, or technical issues;
• Comply with applicable law and enforce our terms.

6. Sub-processors

We rely on the following service providers to operate the Service. They process personal information only as needed to provide their services to us, subject to their own privacy policies and our agreements with them.

• Google Cloud Platform. Hosting, compute, and storage for the Service, including storage of exam recordings.
• Firebase Authentication (Google). Identity and authentication.

7. Sharing and disclosure

We share personal information only as follows:

• With your institution. Exam data (including recordings) may be shared with authorized personnel at the institution administering your exam, for academic, integrity, or records purposes.
• With sub-processors. As described in Section 6, solely to operate the Service.
• Legal. When required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Pistachio, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to customary confidentiality protections.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

8. Education records (FERPA)

Exam records that identify a student and are maintained by or on behalf of a U.S. higher education institution may constitute “education records” under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. Where Pistachio processes such records on behalf of an institution, we aim to do so in a manner consistent with the institution’s FERPA obligations. Students with questions about their FERPA rights — including the right to inspect and review education records — should contact their institution, which is the party responsible for handling such requests.

9. California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the following rights with respect to your personal information:

• Right to know. Request the categories and specific pieces of personal information we have collected about you.
• Right to delete. Request deletion of personal information we have collected, subject to exceptions.
• Right to correct. Request correction of inaccurate personal information.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

We do not sell personal information or share it for cross-context behavioral advertising, so no opt-out of “sale” or “sharing” is required. To exercise rights, email jack@pistachio.support. We may need to verify your identity and may coordinate with your institution where the information is held as an education record.

10. Retention

We retain personal information for as long as your account is active or as needed to provide the Service, meet legal obligations, resolve disputes, and enforce our agreements. Webcam recordings are retained as described in Section 4. Retention periods vary by data type and purpose.

11. Security

We implement administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest for exam recordings and restricted access controls. No method of transmission or storage is completely secure; we encourage you to use strong passwords and protect access to your devices.

12. Your choices

You may revoke camera permission at any time through your operating system, though doing so may prevent you from completing an exam. For questions about exam data held by your institution, including requests to access, correct, or delete education records, contact your institution. For other privacy requests covered by this policy, email jack@pistachio.support.

13. Children’s privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a user under 18 has provided us personal information, contact jack@pistachio.support and we will take appropriate steps.

14. Changes

We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date above. Material changes will be communicated through the Service or by other reasonable means.

15. Contact

Pistachio Technology Inc. — privacy questions may be sent to jack@pistachio.support, or reach us through the Support page.