Subprocessors
Last updated: 2 October 2026
These are the outside services that handle data for MegaExams (operated by Goodfit Software LLC). We do not use any other service providers to process student data. We will tell school account owners by email at least 30 days before we add a new subprocessor that receives student data, so a school can object.
| Provider | Purpose | Data it receives | Location |
|---|---|---|---|
| DigitalOcean | Hosting: our one application server, database and file storage. | All application data and uploaded files, including student records, answers and photos. | India (Bangalore, BLR1) |
| OpenAI | AI question writing and importing questions from teacher uploads. Suggested scores for typed essay answers. | Teacher uploads and prompts. For essay scoring: the question, rubric and the student's typed answer text (no name or email). OpenAI does not use API data for training. | USA |
| Resend | Sending email: sign-in codes, exam invitations, notifications. | Recipient email address and the message content. | USA |
| Microsoft Clarity | Usage analytics (clicks, scrolls, page layout) so we can fix confusing screens. | On teacher and student pages all text, inputs and images are masked, so Clarity sees page structure and interactions only. Also IP address and browser details. Marketing pages are not masked. | USA |
| Google Fonts (page fonts). reCAPTCHA spam check on the teacher sign-up page. Google Classroom, only if a teacher connects it. YouTube and Google Drive video players, only if a teacher adds a video lecture to a course. | Fonts, players: IP address and browser details. reCAPTCHA: the sign-up visitor's browser signals. Classroom: class rosters (names, emails) read from Classroom, and grades sent back, as the teacher directs. | USA | |
| jsDelivr and the Tailwind CSS CDN | Delivering standard page code and styles. | IP address and browser details only. | Global CDN |
What is not on this list
IP geolocation runs on our own server using the DB-IP Lite database, so no IP address is sent to any third party for it. IP geolocation by DB-IP (https://db-ip.com). Backups stay on our own server. We do not use advertising networks or data brokers.
Controls
A school can turn AI processing off; then no student answer is ever sent to OpenAI. Google Classroom and video lectures are used only when a teacher chooses them. Webcam photos and answer photos stay on our DigitalOcean server and are not sent to any other provider.
Questions
Email prasanth@megaexams.com. See also our student data privacy page, privacy policy and security page.