Privacy Policy

Last updated 15 October 2026

One Spot is an assessment platform. This policy explains what we collect, why, how long we keep it, and what you can ask us to do with it. It covers both the people who run assessments (customers) and the people who sit them (candidates).

What we collect

• Account data. Name, work email, company name, and password hash for customers.
• Candidate data. Name and email supplied at the point of joining an assessment, plus the answers submitted and the score produced.
• Integrity data. Where the assessment owner has enabled proctoring: webcam recording of the session, tab-switch and fullscreen-exit events, and camera or microphone permission changes, each timestamped against the attempt.
• Technical data. IP address, browser and device information, and timestamps, used for security, abuse prevention and duplicate-identity detection.
• Billing data. Plan and transaction references. Card details are handled by our payment processor and are never stored on our servers.

Why we collect it

To deliver the assessment, to produce a result the assessment owner can rely on, to detect fraud and impersonation, to bill for the service, and to keep the platform secure. We do not sell personal data and we do not use candidate recordings to train models.

Who the data controller is

For candidate data, the organisation that created the assessment is the controller and One Spot is the processor acting on its instructions. For customer account data, One Spot is the controller. Candidates with a question about an assessment they sat should contact the organisation that invited them in the first instance.

How long we keep it

• Session recordings are stored with our media provider and pruned automatically on a retention schedule. The default retention is short and the assessment owner can shorten it further.
• Assessment results and answer sheets are retained for as long as the customer's account is active, because they are the record of the assessment.
• Account and billing records are retained for as long as required by law after the account closes.

Where data is processed

Our servers are hosted in the European Union. Email delivery and media storage are handled by third-party processors under contract. Transfers are protected by the standard contractual terms those providers offer.

Security

All traffic is encrypted in transit over HTTPS. Access to production data is limited to staff who need it. Passwords are stored hashed, never in plain text. Sessions are protected with token authentication and rate limiting.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it. Email support@onespothq.com and we will respond within 30 days. If a request concerns an assessment run by one of our customers, we will pass it to that customer and support them in answering it.

Cookies

We use cookies and local storage only to keep you signed in, to remember interface preferences, and to protect forms against cross-site request forgery. We do not run third-party advertising trackers.

Changes

If we change this policy we will update the date at the top of this page, and we will tell account holders by email where the change is material.

Contact

Questions about this policy: support@onespothq.com.