Privacy Policy

Last updated 26 July 2026

NexaProva is an HSK mock-exam service operated by Hanzi Express, LLC. This policy explains what we collect when you use it, why we collect it, who else sees it, and how to get it removed. It covers nexaprova.com and the NexaProva app.

What we collect

Only what the service needs to work. Specifically:

• Account details. Your email address, and a display name if you choose to give one. Your password is stored only as a cryptographic hash — we cannot read it.
• Exam activity. The papers you sit and the answers you give, along with scores, timings, and which questions you have already seen. The last of these is what lets us avoid repeating questions in your future papers.
• Written and spoken responses. The text you write in the writing and translation tasks, and, if you sit the speaking test, the audio you record and its transcript.
• Subscription status. Whether you have an active plan and when it renews. Card details are handled entirely by our payment processor and never reach our servers.
• If you sign in with Google. We receive your email address, your name, and the permanent identifier Google uses for your account. We keep that identifier so the link to your account survives you changing your Google email address. We ask Google for nothing else: not your contacts, your calendar, your files, or your photo, and we never receive your Google password. Signing in this way is optional, and creating an account with an email address and password asks Google nothing at all.

We do not ask for your date of birth, address, phone number, or any government identifier, and you do not need an account to sit a free mock exam.

Why we collect it

• To create your account, sign you in, and keep your session secure.
• To mark your papers, show your results, and keep your reports available afterwards.
• To assemble fresh papers that do not repeat questions you have already answered.
• To take payment and give you access to the features your plan includes.
• To send transactional email: verification, receipts, and account notices.

Who else sees it

We do not sell your data, and we do not share it for advertising. We use a small number of processors that handle specific parts of the service on our behalf:

• An AI provider receives the text of your open writing and translation answers so they can be marked against the official rubric, and returns the feedback you see. It is sent for grading only.
• A speech provider receives your recorded audio, if you sit the speaking test, to produce a transcript for grading.
• Stripe processes payments. Your card details go directly to Stripe; we receive only your subscription status.
• An email provider delivers verification and account email.
• Google Analytics receives which pages are viewed, along with the coarse location, device and referring site that any web analytics records. It never receives your answers, your results, or the address of an individual exam attempt.

We may also disclose information where the law requires it, or to protect the service and its users from abuse.

Cookies

We set a signed session cookie that keeps you logged in. It is HTTP-only, so scripts on the page cannot read it, and clearing it signs you out.

Google Analytics sets its own cookies to count visits and tell a returning visitor from a new one. We use it to see which pages people find and where they arrive from. We do not use advertising or cross-site tracking cookies, and we do not sell your data.

We never send Google the address of an exam you are taking. Those addresses contain an identifier for your individual attempt, so we replace it before anything is reported.

How long we keep it

Your account and your saved papers stay until you delete them or ask us to close your account. Exam attempts sat without an account are not tied to you and are not retained as personal data. If you close your account, we delete your personal details and your saved attempts; we may keep billing records where tax or accounting law requires it.

Your rights

You can ask us for a copy of the personal data we hold about you, correct it, or have it deleted. Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your data-protection authority. To exercise any of these, email support@nexaprova.com from the address on your account, and we will respond within 30 days.

Where your data is processed

Hanzi Express, LLC is incorporated in the State of Delaware, United States. Your data is processed in the United States and in other countries where the processors listed above operate. If you are in the UK, the EEA, or another region with data-transfer rules, using NexaProva means your data is transferred outside that region, and we rely on the standard contractual protections our processors provide.

Security

Passwords are hashed, session cookies are signed and HTTP-only, and payment details never touch our servers. No service can promise perfect security, but we do not keep data we do not need, which is the most reliable protection there is.

Children

NexaProva is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us information, email us and we will remove it.

Changes

If we change this policy we will update the date at the top of this page, and for significant changes we will tell account holders by email.

Contact

The data controller is Hanzi Express, LLC. Write to us by email or by post: