Contents
Privacy and GDPR - Plugixa Exam
An exam plugin has to store who sat what, when, what they answered and what they scored. This page is what it does with that.
What is stored
- Attempts: who, which exam, when it started and ended, the frozen question set.
- Responses: what they answered, question by question.
- Results: scores, outcomes, and any grader comments.
- For guests: the name and email they gave, and nothing else.
Cookies
One, and only for guests.
A guest who starts an exam is identified by a signed cookie so their paper survives a page reload. It is set when they press Start, never for merely looking at an exam, and it is not used for tracking.
No PHP session is used anywhere. That is a deliberate choice with a visible benefit: a session cookie on every visitor would break page caching for the whole site.
Files candidates hand in
Answers to file upload questions PRO are kept out of the media library. They go in a private uploads directory under an unguessable name, with a deny rule beside them, and are served only through a route that checks who is asking.
A media library attachment would have sat at a public URL that no permission check ever runs on. Coursework handed in for marking is not media.
WordPress’s own tools
The plugin ships GDPR exporters and erasers, so a personal-data request made through Tools -> Export Personal Data or Tools -> Erase Personal Data includes and removes exam data along with everything else. There is no separate process to remember.
What an erasure clears, and whether an attempt is deleted outright or anonymised, is filterable:
plugixa_exam_personal_data_providers
plugixa_exam_erase_attempt_columns
plugixa_exam_erase_attempt_delete
Anonymising rather than deleting is often what you want: it honours the request while keeping the cohort statistics that other people’s results depend on.
External services
The plugin connects to nothing of its own choosing. It loads no fonts from a CDN - the KaTeX fonts for premium maths rendering are bundled and served from your own site - and it does not contact plugixa.com.
| Service | When it is contacted |
|---|---|
| Freemius | Licensing and updates, free and premium |
| AI drafting PRO | Only with a key you enter, to the provider you choose |
| Webhooks PRO | Only to an address you enter |
| LTI 1.3 PRO | Only with a platform you register |
Those last three have no default endpoint. On a site where nobody has configured them, no request is ever made.
Uninstalling
The plugin creates its own tables on activation and removes them on uninstall.
What uninstall removes is filterable through
plugixa_exam_uninstall_capabilities.
Deactivating does not delete anything.
Troubleshooting
| Symptom | Usual cause |
|---|---|
| An export request returned no exam data | The request is matched by email. A guest who used a different address is a different person as far as the tools are concerned. |
| An erasure removed more than expected | The default deletes the attempt. Filter it to anonymise instead. |
| A candidate file is reachable without signing in | It should not be. Check the deny rule survived a server config change. |
| Page caching stopped working site-wide | Personal pages are uncached by design. Check nothing global is embedding the portal. |
What to do next
- Where files and results are shown: Results and Reports.
- The disclosure text for your own privacy page is in the plugin’s
readme.txt, under External services. - Filter any of the above via Hooks.