Legal Corner

These Terms of Use govern access to the Stima Prova assessment platform. They are entered into between Milkis Strategic Partners LLC, an Arizona limited liability company of 378 W Foothill St, Apache Junction, AZ 85120 ("Stima", "we", "us"), and the organisation identified on the order form ("Customer", "you").

The Service is used in two contexts. In the hiring context, an employer invites a job applicant to complete a work task. In the education context, an educational institution or an instructor invites a student to complete a work task as part of a course, programme or credential. Most of these Terms apply to both. Where a clause applies to only one, it says so.

Three instruments make up the framework. These Terms bind Customer. The Participant Terms bind each Participant directly and are accepted before the assessment opens. The Privacy Policy describes how Stima processes personal data in each of its roles. Schedule 1 sets out the screens the Service presents to every Participant, in a hiring variant and an education variant, and the requirements Stima holds itself to in operating them.

1Definitions

"Service" means the Stima Prova assessment platform and related interfaces, documentation and support.

"Customer" means the organisation that subscribes to the Service under an order form.

"Authorised User" means a Customer employee, contractor or instructor permitted by Customer to access the Service.

"Participant" means an individual who completes an assessment through the Service at Customer's invitation.

"Candidate" means a Participant assessed in connection with recruitment or employment.

"Student" means a Participant assessed in connection with a course, programme or credential offered by Customer as an educational institution.

"Assessment Context" means, for a given campaign or assignment, whether it is a hiring context or an education context. Customer sets it and warrants that it is accurate.

"Participant Terms" means the agreement between Stima and each Participant, presented in full and accepted by the Participant before the assessment opens. The current version is at https://mystima.io/participant-terms and is incorporated into these Terms by reference. Stima will give Customer 30 days' notice of any change to it.

"Assessment Data" means work products, responses and submissions a Participant creates during an assessment.

"Interaction Record" means process data captured during an assessment, including prompts sent to AI models, the model and capability tier selected, edits made after model output, content copied from model output into the Participant's work, responses the Participant discarded or regenerated, verification actions, periods of inactivity, and the distribution of time across the session.

"Results" means the scores, levels, calibration measures and reports the Service generates from Assessment Data and Interaction Records.

"Model Vendor" means a third party whose AI models the Service makes available to Participants or uses to generate Results, listed at Schedule 2.

"Sub-processor" means a third party engaged by Stima to process personal data in connection with the Service, listed at Schedule 2.

"De-identified Data" means data produced by the procedure at clause 6.2 from which direct and indirect identifiers have been removed such that it can no longer reasonably be attributed to an identified or identifiable natural person, and which Stima undertakes not to attempt to re-identify.

"Aggregate Research" means research and publication using De-identified Data and statistics derived from it, under clause 6.3(a). Aggregate Research does not involve publication of any individual session.

"Session Research" means research and publication using a Participant's session record in a form that is not De-identified Data, under clause 6.3(b), and only with that Participant's consent.

"Education Records" has the meaning given by the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g, and its implementing regulations.

2The Service

2.1Stima grants Customer a non-exclusive, non-transferable, non-sublicensable right to access and use the Service during the subscription term for Customer's internal assessment purposes in the Assessment Context it has set.

2.2The Service produces Results intended to inform human judgement. The Service does not make hiring decisions and does not assign grades. Customer is solely responsible for every employment decision and every academic decision it takes.

2.3The Service is available only to Participants aged 18 or over. Customer will not invite or assign an assessment to any person under 18, including where an under-18 person is enrolled in a course through dual enrolment, early admission or an equivalent arrangement. The Service does not knowingly process the personal data of anyone under 18, and consent to Session Research is never sought from anyone who has not confirmed they are 18 or over.

2.4Stima may modify the Service. Stima will not materially degrade core functionality during a paid term.

3Accounts and access

3.1Customer is responsible for the confidentiality of Authorised User credentials and for all activity conducted under its account.

3.2Customer will notify Stima without undue delay on becoming aware of any unauthorised access.

3.3Participants do not hold accounts. Participant access to a session, and to a result page, is by single-purpose token, or, where the Service is used through a learning management system, by the identifier that system supplies. Customer will not share, reissue or attempt to reuse a Participant token.

4Customer responsibilities

4.1Customer will:

(a) use the Service only for the lawful assessment of Participants, and in the hiring context only for roles Customer is genuinely recruiting for;

(b) notify Participants in advance that an automated or AI-assisted tool will be used in the assessment, before the assessment begins, where any applicable law requires such notice;

(c) not suppress, bypass, pre-complete, alter or reorder the Participant Terms or the notice and consent screens the Service presents, and not prevent a Participant from reading them;

(d) maintain meaningful human review of any adverse decision informed by Results, and provide each affected Participant with any explanation, reconsideration route, appeal, or record retention that applicable law or Customer's own academic regulations require;

(e) not use Results as the sole basis for an adverse decision, not configure any automated rejection on the basis of a Result, and in the education context not treat a Result as a grade;

(f) in the hiring context, where required by applicable law, inform and consult employee representatives before putting the Service into service;

(g) not invite or knowingly permit any person under 18 to take an assessment;

(h) not attempt to re-identify De-identified Data, reverse engineer the Service, or use the Service to develop a competing product;

(i) not represent to Participants that consent to Session Research is required, expected, beneficial to their application or their standing on a course, or visible to Customer;

(j) set the Assessment Context accurately for each campaign or assignment, and notify Stima before changing it.

4.2Customer acknowledges that obligations under laws including the EU Artificial Intelligence Act, the Colorado Artificial Intelligence Act (SB 26-189), New York City Local Law 144, the Illinois Human Rights Act as amended by HB 3773, the Illinois Biometric Information Privacy Act where the optional identity check is enabled, the California Consumer Privacy Act, the Family Educational Rights and Privacy Act, UAE Federal Decree-Law No. 45 of 2021, and DIFC Data Protection Law No. 5 of 2020 together with DIFC Regulation 10, may attach to Customer in its capacity as deployer, controller or educational institution, and that Customer is responsible for its own compliance. Stima will provide the documentation described in clause 7 to support that compliance.

Customer further acknowledges that Annex III of the EU Artificial Intelligence Act treats both recruitment and candidate evaluation, and the evaluation of learning outcomes and admission to educational institutions, as high-risk uses, so that the education context is not outside that regime.

4.3Hiring context only. Where Customer uses the Service to assess Candidates for a position located in, or performed in, New York City, Customer is responsible for commissioning the independent bias audit and publishing the summary of results required by New York City Local Law 144, and for the Candidate notice that law requires. Stima will supply, on request and without charge, the selection and scoring data for Customer's own campaigns in a form suitable for an auditor. Stima does not perform that audit and does not hold itself out as an independent auditor of it.

4.4Education context only. Customer:

(a) warrants that its use of the Service is consistent with its own academic integrity policy and that the policy permits the use of AI tools in the manner the assessment allows;

(b) warrants that, where it is subject to FERPA, it has specified criteria for school officials and legitimate educational interest in its annual FERPA notification, and that those criteria cover Stima;

(c) will make its appeal route available to any Student who disputes a Result, and will not treat a Result as determinative of an academic integrity allegation;

(d) will set, on the order form, when a Student's result page is released to them: on scoring, or after an instructor has reviewed it. Stima defaults to release on scoring, and the Student-facing screens state which setting applies;

(e) acknowledges that no research of any kind is performed on Student sessions unless Customer has signed the Research Annex described in clause 6.3(i).

5Roles under data protection law

5.1In respect of Assessment Data, Interaction Records and Results processed in order to deliver assessments to Customer, Customer is the controller and Stima is the processor. The Data Processing Addendum at https://mystima.io/dpa applies and forms part of these Terms.

5.2Where DIFC Regulation 10 applies, Customer is the Deployer and Stima is the Operator, and each party will perform the obligations attaching to that role. Customer acknowledges that use of the Service for the evaluation of individuals in a recruitment or educational context is capable of amounting to High Risk Processing under that Regulation, and that the Deployer bears primary accountability for the deployment. The order form states which party appoints the Autonomous Systems Officer, or whether Stima holds Regulation 10 certification.

5.3In respect of Session Research under clause 6.3(b), Stima acts as an independent controller. Customer does not direct that processing and has no right to the identity of the reviewers engaged under clause 6.3(h). Stima is accountable to the Participant for it, not to Customer.

In the hiring context Customer has no right to object to that processing. In the education context Customer controls whether it happens at all, through the Research Annex at clause 6.3(i), and may withdraw that Annex on notice, in which case Stima stops. Within the scope Customer has agreed there, Stima still acts as independent controller and Customer still does not direct the research itself.

5.4In respect of the creation of De-identified Data under clause 6.2, which is itself an operation on personal data, Stima acts as controller of that operation, with Customer's authorisation under clause 6.2 and the licence each Participant grants under the Participant Terms. De-identified Data, once created, is not personal data. Aggregate Research under clause 6.3(a) operates on De-identified Data only, so no party is a controller of it and no data protection legal basis is required for it.

5.5In respect of the Participant Terms, the Participant result page, and requests a Participant makes to Stima about their own data, Stima acts as controller for those limited purposes, as described in the Privacy Policy.

5.6Education context only. Where Customer is an educational institution subject to FERPA, and Customer has designated Stima as a school official in its annual FERPA notification under clause 4.4, Stima acts as a school official with a legitimate educational interest in Education Records disclosed to it. In that capacity Stima performs a service Customer would otherwise perform with its own employees, is under Customer's direct control with respect to the use and maintenance of those records, and will not redisclose them except as Customer directs or the law requires.

That capacity and the independent-controller capacity at clause 5.3 cannot operate on the same records at the same time. Clause 6.3(i) resolves the conflict by switching research off in the education context unless Customer has separately agreed to it in writing.

6Use of data

6.1To provide the Service. Stima processes Assessment Data, Interaction Records and Results in order to operate, secure and support the Service, on Customer's documented instructions. Those instructions include quality assurance of Results generated for Customer's own campaigns and assignments, which may involve blind scoring of a session by Stima personnel and comparison against the Service's output. Personnel performing that work are bound by confidentiality and see only what the task requires. Work directed at validating Stima's scoring methods generally, rather than at a Customer's own Results, is performed on De-identified Data under clause 6.2.

6.2De-identification and product improvement. Stima creates De-identified Data from Assessment Data and Interaction Records and uses it to operate, evaluate, secure, calibrate and improve the Service, including the validation of scoring models, and for Aggregate Research under clause 6.3(a).

Customer authorises that creation and use, and grants Stima a non-exclusive, perpetual, irrevocable, royalty-free right in respect of any Customer content it comprises. Each Participant grants Stima the corresponding right in respect of their own Assessment Data and Interaction Record under the Participant Terms, on the same terms and for the same purposes. De-identified Data does not constitute Customer Confidential Information.

De-identification is not automated pattern matching alone. Stima operates a documented procedure comprising automated removal of direct identifiers, automated detection of indirect identifiers in free text including personal names, employer names, institution names, course names, project names and client names, and a human review pass before any record enters a research or improvement set. Stima maintains a written record of that procedure and of its version history, and will make it available to Customer on request.

Where a record cannot be brought to the De-identified Data standard by that procedure, it is not used for Aggregate Research and is used for Session Research only under clause 6.3(b).

A Participant who objects to the creation of De-identified Data from their session is excluded from it, provided the objection reaches Stima before the campaign or assignment closes. De-identification does not run on any session before that point, so that is the window, and the Participant Terms state it. Once created, De-identified Data is no longer attributable to that Participant and cannot be withdrawn from the set, which the Participant Terms state before the assessment begins.

6.3Research. Stima conducts methodological research into assessment design and the measurement of human-AI collaboration, and publishes the results of that research.

(a) Aggregate Research. Stima may use De-identified Data, which is not personal data, for research and may publish aggregate findings and statistics derived from it. No Customer, Participant, role, course or organisation is identified, and no individual session is published. This does not depend on Participant consent and is disclosed to every Participant in the assessment notice at Schedule 1 Part 2.

(b) Session Research. Where research requires a session record in a form that is not De-identified Data, Stima uses that record only in respect of Participants who have given explicit consent, separately recorded, through the consent screen at Schedule 1 Part 3. That consent is optional, is not a condition of taking or completing an assessment, has no bearing on Results or on any grade, is not disclosed to Customer, and may be withdrawn at any time.

(c) Customer will not suppress or interfere with the consent screen and will not request disclosure of which Participants consented. Stima will not disclose it, including in aggregate at a granularity that would permit identification of an individual Participant's answer.

(d) Research outputs may include published papers, conference proceedings and published datasets. A published dataset contains only the session records of consenting Participants, processed as described in Schedule 1 Part 3. No individual session derived from a non-consenting Participant is published in any form; publication from De-identified Data is limited to aggregate findings and statistics.

(e) Stima will record, for every Participant and every session, the answer given to the consent question, the timestamp, and the identifier of the exact version of the wording displayed, including where the answer was a refusal or a non-answer. Superseded versions of that wording are retained.

(f) Stima will obtain ethics review of any Session Research before submission for publication, through an institutional review board, an independent ethics review service, or the review process of the publication venue, and will record which route was used for each output.

(g) Consent to Session Research is recorded per session. It does not carry over to any subsequent assessment, and it is never sought from a person who has not confirmed they are 18 or over.

(h) Session records used in Session Research are read by Stima's researchers and by independent academic reviewers and collaborators engaged for scoring-agreement studies. Stima engages such a reviewer only under a written agreement imposing confidentiality, use restrictions limited to the study, a prohibition on re-identification and on onward disclosure, and a return or destruction obligation, and only where a lawful transfer mechanism is in place. Reviewers receive no Participant contact details.

(i) Education context only. Research is off by default. Neither Aggregate Research nor Session Research is performed on any session generated in the education context unless Customer has signed a Research Annex. Absent that Annex, Stima uses a Student's session solely to deliver the assessment to Customer, including the quality assurance of that Student's own Results described in clause 6.1, and to support and secure the Service. No De-identified Data is created from it, it is not used to validate Stima's scoring methods generally, and the consent screen at Schedule 1 Part 3 is not shown.

Where a Research Annex is in place, it governs which of the two activities is permitted, the de-identification standard applied, which institutional approvals are required, the destruction obligations, and Customer's right to withdraw from it. Then:

• Aggregate Research may proceed on Student sessions, on the de-identification standard the Annex sets. It does not require individual Student consent, because it operates on data that is no longer personal and is no longer an Education Record.
• Session Research requires both the Annex and the Student's own consent under clause 6.3(b). Neither alone is sufficient, on any route.

Stima does not rely on, and does not ask Customer to rely on, the studies exception at 34 C.F.R. 99.31(a)(6). That exception is available only for a study conducted for or on behalf of the institution, and Stima's research is methodological, conducted in its own name and published by Stima. The Annex operates on de-identification and on Student consent instead.

A Research Annex applies only to sessions started after it is signed. Signing it does not sweep in the session of a Student who was told, before starting, that their work would not be used for research.

6.4Restrictions on Stima. Stima will not:

(a) sell, rent or license Assessment Data, Interaction Records or Results;

(b) use Assessment Data, Interaction Records or Results to train, retrain or fine-tune the weights or parameters of any artificial intelligence model, whether Stima's own or a third party's;

(c) disclose an individual Participant's data to any third party except as instructed by Customer, as required by law, as necessary to a Sub-processor listed at Schedule 2 or a reviewer engaged under clause 6.3(h), or as permitted by that Participant's consent;

(d) use Assessment Data, Interaction Records or Results to build a profile of a Participant for any purpose other than producing that Participant's Results, or to market to a Participant;

(e) operate a candidate pool, talent marketplace or similar product in which Participants are made discoverable to any employer or institution other than the one that invited them.

For the avoidance of doubt, the Service generates Results by prompting Model Vendor models against Stima's rubrics. Nothing in clause 6.4(b) prevents Stima from using De-identified Data to design, evaluate, calibrate and test its own scoring methods, rubrics, prompts and evaluation sets, provided no model weights or parameters are trained or fine-tuned on Assessment Data, Interaction Records or Results.

6.5Model Vendors. Prompts a Participant sends during a session, and the resulting model output, are transmitted to the Model Vendors listed at Schedule 2 under terms that prohibit use of that content to train the vendor's models and that limit retention to abuse monitoring. Stima will not engage a Model Vendor on terms that lack those protections. Stima will give Customer at least 30 days' notice before adding or replacing a Model Vendor or Sub-processor, and Customer may terminate the affected order form without penalty if it reasonably objects. This clause does not apply to reviewers engaged under clause 6.3(h), over whom Customer has no right of notice or objection.

7Documentation and records

7.1On request, and in any event at least annually, Stima will provide Customer with:

(a) a statement of the Service's intended uses, the type and nature of the system, and its known limitations and reasonably foreseeable risks;

(b) a description of the categories of data used to develop, train and calibrate Results, and a summary of the evaluation performed;

(c) a record of material modifications to scoring logic, together with notice of any such modification;

(d) the decision record for any campaign or assignment, exportable as structured data, comprising every scoring run, reviewer action, dispute, disclosure version and erasure;

(e) where Customer lawfully collects demographic data separately from the assessment and provides it to Stima for that purpose, summary adverse impact statistics for Customer's own campaigns. Demographic data is never collected through the assessment. It is joined to outcome data only inside the calculation that produces a group-level statistic, and that join is not persisted and is never written to a Participant's record.

7.2Stima will retain the records in clause 7.1(a) to (d) for three years, and will not delete them earlier, in line with the developer record-keeping obligation the Colorado Artificial Intelligence Act imposes from 1 January 2027, which Stima applies from the date of these Terms.

7.3Stima will notify Customer of any material update to the Service that affects the matters described in clause 7.1(a) or 7.1(c).

7.4Stima maintains a public version-numbered statement of the collaboration rubric it scores against, comprising the levels, the behavioural anchors and the evidence types, and will not change it without a version increment. The task materials, the model prompts and the internal evaluation sets are not published.

8Fees

Customer will pay the fees set out in the applicable order form. [Billing cycle. Renewal. Late payment interest. Taxes.] Fees are non-refundable except as expressly stated in these Terms.

9Confidentiality

Each party will protect the other's confidential information with not less than reasonable care and will use it only to perform under these Terms. This obligation does not apply to information that is or becomes public through no breach, is independently developed, or is lawfully received from a third party without restriction. This clause survives termination for 3 years.

10Intellectual property

10.1Stima retains all right, title and interest in the Service, including scoring frameworks, rubrics, task libraries, models and documentation.

10.2Customer retains all right, title and interest in its own content, including any task materials Customer uploads. Customer grants Stima only the rights expressly stated in clause 6.

10.3As between Stima and Customer, the work product a Participant creates during an assessment belongs to the Participant, subject to the licence the Participant grants Stima in the Participant Terms and to any separate arrangement between Customer and that Participant, including an institution's own intellectual property regulations. Neither party acquires ownership of a Participant's work product by reason of these Terms.

10.4Feedback provided by Customer may be used by Stima without restriction or obligation.

10.5Neither party will use the other's name or marks in publicity without prior written consent, save that Stima may include Customer in a factual list of customers after Customer's first paid term unless Customer objects in writing.

11Warranties and disclaimers

11.1Stima warrants that it will provide the Service with reasonable skill and care and substantially in accordance with the documentation.

11.2Stima does not warrant that Results are accurate predictors of job performance or of academic attainment, that the Service is free of bias, or that Customer's use of the Service satisfies Customer's legal obligations.

11.3Except as expressly stated in this clause 11, the Service is provided on an as-is basis and all other warranties are disclaimed to the extent permitted by law.

12Liability

12.1[Aggregate cap at the greater of fees paid in the preceding twelve months or $X.]

12.2[Mutual exclusion of indirect, special and consequential loss.]

12.3[Carve-outs: breach of confidentiality, data protection indemnity, intellectual property indemnity, breach of clause 6.4.]

12.4Nothing in these Terms limits liability that cannot lawfully be limited. Consistent with the Colorado Artificial Intelligence Act, no provision of these Terms operates to indemnify either party against liability for its own discriminatory act or omission arising from the use of an automated decision-making technology, and any provision purporting to do so is void to that extent.

13Term, retention and termination

13.1[Initial term. Renewal. Termination for convenience. Termination for cause and cure period.]

13.2What survives. The following are not deleted under clause 13.3 or 13.4, whether during the term or on termination:

(a) De-identified Data;

(b) session records covered by a Participant's consent to Session Research, retained under clause 13.5 and subject to any destruction date a Research Annex sets;

(c) the records required by clause 7.2, for the period stated there;

(d) the acceptance, consent and disclosure records required by clause 6.3(e) and the Participant Terms, for the life of the session record and for 3 years thereafter;

(e) anything subject to a legal hold or a legal retention obligation.

Customer acknowledges that the survival of (a) and (b) is material to the commercial terms.

13.3Retention during the term. Assessment Data, Interaction Records and Results for a campaign or assignment are retained for 12 months after the campaign or assignment closes, or 24 months where the order form provides for extended assessment retention, and are then deleted, subject to clause 13.2. A legal hold placed by Customer suspends deletion until Customer releases it. The decision record for that campaign or assignment is retained for the three years set by clause 7.2 and is then deleted. Customer may instruct earlier deletion of Assessment Data, Interaction Records and Results; the decision record is retained regardless, because clause 7.2 is a record-keeping obligation Stima owes independently of Customer.

13.4On termination. On termination or expiry, Stima will, at Customer's election, return or delete Customer data within 30 days of Customer's instruction, and in any event will delete it within 30 days of the end of the applicable period in clause 13.3 if Customer gives no instruction. Clause 13.2 applies throughout.

13.5Session records covered by a Participant's consent are retained until that Participant withdraws consent, or until any earlier date a Research Annex sets for that Customer's Students, because reproducibility of published findings requires the underlying dataset to persist. On withdrawal, Stima removes the session from every research set and from any output not yet published. Stima cannot retract a dataset or paper already published, and the consent screen says so in those words before the Participant answers.

14Governing law and disputes

These Terms are governed by the laws of the State of Arizona, without regard to its conflict of laws principles. [Venue: courts of Maricopa County, Arizona, or arbitration clause.] Nothing in this clause deprives a Participant of any protection available to them under mandatory law of their place of residence, and nothing in it displaces the Participant Terms.

15Changes to these Terms

Stima may update these Terms on 30 days' written notice. Changes apply prospectively only. Material changes to clause 6 do not apply to data already collected, and no change alters what a Participant has already consented to.

SCHEDULE 1

Participant-facing screens

The following are presented by the Service to each Participant, in this order, before the assessment opens. Customer may not alter, suppress or reorder them. Parts 2 and 3 have a hiring variant and an education variant; the Service selects the variant from the Assessment Context Customer has set.

Part 1. Participant Terms

The Participant Terms are presented in full. The Participant accepts them by an explicit control. A separate required control, on the same screen, carries the age confirmation. No telemetry is captured before both controls are used. Acceptance is recorded with a timestamp and the identifier of the version displayed.

Part 2. Assessment notice

Shown to every Participant. Acknowledged by an explicit control before the assessment opens. There is no opt-out, because it describes processing that is necessary to run the assessment.

Hiring variant

Before you start

[Customer name] is using Stima Prova to assess this work task. You are allowed to use AI tools on it, and you are encouraged to work the way you normally would. You are not scored on whether you used AI. You are scored on how you worked.

While you work, this platform records what you do: the prompts you send, which model you choose, the edits you make afterwards, what you copy across, what you check, and how your time is spent. It also records your IP address and basic browser and device information. The prompts you write go to the AI company whose model you pick, so they can answer. Those companies are not allowed to use your prompts to train their models.

We use that record to produce a report for [Customer name]. Our own staff sometimes read a session and score it by hand, to check that our scoring agrees with a human's. They are under confidentiality.

We also strip your name, [Customer name]'s name and other identifying details out of session data and use what is left to improve how we score and to publish statistics about how people work with AI. Nobody is named in that, and no individual session is ever published that way. There is a separate question on the next screen about whether your actual session record can be used in published research. That one is optional.

We do not record anything you do outside this page. No camera, no microphone, no screen recording, no keystrokes outside this workspace.

[Shown only where the identity check is enabled: Before you start, a separate identity provider will check that you are the person who was invited. They tell us only whether it passed. We never see your photo, your document or your biometric data.]

If we have good reason to think this assessment was not completed as agreed, we may end the session and tell [Customer name] that it is unverified, and we will tell you at the same time.

The report describes how you worked. It does not decide anything. A person at [Customer name] makes the decision.

You must be 18 or over to take this assessment.

Your data is handled as described in our Privacy Policy. You can ask for a copy of your data, ask us to correct it, or ask us to delete it, at info@mystima.io.

Education variant

Before you start

[Institution or instructor name] is using Stima Prova for this assignment. You are allowed to use AI tools on it, and you are encouraged to work the way you normally would. You are not marked down for using AI. You are assessed on how you worked.

While you work, this platform records what you do: the prompts you send, which model you choose, the edits you make afterwards, what you copy across, what you check, and how your time is spent. It also records your IP address and basic browser and device information. The prompts you write go to the AI company whose model you pick, so they can answer. Those companies are not allowed to use your prompts to train their models.

We use that record to produce a report for your instructor. Other people at [institution name] may see it too, in the same way they can see your other coursework. That is your institution's decision, not ours. Our own staff sometimes read a session and score it by hand, to check that the report we produced for you is right. They are under confidentiality.

[Shown only where [institution name] has signed the Research Annex: We also strip your name, your institution's name, the course name and other identifying details out of session data and use what is left to improve how we score and to publish statistics about how people work with AI. Nobody is named in that, and no individual session is ever published that way. There is a separate question on the next screen about whether your actual session record can be used in published research. That one is optional.]

[Shown where [institution name] has not signed the Research Annex: We use your session only to produce that report and to keep the platform running and secure. We do not use it for research, and we will not ask you about research.]

We do not record anything you do outside this page. No camera, no microphone, no screen recording, no keystrokes outside this workspace.

[Shown only where the identity check is enabled: Before you start, a separate identity provider will check that you are the person who was invited. They tell us only whether it passed. We never see your photo, your document or your biometric data.]

The report describes how you worked. It is not your grade. Your instructor decides your grade, and your institution's usual appeal route applies. [Result release: Your report is available to you as soon as it is scored. / Your report is available to you once your instructor has reviewed it.]

If we have good reason to think this assignment was not completed as agreed, we may end the session and tell your instructor that it is unverified, and we will tell you at the same time. That is a flag for a human to look at, not a finding against you.

You must be 18 or over to use this platform.

Your data is handled as described in our Privacy Policy. You can ask for a copy of your data, ask us to correct it, or ask us to delete it, at info@mystima.io.

Part 3. Consent to Session Research

Separate screen. Optional. Opt-in only. Neither option pre-selected.

Hiring variant

One optional question

We do research on how people work with AI, and we publish what we find. It helps set fairer standards for assessments like this one.

As we said on the last screen, we already use stripped-down session data to publish statistics, and nobody is named in that. This question is about something different: whether researchers may read the actual record of your session, and whether that record may appear in a published dataset alongside a paper.

May we use the record of this session in published research?

[ ] Yes. Researchers may read my session record and it may appear in published research.

[ ] No. Do not use my session record in published research.

This makes no difference to your assessment. Your answer is not shown to [Customer name], does not affect your report, and does not affect the outcome. You can change your mind at any time by emailing info@mystima.io.

If you say yes: your session record is stored apart from your name and contact details, and is read by our researchers and by independent academic reviewers who are under written confidentiality agreements. Before anything is published we remove your name, your contact details, the employer's name, and other identifying details we find. We will be straight with you about the limit of that: the things you wrote are your own words, and writing can be distinctive, so we cannot promise that someone determined to work out who you are could never do it. That is exactly why we ask you rather than treating your session as anonymous.

We keep the record for as long as the research needs it, which for published work means indefinitely, unless you withdraw. If you withdraw, we take your session out of any research we have not yet published. We cannot pull back a paper or a dataset that is already out.

If you say nothing, we treat that as no.

Education variant

Shown only where [institution name] has signed the Research Annex described in clause 6.3(i). Where it has not, this screen is not shown at all.

One optional question

We do research on how people work with AI, and we publish what we find. It helps set fairer standards for assessments like this one.

As we said on the last screen, we already use stripped-down session data to publish statistics, and nobody is named in that. This question is about something different: whether researchers may read the actual record of this assignment, and whether that record may appear in a published dataset alongside a paper.

May we use the record of this session in published research?

[ ] Yes. Researchers may read my session record and it may appear in published research.

[ ] No. Do not use my session record in published research.

This makes no difference to your assignment. Your answer is not shown to your instructor or to anyone else at [institution name], does not affect your report, and does not affect your grade. We will not tell them what you answered even if they ask. You can change your mind at any time by emailing info@mystima.io.

If you say yes: your session record is stored apart from your name and contact details, and is read by our researchers and by independent academic reviewers who are under written confidentiality agreements. Before anything is published we remove your name, your contact details, [institution name], the course name, and other identifying details we find. We will be straight with you about the limit of that: the things you wrote are your own words, and writing can be distinctive, so we cannot promise that someone determined to work out who you are could never do it. That is exactly why we ask you rather than treating your session as anonymous.

Your yes is not the only thing that has to be in place. [institution name] has also agreed separately to this research, and that agreement sets the rules we work to. If it withdraws that agreement, we stop, whatever you answered.

We keep the record for as long as the research needs it, which for published work means indefinitely, unless you withdraw, or until any earlier destruction date [institution name] has agreed with us. If you withdraw, we take your session out of any research we have not yet published. We cannot pull back a paper or a dataset that is already out.

If you say nothing, we treat that as no.

Part 4. Implementation requirements

The following are binding on Stima in respect of these screens.

(a) Neither option on the consent screen is pre-selected and no default applies. Declining to answer is recorded as a refusal. Every answer, including a refusal and a non-answer, is stored with its wording version.

(b) Every screen in this Schedule carries a version identifier. The version shown to a Participant is stored against the session with a timestamp, for the Participant Terms, the assessment notice and the consent wording alike, and for the variant displayed. Superseded versions are retained.

(c) The consent answer is not exposed on any Customer-facing surface, report, export or application programming interface, and in the education context is not written to any learning management system, gradebook or grade passback payload.

(d) A withdrawal route is operated, such that a Participant request results in removal of that session from the research set. Responsibility for that route is assigned to a named individual.

(e) Consent is recorded per session and does not carry over to any subsequent assessment.

(f) No telemetry is captured before the Participant has used the acceptance control and the age control at Part 1 and the acknowledgement control at Part 2.

(g) The age confirmation is a separate required control at Part 1. The consent screen at Part 3 is not shown, and no consent is recorded, unless that confirmation has been given.

(h) The variant shown follows the Assessment Context set by Customer. Where no context is set, the Service does not open the assessment.

(i) In the education context, where Customer has not signed the Research Annex described in clause 6.3(i), the consent screen at Part 3 is not rendered, no consent record is created, and no De-identified Data is created from that session.

(j) Each variant is stored and versioned as rendered text, not as a difference from another variant, so that the exact wording a Participant saw can be reproduced.

SCHEDULE 2

Sub-processors and Model Vendors

Current as at 24 September 2026. Stima gives 30 days' notice of any addition or replacement, and Customer may object. This Schedule does not cover research reviewers, who are engaged under clause 6.3(h) and over whom Customer has no right of notice, objection or disclosure.

Model Vendors

Sub-processors

Customer systems

Where Customer runs the Service through a learning management system, that system supplies the Participant identifier and receives the Result for its gradebook. It is Customer's own system, not a Stima Sub-processor, and Customer is the controller of what it holds. The Participant's answer to the consent question is never written to it.

Identity verification

Identity verification is a per-campaign option and is not offered in the education context without Customer's separate written instruction. Where it is enabled, the identity provider performs the check under its own agreement with the Participant and returns to Stima a pass, fail or name-mismatch signal only. Stima does not receive or store video, images, biometric data, or a copy of any identity document. Customer is responsible for determining whether the check is lawful in the Participant's jurisdiction, including under the Illinois Biometric Information Privacy Act.

The short version

The platform is used in two ways. An employer invites a job applicant to complete a work task, or an instructor sets one as part of a course. This policy calls both of them participants, and says where the two differ.

If you are a participant, section 2 is yours. We record how you work during the assessment, we turn that into a report for whoever invited you, a human makes the decision or the grade, and we ask you one optional question about published research that you are free to decline with no consequence.

If you work for a customer, an employer or an institution, section 3 is yours. We process participant assessment data on your instructions under a data processing addendum, and section 3.3 covers our position under FERPA.

If you are a site visitor, section 4 is yours, and it is short.

Section 5 covers research and publication. Read it if you want to know what we publish and what is optional.

1Who we are and which role we are in

Milkis Strategic Partners LLC, an Arizona limited liability company of 378 W Foothill St, Apache Junction, AZ 85120, trading as Stima ("Stima", "we", "us"), operates the Stima Prova assessment platform at mystima.io.

We are in a different role depending on what is being processed. This decides who answers your request.

For the research part of what we hold we are the controller, we are accountable to the participant for it, and the participant deals with us, not with the employer or the institution.

Contact for any privacy matter: info@mystima.io. Postal: 378 W Foothill St, Apache Junction, AZ 85120. [Data protection officer, EU or UK representative under article 27, and DIFC contact, if appointed.]

2If you are a participant

2.1 What we collect and why

We also process the data above for the further purposes below. Except where the table says otherwise, these are ours rather than the customer's.

If you are a student, the de-identification, Aggregate Research and Session Research rows below do not apply to you unless your institution has signed a research agreement with us. Without it we use your session only to produce your report, to check that report is right, and to keep the platform running and secure. Section 3.3 explains why we set it up that way.

We do not collect anything from outside the assessment page. No camera, no microphone, no screen recording, no keystrokes outside the workspace. We do not infer your emotions, and the platform is not built to.

We do not ask for or use special category data as defined by the GDPR, and we do not process biometric data. Where the optional identity check involves biometric processing, that happens at the identity provider, under its agreement with you, and we receive only the result.

We do not collect demographic data through the assessment and never write it to your record. Where an employer lawfully collects it separately for adverse impact reporting in its own jurisdiction, that is voluntary, it happens outside the assessment, and it is joined to outcome data only inside the calculation that produces a group-level statistic.

2.2 Automated processing, and what it does not do

Your session is scored by an AI model against our rubric. The score is produced automatically. The hiring decision and the grade are not.

Our contract with every customer requires meaningful human review over any decision informed by your report, forbids using the report as the sole basis for an adverse decision, and forbids automated rejection. In the education context it forbids treating a Result as a grade. Those decisions happen in the customer's own systems, which we cannot see, so this is a contractual obligation on them. What we control is our side: the platform does not set a final status on a participant without a person at the customer acting, and it records who acted and when.

In the hiring context your own result page does not depend on that. It is available to you as soon as your session is scored, by the link we send you, whatever the employer does or does not do. In the education context your institution chooses whether you see it on scoring or after your instructor has reviewed it, and the screen you saw before starting says which applies.

You can ask us for the logic in plain terms: which criteria were scored, what evidence from your session was cited for each, and which rubric version applied. That is on your result page, and we publish the rubric itself with a version number. The task materials and our internal scoring prompts are not published.

If you want the hiring decision or the grade reconsidered, that request goes to the customer. If you want your session record checked, that comes to us.

2.3 Who sees your session

• The employer or institution that invited you sees your report and the cited evidence from your session. If we have reason to believe the assessment was not completed as agreed, we may also tell them the session is unverified and why, and we tell you at the same time.
• Our staff see it where the task requires, for support, for quality assurance, and for blind human scoring used to check the platform's agreement with human scorers. They are bound by confidentiality.
• The AI vendors listed in section 7 receive the prompts you send and return the responses. They are contractually barred from training on that content.
• Our hosting and email providers process it as infrastructure.
• Our researchers, and independent academic reviewers under written confidentiality agreements, see your actual session record only if you consented under section 5.
• Where your institution runs the platform through its learning management system, that system receives your score for its gradebook. It never receives your answer to the research question.
• Nobody else. We do not sell it, we do not run a candidate pool, and we do not make you discoverable to employers or institutions you did not apply to.

2.4 How long we keep it

Deleting a session means we delete the session records and destroy the encryption key unique to you, which makes your contact details unrecoverable. We do not keep a readable copy.

Our telemetry and decision records are append-only for the whole time a session is retained, so nobody can quietly rewrite what happened. That is a constraint on editing individual entries, not on deletion: an erasure request or the end of a retention period removes the session's records as a whole, which is how the two fit together.

2.5 Your rights

You can ask us to: give you a copy of your data, which you can also download yourself from your result page once it is available to you; correct it; delete it; restrict or object to processing; port it; and withdraw research consent.

Write to info@mystima.io. If you have a result page, quote the reference on it; if you do not yet, say who invited you and when. We respond within 30 days. There is no charge, and we will not treat you differently for asking, and you do not have to wait for your result page to make a request.

Where we hold your data as processor for the employer or institution, we must pass your request to them so they can answer it. We tell you when we do. Where we are the controller, including for your research consent and your result page, we answer you directly. We will never tell a customer how you answered the research question.

De-identified data is the one thing a deletion request cannot reach, because by then it is no longer about you and we have no way to find your part of it. Section 6 of the Participant Terms says the same thing, before you start.

Section 9 sets out the additional rights you have depending on where you live.

3If you work for a customer

3.1 Participant data

We process participant assessment data on your documented instructions, as processor, under the Data Processing Addendum at https://mystima.io/dpa. That addendum carries the article 28 terms, the sub-processor list, the transfer mechanism, our security measures and our breach notification commitments.

Two things sit outside that relationship. First, we create de-identified data from assessment sessions and use it to operate and improve the service and for Aggregate Research, as your Terms of Use and our agreement with each participant permit. If you are an educational institution, neither of those happens to your students' sessions at all unless you have signed the Research Annex described in section 3.3. Second, we conduct Session Research under section 5, for which we are an independent controller and you are not. You cannot direct that research, you cannot see which participants consented, and you cannot ask us who the reviewers are. In the hiring context you also have no right to object to it. In the education context you decide whether it happens at all, through the Research Annex in section 3.3, and you can withdraw that Annex, in which case we stop.

3.2 Your own account data

We use magic-link sign-in, so we do not hold a password for you.

Account data is retained for the term plus 6 years for tax and limitation purposes. Your rights are the same as those in section 2.5, and you write to the same address.

3.3 If you are a US educational institution: FERPA

Where you are subject to FERPA and disclose education records to us, we act as a school official with a legitimate educational interest, provided you have specified criteria for school officials in your annual FERPA notification that cover us. We perform a service you would otherwise perform with your own employees, we are under your direct control with respect to the use and maintenance of those records, we use them only for the purposes you authorise, and we do not redisclose them except as you direct or the law requires.

Research on student sessions is off by default. We do not perform Session Research or Aggregate Research on any session generated through your account, and we do not create de-identified data from one, unless you have signed a separate Research Annex. Without it, a student's session is used only to deliver the assessment to you, including checking that the student's own report is right, and to support and secure the platform. It is not used to validate our scoring methods generally, and the research consent screen is never shown to your students.

We do not rely on the studies exception at 34 C.F.R. 99.31(a)(6), and we do not ask you to. That exception is available only for a study conducted for or on behalf of you, and our research is methodological, conducted in our own name and published by us. We would rather tell you that now than have your counsel find it later.

Where an Annex is in place: Aggregate Research proceeds on the de-identification standard the Annex sets and does not need individual student consent, because it operates on data that is no longer personal and no longer an education record. Session Research needs both the Annex and the student's own consent. Neither is sufficient alone.

An Annex applies only to sessions started after you sign it. It does not sweep in the session of a student who was told, before starting, that their work would not be used for research.

We take this position because being your school official under your direct control and being an independent researcher you cannot direct are not compatible on the same records. Defaulting research off is how we keep the first one true.

Students exercise their FERPA rights of access and amendment through you. We will support any request you pass to us.

State student-privacy statutes such as California's SOPIPA and New York Education Law 2-d, and the standard data privacy agreements built on them, may also apply to you. Tell us which apply and we will complete your rider.

4If you are a site visitor

Our servers record your IP address, browser and device type, operating system, referring page, pages viewed and time of visit whenever you load a page, which is how the site works and how we keep it secure. We rely on our legitimate interests for that.

We also set cookies. Strictly necessary cookies are set without asking, as the law allows. Analytics cookies are set only if you agree through the banner, and you can withdraw that at any time.

If you sign up for a trial or a waitlist, or send us a message, we hold what you gave us in order to reply and, where you agreed, to send you product email. Every marketing email has an unsubscribe link that works.

Your rights are the same as those in section 2.5, and you write to the same address.

5Research

If you consented to research, or you are deciding whether to, this is the part that binds us.

5.1 What we research and why

We study how people work with AI on real tasks: which prompts people write, when they accept model output and when they reject it, what they verify, and how that relates to the quality of what they produce. We publish the results in academic venues.

The purpose is methodological. We are trying to establish how assessments of human-AI collaboration should be designed and scored, which is a question the field has not settled and which affects everyone assessed by a tool like ours. We are not researching you, and we are not researching the employers or the institutions.

For Session Research we are an independent controller. No customer directs it, and no customer sees it.

5.2 Two kinds of research, and only one of them is optional

Aggregate Research. Not optional in the hiring context, and we tell you about it before the assessment. In the education context it does not happen at all unless the institution has signed a research agreement.

We strip identifiers out of session data and use what is left to improve our scoring and to publish statistics and aggregate findings. Nobody is named. No individual session is published this way, whether or not identifiers have been removed. This is described on the assessment notice screen, before the optional question, so that the optional question is not the first you hear of it.

Stripping is not a single pass. We remove direct identifiers automatically, then run automated detection for indirect identifiers in free text, including personal names, employer names, institution names, course names, project names and client names, then a person reviews the record before it enters any research or improvement set. We do not attempt to re-identify it, and our terms forbid customers from trying.

Session Research. Optional, and only with your explicit consent.

Some research needs the actual session: the prompts as written, the sequence of edits, the moments of verification. That material cannot be reliably stripped of everything that might identify its author, because writing itself is distinctive. We do not pretend otherwise, and that is precisely why we ask rather than treating it as anonymous. We use it only where the participant said yes. Published datasets contain only the sessions of participants who said yes.

If a record cannot be brought to the de-identified standard, it is not used for Aggregate Research either. It goes into the consented set or it goes nowhere.

5.3 How we ask

One question, on its own screen, after the assessment notice and before the task begins. Neither answer is pre-selected. Skipping it is recorded as a refusal.

We hold ourselves to these six points:

• No pre-selected option and no default. A non-answer is a no.
• Your answer is stored with a timestamp and the identifier of the exact wording you saw, whether you said yes, said no, or skipped it. We keep superseded wordings, so we can always show what you were asked.
• Your answer is never exposed on any customer-facing screen, report, export or interface, and in the education context it is never written to a learning management system or a gradebook. Your instructor cannot find out, and our contract forbids a customer from asking or from telling you the answer matters.
• Withdrawal is a real route with a named person responsible for it.
• Consent is per session. Saying yes once does not commit you for any later assessment.
• We never ask this question of anyone who has not confirmed they are 18 or over, and the platform is not open to anyone under 18.

Consent here is consent under article 6(1)(a) of the GDPR and the equivalent provisions of DIFC Data Protection Law. It is separate from anything the customer relies on, and refusing it has no effect on your assessment or your grade.

5.4 What happens to a consented session

It is stored apart from your name and contact details. It is read by our researchers and by independent academic reviewers and collaborators who take part in scoring-agreement studies. Each of them is engaged under a written agreement imposing confidentiality, use restricted to the study, a ban on re-identification and on passing the data on, and a return or destruction obligation, with a lawful transfer mechanism in place. They never receive your contact details.

Your session may appear in a published paper, or in a published dataset, with identifying material removed first, subject to the limit described in section 5.2.

We keep it until you withdraw. There is no fixed end date, because published findings have to remain reproducible and a dataset that disappears cannot be checked. If you are a student, your institution may have agreed a destruction date with us, in which case that date applies and the screen you saw says so.

If you withdraw, we remove your session from every research set and from any work not yet published. We cannot retract a paper or dataset already published. We say this on the consent screen, in those words, before you answer.

5.5 Ethics review

Session Research goes through ethics review before submission for publication, through an institutional review board, an independent ethics review service, or the review process of the publication venue. We record which route was used for each output. Consent is not the same thing as ethics clearance and we do not treat it as though it were.

5.6 What we do not do with research data

We do not use it to train or fine-tune the weights or parameters of any AI model. We do not sell it. We do not share it with employers or institutions. We do not use it to profile you for any purpose other than the research described here.

6AI models and what reaches them

The workspace gives participants a choice of AI models from two vendors, at two capability tiers each. The prompts a participant sends, and the resulting output, go to the vendor whose model was chosen. Results are generated by prompting a vendor's model against our rubric, with structured output.

Every vendor is engaged under terms that prohibit using the content for training their models and that limit retention to abuse monitoring. We will not engage a vendor on terms that lack those protections.

Generating a score by prompting a model is not the same as training a model. No model's weights or parameters are trained or fine-tuned on participant data, by us or by our vendors. We do use de-identified data to design and test our own rubrics, prompts and evaluation sets, which is a different operation and does not change any model.

7Sub-processors and vendors

Customers receive at least 30 days' notice of any addition or replacement to this table and may object.

Where your institution runs the platform through its own learning management system, that system supplies your identifier and receives your score for its gradebook. It is your institution's system rather than one of ours, so it is not in the table above and your institution controls what it holds. Your answer to the research question is never written to it.

Independent academic reviewers are not in this table and are not sub-processors. They receive consented session records only, under the agreements described in section 5.4, and they act under our direction as independent controller, not the customer's. A customer has no right of notice or objection over them and no right to their identities, because the research is not the customer's processing.

Where identity verification is enabled, that provider performs the check under its own agreement with the participant and returns only a pass, fail or name-mismatch signal. We do not receive or store video, images, identity documents or biometric data.

8Where data is stored, and transfers

We run the platform on infrastructure we control, in an EU region, hosted by the provider named in section 7. Participant assessment data is stored there regardless of where the participant or the customer is located.

Model vendors, the email provider, the identity provider and research reviewers may process data outside the EEA. Where they do, transfers are made under [Standard Contractual Clauses, adequacy, or Data Privacy Framework certification], and the mechanism for each is recorded in the Data Processing Addendum and, for reviewers, in the written agreement with that reviewer.

For participants in the DIFC, transfers out of the DIFC are made under [article 26 or 27 DIFC DPL mechanism]. For participants in the UAE outside the DIFC, transfers follow Federal Decree-Law No. 45 of 2021.

9Rights by jurisdiction

Everyone covered by this policy has the rights in section 2.5, whichever section describes them. Depending on where you live, you also have the following. We apply these rights based on where you are, not where the customer is.

EEA and UK. Access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects. You can complain to your supervisory authority. [Representative under article 27, if appointed.]

California. Under the CCPA as amended: the right to know the categories and specific pieces of personal information collected, the sources, the purposes and the categories of recipients; the right to delete; the right to correct; the right to limit use of sensitive personal information; and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use or disclose sensitive personal information beyond the permitted business purposes. We do not offer financial incentives. Job applicants have these rights in full. Students hold them too, to the extent their records are not carved out as education records handled under section 3.3.

Colorado. The Colorado Privacy Act's consumer rights do not extend to individuals acting in a job applicant or employment context, so for Colorado job applicants we give the same rights as everyone else under section 2.5 as a matter of policy rather than statute. A Colorado student on a course is not in an employment context, and holds those rights by statute, including the right to appeal a refused request and to use a recognised universal opt-out mechanism. Write to us and we will handle either. Separately, from 1 January 2027, SB 26-189 requires us as a developer to give deployers documentation of intended uses, known limitations and risks, and the categories of data used in development, to notify them of material updates, and to keep those records for three years. Section 7 of the Terms of Use is how we do that. That statute also voids any contract term purporting to indemnify a party against liability for its own discriminatory act.

Illinois. The Human Rights Act as amended by HB 3773 applies to an employer's use of AI in employment decisions. The Artificial Intelligence Video Interview Act applies to video interviews, which Stima Prova does not conduct and does not process. Where the optional identity check is enabled, the Biometric Information Privacy Act may apply to that check; it is performed by the identity provider, which obtains its own consent, and we receive no biometric data.

New York City. Local Law 144 requires the employer to commission an independent bias audit within the preceding year, to publish a summary, and to give candidates notice. That obligation sits with the employer. We supply the underlying data for their auditor and we do not hold ourselves out as that auditor.

Students at US institutions. FERPA gives you the right to inspect and review your education records, to seek amendment, and to control certain disclosures. You exercise those rights through your institution, not through us, and we support any request it passes to us. Section 3.3 sets out our position.

DIFC. Access, rectification, erasure, restriction, portability, objection, the right not to be subject to solely automated decisions with significant effects, and the right to complain to the Commissioner of Data Protection. Under Regulation 10 you may also request information about the autonomous processing and contest its output.

United Arab Emirates, outside the DIFC. Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to object to automated processing producing legal or seriously affecting consequences, subject to the exceptions in the law.

Everywhere else. Write to us anyway and we will answer.

10Security

Participant contact details are held in a separate table, encrypted with a key unique to that participant. Session telemetry, submissions, scores and the decision record reference only an opaque participant identifier. Deletion destroys the per-participant key and the session records.

Telemetry and the decision record are append-only for as long as a session is retained, enforced at the database layer, so the record of what happened cannot be quietly rewritten.

Invitation tokens, result tokens and share links are hashed at rest and are single purpose. Secrets are held outside the code repository and outside anything sent to the browser. Backups run daily and restores are tested.

We will notify affected customers of a personal data breach without undue delay, and participants directly where the law requires it or where the risk to them warrants it.

11Children

The platform is for people aged 18 and over. We do not knowingly process the data of anyone under 18. If we learn that we have, we delete the session.

Customers are contractually forbidden from inviting or assigning an assessment to anyone under 18, including a school-age student enrolled on a course through dual enrolment or early admission. The research question is never shown to anyone who has not confirmed they are 18 or over.

12Changes to this policy

We post the current version here with its version number and date, and keep prior versions available. Changes apply prospectively only. A change never alters what a participant has already consented to, and never applies retroactively to a session already completed.

13Contact

Milkis Strategic Partners LLC

378 W Foothill St, Apache Junction, AZ 85120

General: info@mystima.io

Privacy and data requests: info@mystima.io

Research withdrawal: info@mystima.io

Version 1.1. Last updated 24 September 2026.

These terms cover two situations: an employer invited you to complete a work task as part of hiring, or an instructor set it as part of a course. Where the two differ, this says so.

1Who we are and what this is

Stima Prova is an assessment platform run by Milkis Strategic Partners LLC, an Arizona limited liability company of 378 W Foothill St, Apache Junction, AZ 85120 ("Stima", "we", "us").

Someone has invited you to complete a work task on it. In these terms we call them "the organisation": your prospective employer if this is part of a job application, or your institution and instructor if this is part of a course.

These terms are an agreement between you and us. They are not an agreement with the organisation. Your relationship with them, including anything about the job or about your course, is between you and them.

2Accepting these terms

You accept these terms by selecting "I agree" below. Until you do, we record nothing about your session.

There is also a separate box confirming your age. You have to tick both.

If you do not want to accept, close the page and tell the organisation.

We record which version of these terms you saw, when you accepted, and your IP address and basic browser and device information at that moment.

3You must be 18

You confirm that you are 18 or over.

The platform is not for anyone younger, including if you are enrolled on a university course while still at school. If we learn that a person under 18 has completed an assessment, we delete the session.

4Using AI during the assessment

You are allowed to use the AI models built into the workspace. That is the point of the task. You are not penalised for using them, and you are not rewarded simply for using them. You are assessed on how you worked: what you asked, what you kept, what you changed, and what you checked.

You agree that:

(a) you are taking the assessment yourself, and nobody else is doing it for you;

(b) you will not use another person to produce your answer, and will not share your invitation link or your session with anyone;

(c) you will not attempt to interfere with the platform, extract its task materials or its internal scoring prompts, or use it to build a competing product. The rubric we score against is published, so that is not something you need to extract;

(d) where the task tells you a specific tool or resource is off limits, you will respect that.

If we have good reason to believe an assessment was not completed as described here, we may end the session and we may tell the organisation that the session is unverified and why. We tell you at the same time. That is a flag for a person to look at. It is not a finding against you, and if this is a course, your institution's own academic integrity process applies, not ours.

5What we record

While you work, the platform records:

• the prompts you send to the AI models and the responses you get back;
• which model and which capability tier you chose, and when you switched;
• snapshots of your draft as you edit it, and text you copy from a model response into your work;
• responses you discarded or regenerated;
• what you checked or verified during the task;
• how your time was spent, including periods of inactivity;
• your final submission and your optional note about your approach;
• your name and email address, from the invitation, or, where your institution runs this through its learning management system, the identifier that system gives us for you;
• your IP address and basic browser and device information, when you accept these terms and through the session, which is how we evidence what you agreed to and how we detect abuse;
• your acceptance of these terms, and your answer to the optional research question in section 7, each with a timestamp and a note of which version of the wording you saw.

That is the whole list.

If your institution runs this through its learning management system, your score may also be written back to its gradebook. Your answer to the optional research question in section 7 is never written there, or anywhere else your institution or employer can see.

It does not record anything you do outside the assessment page. No camera, no microphone, no screen recording, no keystrokes outside the workspace.

The prompts you write are sent to the AI company whose model you chose, because that is how you get an answer. Those companies are contractually barred from using what you send to train their models. They are named in our Privacy Policy.

If the optional identity check is switched on, a separate provider runs that check and tells us only whether it passed and whether the name matched. We never receive or store your photo, your video, your identity document or your biometric data.

Our Privacy Policy explains what we do with all of this, how long we keep it, and who else sees it. Read it at https://mystima.io/privacy.

6Your work stays yours

The work you produce during the assessment is yours. You keep the rights in it. If this is a course, your institution's own intellectual property regulations are between you and them.

If this is a course, permissions (b) and (c) below are switched off unless your institution has signed a separate research agreement with us. Without it we use your session only for (a), and to check that your report is right. Section 7 has the detail.

You give us permission to:

(a) store and analyse your session, generate your report and your result page, and make that report available to the organisation that invited you;

(b) have our own staff read your session and score it by hand, under confidentiality, so we can check that our scoring agrees with a human's;

(c) strip your name, the organisation's name and other identifying details out of your work and the record of how you produced it, and use what is left to operate, secure, evaluate, calibrate and improve the platform, and to publish statistics and aggregate findings about how people work with AI. Nothing published this way names you, names the organisation, or reproduces an individual session;

(d) if you say yes to the optional question in section 7, use the record of your session in published research as described there.

That is the whole of what you give us.

One thing to be straight about on (c). If you tell us before we do it that you do not want your session stripped down and used this way, we will leave it out. Write to info@mystima.io before the campaign or assignment closes, which is when it runs. Once we have stripped the identifying details out, though, the data is no longer about you, we cannot pick your part back out of it, and it stays in use indefinitely. That means asking us later to delete your session removes your session and your identifying details, but it does not reach back into stripped data we have already produced or into statistics already published. If that matters to you, it is worth knowing before you start rather than afterwards.

We do not acquire ownership of your work, and the organisation does not acquire it through us. Anything they want beyond that is a matter between you and them.

7Published research using your session is optional

We do research on how people work with AI, and we publish it. After the assessment notice, you will see one optional question asking whether we may use the record of your session in that research.

If this is a course, you will only see that question if your institution has signed a separate research agreement with us. If it has not, we do not use your work for research at all, we do not create stripped-down data from it either, and nothing in section 6(c) applies to you. If it has, your yes is necessary but not sufficient: the institution's agreement sets the rules, and if it withdraws that agreement we stop, whatever you answered.

It is a different thing from section 6(c). Section 6(c) is stripped-down data and statistics with nobody named and no individual session published. This question is about whether researchers may read your actual session, and whether that record may appear in a published dataset alongside a paper.

It is genuinely optional:

• it is not a condition of taking or completing the assessment;
• your answer is never shown to the organisation, and we will not tell them, even if they ask. If this is a course, that includes your instructor;
• it has no effect on your score, your report, the hiring outcome, or your grade;
• neither answer is pre-selected, and if you skip the question we treat it as a no;
• you are asked once per assessment. Saying yes now does not commit you for any future one.

If you say yes, your session record is stored apart from your name and contact details, and is read by our researchers and by independent academic reviewers who are under written confidentiality agreements. Before anything is published we remove your name, your contact details, the organisation's name, and other identifying details we find.

We will be straight with you about the limit of that. The things you wrote are your own words, and writing can be distinctive, so we cannot promise that someone determined to work out who you are could never do it. That is exactly why we ask you rather than treating your session as anonymous.

You can withdraw at any time by emailing info@mystima.io. We will take your session out of any research that has not yet been published. We cannot retract a paper or dataset that is already published, which is why we keep published research data indefinitely unless you withdraw first. If you are a student and your institution has agreed a destruction date with us, that date applies instead.

8How your report is used

The report describes how you worked. It does not decide anything.

If this is a job application, a person at the employer makes the hiring decision, in their own systems. Our contract with them requires meaningful human review over any decision informed by your report, forbids using it as the sole basis for turning you down, and forbids any automated rejection. We cannot see or control what they do in their own systems, which is why it is a contractual obligation on them rather than a promise from us.

If this is a course, the report is not your grade. Your instructor decides your grade, and your institution's usual appeal route applies. Our contract with your institution forbids treating a Result as a grade or as determinative of an academic integrity allegation.

If this is a job application, your result page is available to you as soon as your session is scored. It does not depend on the employer doing anything first.

If this is a course, your institution chooses whether you see your report as soon as it is scored or after your instructor has reviewed it. The screen you saw before you started says which applies. It shows which criteria were scored, what evidence from your session was cited for each, and which version of our rubric applied. We publish the rubric itself.

If you think your report is wrong, email us at info@mystima.io with the reference on your result page. We will look at the session and tell you what we find.

Depending on where you live, you may also have a legal right to an explanation, to contest the decision, or to ask for human intervention. Requests about the hiring decision or the grade go to the organisation, because the decision is theirs. We will help you reach the right contact.

9What we will not do

We will not sell your data.

We will not use your session to train or fine-tune the weights or parameters of any AI model, ours or anyone else's. The AI vendors whose models you use in the workspace are contractually barred from training on what you send. What we do instead, under section 6(c), is use stripped-down data to design and test our own scoring methods, rubrics and prompts. That is a different thing from training a model on your work, and we would rather spell out the difference than leave you to guess at it.

We will not show you to employers or institutions you did not apply to. We do not run a candidate pool or a talent marketplace.

We will not use your session to market anything to you.

10Your rights over your data

You can, at any time:

• get a copy of everything we hold about your session, as a structured file, from your result page once it is available to you, or by emailing us at any time, whether or not your result page is out;
• ask us to correct something that is wrong;
• ask us to delete your data, subject to the point about stripped data in section 6;
• withdraw research consent;
• object to or restrict certain processing.

Write to info@mystima.io. We respond within 30 days. There is no charge, and we will not treat you differently for asking.

One thing to know about where your request goes. For most of what we hold about your assessment, the organisation is legally the controller and we hold it on their behalf, so we have to pass your request to them so they can answer it. When we do that, we tell you. For your research consent, for your result page, and for what we hold under these terms, we are the controller and we answer you directly. We will never tell the organisation how you answered the research question.

The Privacy Policy sets out the full list, including the extra rights you have if you are in the EEA, the UK, California, Colorado, the DIFC or the UAE, and, if you are a student at a US institution, your rights over your education records.

11Availability and limits

We try to keep the platform working, but we do not promise it will be uninterrupted or error-free.

If an AI model provider is unavailable during your session, you can carry on editing your work. Your time limit keeps running, because the timer is set by the organisation and we do not stop it automatically. We record the outage against your session and flag it to them. Whether to give you extra time is their decision, not ours. If you think an outage affected you, email us at info@mystima.io and we will tell them what we recorded.

Our liability to you is limited to the extent the law allows. We do not exclude or limit liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be limited. Nothing here takes away a right you have under the mandatory law of where you live.

12Law and disputes

These terms are governed by the laws of the State of Arizona, without regard to its conflict of laws principles. [Venue.]

If you live in the EEA, the UK, or another place whose law gives you rights that cannot be contracted away, you keep those rights and you can bring a claim where you live.

13Changes

If we change these terms, the new version applies to assessments started after the change. It does not apply to a session you have already completed, and it never changes what you agreed to about research.

14Contact

Milkis Strategic Partners LLC

378 W Foothill St, Apache Junction, AZ 85120

info@mystima.io

Data protection contact: info@mystima.io

Research withdrawal: info@mystima.io