Privacy Policy

1. Introduction

activATAR ("we", "our", "us") is an Australian education technology provider. We operate an online study platform that helps senior secondary students learn, practise and track their progress.

This Privacy Policy explains how we collect, hold, use and disclose personal information, and how you can access, correct or complain about the information we hold about you. It applies to our website, our platform and every service we provide (together, the "Services").

We are committed to protecting your privacy and to handling personal information openly and transparently. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we handle personal information in accordance with them.

If you have any questions about this policy, contact our Privacy Officer using the details in section 16.

2. Who This Policy Applies To

This policy applies to:

• Students who use the platform
• Parents and guardians
• Teachers and school staff
• Schools and education authorities that engage us
• Visitors to our website

Where a school provides accounts to its students, section 13 explains how responsibilities are shared between activATAR and the school.

3. Information We Collect

We collect only the information we need to run the Services. It falls into the following categories.

4. Why We Collect Information

We collect, hold, use and disclose personal information to:

• Create and administer your account
• Authenticate you and keep your account secure
• Deliver educational content and features
• Save and display your progress
• Personalise learning, including recommendations and practice suited to your level
• Provide progress reporting to you, and to your school or parent where an account is linked
• Improve platform performance, reliability and content
• Detect, prevent and investigate misuse, fraud or abuse
• Provide customer support and respond to your enquiries
• Send account and service communications, and optional marketing you can unsubscribe from (see section 14)
• Meet our legal, regulatory and record-keeping obligations

We do not sell personal information. We will not use personal information for a purpose unrelated to those above unless you consent, or we are required or authorised by law to do so.

5. Children's Privacy

Our Services are designed for senior secondary students, typically in Years 10 to 12, which means many of our users are under 18. We take extra care with their information.

• If you are under 18, you must have permission from a parent, guardian or your school to use the Services.
• Where a school provides accounts, the school is responsible for obtaining any consent required from students and their parents or guardians under its own privacy obligations.
• We collect the minimum information needed to deliver learning. We do not ask students for sensitive information, and where a student can write to us in their own words — feedback and support messages — we ask them on screen not to include personal details.
• We do not use student information for behavioural advertising, ad targeting or commercial profiling, and we do not permit our service providers to do so.
• We apply automated profanity filtering and abuse protection to user-generated content, and staff access to student records is limited to those whose role requires it.
• A parent, guardian or school can ask us to access, correct or delete a student's information at any time using the process in section 12.

6. AI Features

Some features use artificial intelligence to support learning — most notably automated feedback and marking on written long-answer responses.

• AI features are optional. You can use the platform without submitting work for AI feedback.
• AI assists learning; it does not replace a teacher. Marks and feedback generated by AI are indicative practice feedback, not an official assessment result.
• AI responses may contain errors or omissions. You should verify anything important independently, and check with your teacher where a result matters.
• When you submit work for AI feedback, the question, the marking criteria and your response are sent to an AI processing provider so that feedback can be generated and returned to you. An internal account identifier is included for usage accounting. Your name, email address and contact details are not sent.
• AI providers may process that information only as necessary to provide the service to us, under contract.
• We do not knowingly use personal information, student work or platform data to train public or third-party AI or machine learning models, and we do not permit our providers to do so, without consent.

7. Cookies

The cookies we set are strictly essential. There are only two kinds:

• Authentication — keeping you signed in and maintaining your session as you move between pages.
• Security — protecting your account and our forms from automated abuse.

That is the complete list. We do not set advertising or ad-targeting cookies, we do not use cookies to build a profile of you, we do not use them to follow you across other websites, and we never sell or share cookie data with advertisers.

Two related technologies are worth explaining so you have the full picture:

• Local storage— your preferences, such as theme, subject selections and display choices, are saved in your browser's local storage rather than in cookies. This stays on your device.
• Analytics — we measure, in aggregate, which pages and features are used so we can improve them and keep the site fast. The analytics providers we use may set their own cookies or identifiers to do this. It is never used for advertising, never sold, and never used to identify you to a third party.

You can block or delete cookies in your browser settings at any time, and blocking analytics does not affect how the platform works. You should know that we serve our analytics from our own domain, so a browser tracker blocker will not usually stop it — we do this so analytics keeps working and loads quickly, not to identify you. If you would rather we did not count your usage at all, email our Privacy Officer and we will exclude you. If you block essential cookies, you will not be able to sign in.

9. Overseas Disclosure

Personal information is primarily stored within Australia. Our database, authentication service, application hosting and multiplayer game server all run in Sydney. Some of the service providers described in section 8 process limited information outside Australia, so we are likely to disclose personal information to overseas recipients.

The countries in which those recipients are likely to be located are Australia, the United States of America and Japan, and — only where a provider operates a global content delivery or email network — member states of the European Union and the United Kingdom.

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through written contracts and data processing terms, and by choosing Australian data residency where it is offered.

10. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

• Encryption of information in transit and at rest
• Access controls that limit staff access to what a person's role requires, reviewed periodically
• Secure authentication, including support for one-time sign-in codes, and enforced separation between user and administrative access
• Logical isolation of each user's records, so one account cannot read another's data
• Monitoring and logging of access and system activity, and automated protection against abuse
• Secure development practices, including code review and dependency maintenance
• Regular backups, held securely and tested for recovery
• Documented incident response and data breach procedures
• Confidentiality obligations and privacy training for staff

No system can be guaranteed completely secure. Please use a strong, unique password and keep your sign-in details private.

10.1 Data breach notification. If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will notify any affected school without undue delay.

We maintain an internal Information Security Policy and Data Breach Response Plan describing these measures in detail. Both are available to schools, education authorities and privacy assessors on request.

11. Data Retention

• We retain personal information only while it is needed for the purposes described in this policy, or while your account remains open.
• When you close your account, or a school closes it on your behalf, we delete or de-identify your personal information within a reasonable period.
• Copies may persist in secure backups for a limited period after deletion, before those backups are cycled out.
• We keep some records for longer where the law requires it — for example financial and transaction records for taxation purposes — and we keep them only for that purpose.
• If you unsubscribe from email, we keep a record of that address on a suppression list — including after an account is deleted — so that we can keep honouring your unsubscribe.
• De-identified, aggregated statistics that cannot identify an individual may be retained indefinitely.

Our internal Data Retention and Deletion Policy sets out the specific retention periods and deletion workflow, and is available to schools, education authorities and privacy assessors on request.

13. School Accounts

Where a school engages us to provide the Services to its students, the school administers those accounts. In that arrangement:

• We handle student personal information on the school's behalf and in accordance with our agreement with the school.
• The school is responsible for the notices and consents required under its own privacy obligations before student accounts are created.
• Teachers and school administrators can see the learning information relevant to their students' progress.
• The school may request an exportof a student's information, a correction to it, or its deletion, and we will action the request on the timeframes in section 12.
• Students and parents can also contact us directly, and we will respond and, where appropriate, refer the request to the school.
• When a school's agreement with us ends, we return or delete student information in accordance with that agreement.

Schools can request our School Data Processing Addendum, which sets out these responsibilities in full, from our Privacy Officer.

14. Marketing

• Account and service notifications — such as sign-in codes, password resets, billing notices and important changes — are part of providing the Services, and cannot be unsubscribed from while your account is open.
• Educational announcements — new subjects, features and study resources — are sent occasionally, and you can opt out at any time.
• Marketing and promotional email — including progress summaries and offers we send to a parent or guardian email address given to us — is sent on an opt-out basis to people who have signed up or given us their address, and stops as soon as you unsubscribe. We do not send it to anyone who has unsubscribed, and we do not buy or rent mailing lists.
• Every marketing and announcement email includes an unsubscribe link, and you can also opt out by emailing us. We action unsubscribe requests promptly.
• We do not conduct third-party advertising, and we never allow advertising to be targeted using student data. We do not disclose your information to advertisers, ad networks or data brokers.

15. Changes to This Policy

We may update this policy from time to time. Each version carries the effective date shown at the top of this page, and a summary of what changed.

When we publish a new version, every signed-in user is shown a notice in the platform summarising the changes, with links to the full documents, and is required to review and explicitly accept the updated Privacy Policy and Terms of Use before continuing to use the Services. Anyone who does not wish to accept can log out and contact us to close their account. We keep a record of each acceptance. Where a school administers accounts, we also notify the school.

16. Contact Us and Complaints

Questions, requests and privacy complaints go to our Privacy Officer:

Privacy Officer, activATAR
Email: hello@activatar.com.au

Making a complaint. If you think we have breached the Australian Privacy Principles or otherwise mishandled your personal information, tell us using the details above and mark your message as a privacy complaint. We will acknowledge it within 7 days, investigate what happened, and write to you with our findings and what we intend to do about them — normally within 30 days.

If you are not satisfied with our response, you can refer the complaint to the Office of the Australian Information Commissioner (OAIC), which can review it independently.

Plain-English FAQ

The same information in fewer words. The sections above are the policy that applies.