Third-party services and data access
Our full sub-processor register — every provider, what it receives, why, on what basis, and where.
Running activATAR means relying on a handful of trusted, established service providers for things like hosting, email, and analytics. We keep this list deliberately small, and we choose providers with strong security practices.
This is our sub-processor register. Every provider that handles personal information on our behalf is listed below — none is omitted — together with what it receives, why, the legal basis for it, and the country it processes it in.
How we work with providers
- Each provider only receives the data it needs to do its specific job — nothing more.
- Each is engaged under written data processing terms that restrict use of the data to performing that job for us.
- No provider may sell your data, use it for its own advertising or market research, or use it to train artificial intelligence or machine learning models.
- Our primary records — accounts, learning activity and files — are held in Sydney, Australia.
The services we use
The table scrolls sideways on narrow screens. “Lawful basis” is the legal ground under the Australian Privacy Principles on which we disclose the information.
| Provider | What we send it | Purpose | Lawful basis | Processed in |
|---|---|---|---|---|
| Account credentials; profile details including name, login email, optional parent email, year level, school and subjects; learning activity and question attempts. No student, parent or teacher file uploads — the product has no upload path. | The primary database, authentication service and file store holding core student records. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | Australia (Sydney). Vendor support may access infrastructure from the United States. | |
| Request metadata, IP address, device and browser information, page views, and error logs. | Running the site and diagnosing technical faults. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | Australia (Sydney), with pages cached on a global network. Vercel is a United States company, so platform administration occurs there. | |
| IP address and browser challenge data, from the anti-bot check on sign-up and account forms. Nothing else — the cosmetic items we serve from Cloudflare contain no personal information. | Blocking bots and abuse on sign-up forms, and serving cosmetic assets. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | United States, with a global network including Australia, the EU and the UK. | |
| The question text, the marking criteria, the written answer you submitted, and a randomly generated internal account number used only to attribute usage. No name, email address or contact details. | Generating criterion-level feedback and marks on written long-answer responses. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | United States. | |
| Display name, avatar configuration, and in-match answers and scores — held only while the match is running. | Running live multiplayer quiz matches. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | Australia (Sydney). | |
| Name, email address, billing address and payment details. Card numbers are collected by Stripe directly — activATAR never receives or stores them. | Taking payment for paid plans, managing subscriptions, and fraud prevention. Schools are invoiced directly, so no student financial data is processed in school deployments. | Necessary to provide the Services (APP 6.1(a)), and required for our financial record-keeping obligations. | Australia and the United States. | |
| Name, email address, and email delivery and engagement events. | Sending access codes, password resets, account and service notices, marketing email you have opted into, and handling unsubscribes. | Service email: necessary to provide the Services (APP 6.1(a)). Marketing email: your consent, which you can withdraw at any time. | Japan (Tokyo). Resend is a United States company, so account administration occurs there. | |
| A pseudonymous account identifier, feature and page usage events, device and browser information, and IP address. | Understanding how the platform is used so we can prioritise and fix issues. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | United States. No Australian region is offered. | |
| A pseudonymous cookie identifier, page views, referrer, device and browser information, and IP address — on our public marketing pages. | Measuring aggregate traffic. Google Signals, advertising features and Google data sharing are switched off, and no advertising audiences are built from this data. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | United States, and Google's global infrastructure. | |
| Whatever you include in a message you send us, including your email address — support enquiries, feedback and educator enquiries. | Receiving and responding to your questions, feedback and school enquiries. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | Australia and the United States, and Google's global infrastructure. | |
| The content of a bug report, question error report, feedback or subject request; the page address it came from; the question identifier; and your account's internal ID number. No email address and no name is sent. Teacher and student support conversations are deliberately not sent — only a notice that a message is waiting. | Alerting our team so reports are triaged quickly. | Necessary to provide the Services — Australian Privacy Principle 6.1(a). | United States. |
Where this leaves your information
The countries in which our providers are likely to process personal information are Australia, the United States of America and Japan, and — only where a provider runs a global content delivery network — member states of the European Union and the United Kingdom. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through written contracts and by choosing Australian data residency where it is offered.
Section 8.4 of our Privacy Policy explains the terms these providers are engaged under. This page and that section are kept current as our tools change.
Sharing with schools and parents
If a student's account is linked to a school, the school can see the learning data relevant to that student's progress. If a parent account is linked, it can see what the student has chosen to share. We don't disclose personal information beyond this except with consent, or where the law requires it.
Exporting your data
You have the right to a copy of the personal information we hold about you. Requests can be made at hello@activatar.com.au, and for school accounts, through the school. We'll provide it in a common, usable format.