Privacy Policy

We collect information you provide directly to us, such as when you create an account, subscribe to our service, or contact us for support.

**Personal Information:** - Parent/guardian name and email address - Student first name, grade level, and target exam year - School information (optional) - Payment information (only after the beta ends — we do not collect or store any payment details from beta members)

**Usage Information:** - Learning progress and assessment results - Time spent on activities - Feature usage patterns - Device and browser information

SmartPrepAI is operated by Axient AI Pty Ltd, an Australian company. We are bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme administered by the Office of the Australian Information Commissioner (OAIC).

**Our APP Commitments:** - **APP 1 – Open and transparent management:** This policy describes how we manage personal information and how you can make a complaint. - **APP 2 – Anonymity and pseudonymity:** Where practicable, you may interact with us without identifying yourself. Student profiles use first names only. - **APP 3 – Collection of solicited personal information:** We only collect personal information that is reasonably necessary for our educational services. - **APP 5 – Notification of collection:** We notify you at or before the time of collection about what we collect and why. - **APP 6 – Use and disclosure:** We only use or disclose personal information for the primary purpose for which it was collected, or a directly related secondary purpose you would reasonably expect. - **APP 8 – Cross-border disclosure:** Where data is processed overseas (e.g. cloud hosting, AI providers), we take reasonable steps to ensure the overseas recipient complies with the APPs. - **APP 11 – Security of personal information:** We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. - **APP 12 – Access to personal information:** You may request access to the personal information we hold about you at any time. - **APP 13 – Correction:** You may request correction of inaccurate or out-of-date information.

**Regulator:** The OAIC is the independent regulator responsible for privacy in Australia. If you are unsatisfied with our handling of your complaint, you may lodge a complaint with the OAIC at www.oaic.gov.au.

**Notifiable Data Breaches:** In the event of an eligible data breach likely to result in serious harm, we will notify affected individuals and the OAIC as required under the NDB scheme.

SmartPrepAI is built for school students, and protecting children's information is central to how we operate.

- **Under 13:** a parent or guardian is the sole consent authority. Younger students cannot create their own SmartPrepAI account: for any student below Year 10, a parent or guardian must create the account and give express consent before we collect the child's personal information. We use the student's declared school year level as our age indicator. A parent can review, correct, or delete their child's information at any time. - **Under 16:** any sharing of a student's data with a tutor, tutoring practice, or school requires active parental consent **and** a distinct parental approval — a link alone is never enough. - **16 and over:** students are their own consent authority. They may use SmartPrepAI, and consent to (or decline) tutor, practice, and school connections, **with or without a parent linked** to their account. - **Safety:** at every age, a student can reach our safety and help tools directly. - **Student profiles use first names only** wherever practicable (APP 2).

For users outside Australia, we also observe the Children's Online Privacy Protection Act (COPPA) for US children under 13 and applicable GDPR provisions for EU/EEA children. These supplement — they do not replace — our primary obligations under the Australian Privacy Act 1988 (Cth).

We use the information we collect to:

- Provide, maintain, and improve our educational services - Personalise learning experiences based on student performance - Generate progress reports for parents and students - Send transactional communications (account updates, subscription notices) - Respond to your questions and requests - Monitor and analyse trends and usage - Detect, investigate, and prevent fraudulent transactions and abuse - Comply with legal obligations under Australian law

We do not sell, trade, or rent your personal information to third parties.

**We may share information:** - With service providers who perform services on our behalf (payment processing, analytics, hosting) - To comply with legal obligations or respond to lawful requests from Australian courts or regulators - To protect our rights, privacy, safety, or property - In connection with a merger, acquisition, or sale of assets (with notice to you)

**Cross-Border Disclosure (APP 8):** Your data is stored in Australia (see "Where Your Data Is Stored"). The primary overseas disclosure is AI processing by Anthropic in the United States, limited to what each task requires and never used to train third-party models. Some communication and analytics providers may also process limited data overseas. Before any overseas disclosure we take reasonable steps to ensure the recipient handles your information consistently with the APPs.

**We never share:** - Student learning data with advertisers - Personal information for marketing purposes without consent - Information with other users unless you explicitly choose to share

We implement appropriate technical and organisational measures to protect your information (APP 11):

- Encryption of data in transit (TLS/SSL) and at rest - Secure authentication mechanisms - Employee training on data protection - Access controls limiting who can view personal information - Incident response procedures aligned with the Notifiable Data Breaches scheme

While we strive to protect your information, no method of transmission or storage is 100% secure. Please contact us immediately if you believe your account has been compromised.

Your personal information is primarily stored in **Australia**. Our database and core infrastructure run on **Supabase, hosted in the Sydney region (ap-southeast-2)**. Data is encrypted in transit (TLS) and at rest.

The largest routine exception is **AI processing**. When you use our AI study assistant, feedback, or when we generate practice questions, the necessary content is sent to our AI provider (**Anthropic**, which operates in the United States) to produce a response. We send only what is needed for that task, and this data is **not used to train third-party AI models**. This is a cross-border disclosure under Australian Privacy Principle 8, and we take reasonable steps to ensure it is handled consistently with the APPs.

A small number of other named providers also process limited data outside Australia for specific functions — error monitoring, email delivery, analytics and (when paid plans launch) payments. Each is listed in the next section with its function and location. Your core student data — account, learning records and files — stays in Sydney.

We use a small number of trusted providers to run SmartPrepAI. Each is bound to handle personal information consistently with the Australian Privacy Principles, and we share only what each needs for its function:

- **Supabase** — database, authentication, file storage — Australia (Sydney) - **Anthropic (Claude)** — AI study assistance & question generation — United States (data minimised) - **Resend** — transactional & digest email — United States/EU - **Google Analytics / PostHog** — product analytics (only with your consent) — United States - **Sentry** — error monitoring & crash reporting — Germany/United States - **Cloudflare Turnstile** — bot / abuse protection at sign-up — global edge - **Stripe** — payment processing (when paid plans launch) — Australia/United States

We keep a current list of sub-processors and will provide it, and answer data-handling questions, on request — email us using the details below. Schools and tutoring practices requiring a data-processing agreement can contact us directly.

We keep your information only for as long as your account is active and being used to provide the service, consistent with APP 11.2 (data minimisation).

**Active-use retention.** Your personal information (profile, practice history, wellbeing data, avatar) is kept while the account is active. An account is "active" if you (or a linked account in your household) sign in, run a practice session, open a weekly digest, or take any authenticated action within a rolling 12-month window.

**Automatic closure on inactivity.** If an account has no qualifying activity for 12 consecutive months, we send four notifications — at 90 days, 60 days, 30 days, and 3 days before closure — (see Terms §"Account Inactivity & Automatic Closure" for detail) and then automatically close the account, deleting all associated personal information. This applies to every account type — student, parent, tutor, school administrator — with the household-linkage rule above.

**Explicit deletion request.** You can also request immediate deletion of your account at any time from account settings or by emailing us; we act within 30 days.

**After closure.** We delete or de-identify personal information within 30 days of closure — including practice results, wellbeing records, avatar files in storage, and analytics events tied to your identity. Backup copies (Supabase point-in-time recovery, held automatically by our infrastructure provider) are purged on the standard rolling window, currently 7 days.

**What is retained, and why.** Financial transaction records are held by Stripe (our payment processor) for 5 years to meet Australian tax and accounting obligations — that record is in Stripe's system, not ours; you can request Stripe's own privacy disclosures via us. Aggregated, non-identifying platform statistics (question difficulty calibration, exam-window analytics) may be retained indefinitely because they cannot be traced back to you.

**Sub-processors and backups.** We use Supabase (data hosting, Sydney), Vercel (frontend delivery), Anthropic (AI features), Stripe (payments), Resend (email), Cloudflare Turnstile (bot protection), Sentry (error monitoring), and PostHog + Google Analytics (product analytics). Each processes only the data required for its function; retention within each vendor follows the vendor's own policy plus any narrower limit we impose above. Online backups will be added as we grow; we will update this section when that happens.

Under the Australian Privacy Principles, you have the following rights regarding your information:

**Access (APP 12):** Request a copy of the personal information we hold about you **Correction (APP 13):** Update or correct inaccurate information **Deletion:** Request deletion of your personal information **Complaints:** Lodge a complaint with us or directly with the OAIC if you believe your privacy has been breached **Withdraw Consent:** Withdraw previously given consent at any time

To exercise these rights, contact us via our contact form (/contact?topic=privacy) or through your account settings.

**For international users:** If you are located in the EU/EEA, you may also have rights under the GDPR including data portability, restriction of processing, and the right to object. If you are located in the US, you may have additional rights under applicable state privacy laws.

We use cookies and similar technologies to:

- Remember your preferences and settings - Authenticate users and prevent fraud - Analyse how our service is used - Improve our platform

**Types of Cookies:** - Essential: Required for the service to function - Functional: Remember your preferences - Analytics: Help us understand usage patterns

You can control cookies through your browser settings, though some features may not function properly if cookies are disabled.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

- Posting the new policy on our website - Sending an email notification to registered users - Displaying a prominent notice within the service

Your continued use of SmartPrepAI after changes become effective constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our privacy practices, please contact us:

**Contact:** Use our contact form at /contact?topic=privacy **Mail:** Axient AI Pty Ltd (ABN 21 688 793 151) trading as SmartPrepAI, Sydney, NSW, Australia

**Privacy Officer:** For privacy-related inquiries, our Privacy Officer can be reached via /contact?topic=privacy&subject=Privacy%20Officer%20enquiry

**External Complaints:** Office of the Australian Information Commissioner (OAIC) Website: www.oaic.gov.au | Phone: 1300 363 992

We aim to respond to all inquiries within 10 business days.