Privacy Policy

1. Who this Policy covers

This Policy applies to:

• parents and guardians who create accounts;
• students whose profiles are created by a parent or an organisation;
• teachers and organisation administrators;
• visitors to our website, including people who contact us or request a resource.

2. The information we collect

We may collect:

• Account information: name, email address, username, password (stored by our authentication provider in hashed form), role, organisation, year level, and profile photo.
• Student learning information: practice answers, examination answers, scores, time taken, skills attempts, mastery or progress summaries, and related activity logs.
• Billing information: plan, subscription status, and payment metadata. Card details are processed by Stripe and are not stored in full on our systems.
• Support and communications: messages you send us, including through the contact form.
• Technical information: IP address, device and browser type, approximate location derived from IP address, pages viewed, and diagnostic logs.
• Marketing information: name and email if you request a guide or newsletter, and related campaign details.
• Cookie and analytics information, as described in the Cookie Policy.

We do not require students to provide a personal email address. Student accounts are typically created with a service username under the control of a parent or organisation.

3. How we collect information

We collect information:

• directly from you when you create an account, complete a profile, submit answers, make a payment, or contact us;
• from a parent, guardian, teacher, or organisation administrator who creates or manages a student account;
• automatically when you use the Service, including through cookies, logs, and analytics tools;
• from service providers that process payments, authentication, email, or security checks.

4. Why we use personal information

We use personal information to:

• create and administer accounts and keep the Service secure;
• deliver practice, skills, examinations, and progress reporting;
• personalise learning content and measure progress over time;
• process subscriptions, invoices, and seat or licence changes;
• detect abuse, fraud, and security incidents;
• respond to support requests and legal obligations;
• improve the Service, including by reviewing aggregated usage patterns;
• send service messages about your account; and, where you have agreed, marketing messages that you can unsubscribe from.

We rely on one or more of the following grounds: performance of a contract; consent (including parental or organisational authority for a student); our legitimate interests in operating a secure educational service; and compliance with law.

5. Children’s information

We treat student learning information as sensitive educational information. A parent, guardian, or authorised organisation must create the student account and is responsible for the authority to provide that information to us.

We do not use student learning information to advertise third-party products to children. We do not sell personal information. Student profiles should not include more information than is needed to operate the Service.

6. Who we share information with

We share personal information only as needed to operate the Service or as required by law. Our main categories of recipients are:

• Google Firebase, for authentication, database, file storage, and application hosting.
• Stripe, for payment processing.
• PostHog, for product analytics if you have accepted analytics cookies.
• AI model providers, to generate or validate educational content. We send the prompts and context needed for that task and do not use those transfers to sell student profiles.
• Email and forms providers, such as our transactional or marketing email tools and the contact-form processor.
• Error-monitoring and security providers, such as Sentry and bot-protection services.
• Your organisation, if you are a student, teacher, or administrator on an organisation plan, so that authorised staff can manage learning and licences.
• A parent or guardian linked to a student account, so they can view progress and manage the account.
• Professional advisers or a competent authority if required by law or to protect a person’s safety.

Some providers store or process information outside New Zealand. Where that occurs, we take steps we consider reasonable to ensure the information is protected in a way that is comparable to the Privacy Act 2020.

7. How long we keep information

We keep personal information only as long as we need it for the purposes in this Policy, including:

• account records, while the account is active and for a reasonable period afterwards to handle billing, disputes, or legal claims;
• examination results in identifiable form, generally up to 24 months, with longer-term progress kept as summaries;
• practice question results in identifiable form, generally up to 12 months;
• progress summaries, while the student or organisation relationship continues;
• security and diagnostic logs, for a shorter operational period unless needed for an investigation;
• marketing contacts, until the person unsubscribes or asks us to delete the record.

8. Security

We use access controls, encrypted transport, authenticated sessions, and role-based permissions to protect personal information. No internet service is completely secure. Please use a strong unique password and tell us if you suspect unauthorised access.

9. Your rights

You may request access to, correction of, or deletion of personal information we hold about you, subject to legal exceptions. A parent or authorised organisation may make a request for a student they control.

To make a request, email contact@stud-e.app. We may need to verify your identity and authority. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

10. Automated processing

We use automated systems, including AI, to generate questions, explanations, and scores. These systems support learning and reporting. They do not make legal or similarly significant decisions about a person, such as school enrolment or credit, without human involvement.

11. Changes to this Policy

We may update this Policy from time to time. The current version is published on this page. If a change is material, we will take reasonable steps to notify account holders. The “Last updated” date and version number show when the Policy last changed.

12. Contact

Privacy questions and requests should be sent to contact@stud-e.app or through our contact page.