Privacy Policy

1. Information We Collect

2. Anonymity

An account with verified details is required to use our services, so we do not offer anonymous or pseudonymous access to the platform. You can contact us, give feedback or make a privacy complaint without identifying yourself.

3. Data Quality

We take reasonable steps to ensure the personal information we collect and hold is accurate, up-to-date, and complete. We review all uploaded questions to ensure accuracy and quality of content on the platform.

4. How We Use Your Information

Your account information (name, email, school) is used to manage your account, communicate service updates, and ensure platform security.

Your exam responses are used to:

• Provide AI-powered grading and personalised feedback
• Track learning progress and identify areas for improvement

We do not use any data for advertising or for training AI models. OpenAI, which grades your responses, and Google, which processes exam papers that teachers upload, do not use that data to train their models.

We may also generate aggregated, de-identified performance data from exam results across the platform (for example, average scores per question or subject). This data cannot be used to identify individual users and may be displayed to help students understand how their results compare to others. Aggregated, de-identified data is not considered personal information under the Privacy Act 1988 (Cth).

5. Information Sharing

We do not sell, rent, or trade personal information. We may share data only in these limited cases:

• Service Providers: With trusted providers who help us operate the platform, including Supabase for authentication and database services (hosted on AWS servers in Sydney, Australia), OpenAI for AI-powered grading and feedback, Google (Gemini API) for converting exam papers that teachers upload into questions and marking guides, Amazon Web Services for hosting our application servers, sending account emails and storing backups in Sydney, Australia, Google Analytics for usage statistics, and Stripe for secure payment processing.
• Legal Requirements: Where the disclosure is required or authorised by Australian law or a court or tribunal order, where we reasonably believe it is necessary to lessen or prevent a serious threat to the life, health or safety of a person, or where it is reasonably necessary for the activities of an enforcement body. Where the law allows, we will tell the school before we disclose a school user's data in response to such a request.

We take reasonable steps to ensure all service providers comply with Australian privacy standards.

Our service providers (sub-processors)

We share personal information with these providers only to run AusGrader for you, which is the purpose we collected it for (APP 6.1). Each provider is bound by a contract that limits its use of the data to providing its service to us, and none may use it for its own purposes, except as noted for Stripe below. Where data is processed outside Australia, we rely on those contractual protections (APP 8.1), and on your consent at sign-up or, for school users, your school's agreement under the School Terms.

Student work leaves Australia only when it is sent to OpenAI for grading. Exam papers and marking guides that teachers upload go to Google to be converted into questions and marking guides. Your email address and billing details go to Stripe. Vercel serves the web app from its global network and sees IP addresses. Google Analytics receives usage statistics and IP addresses. A school can ask us to switch analytics off for its users; once switched off, no analytics run while its users are signed in to the web app.

Each of these providers processes data under its published terms and a data processing agreement or equivalent contractual data protection terms, only to the extent needed to provide its service to us, and maintains appropriate technical and organisational security measures. Stripe also uses payment data for its own fraud prevention and legal obligations, as described in its privacy policy.

6. Data Security

Your account and academic data, backups and application logs are stored on AWS servers in Sydney, Australia. Section 7 lists the limited cases where data is processed elsewhere. We use industry-standard measures including encryption, secure authentication, and access controls to protect your information.

If a data breach occurs that is likely to cause serious harm, we will promptly notify affected users and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

7. Cross-Border Data Disclosure

Your account information and learning data is stored in Sydney, Australia.

To grade your work, we send exam questions and your responses to OpenAI in the United States. We do not send your name, email address or school with grading requests. Neither AusGrader nor OpenAI uses them to train AI models. You agree to this transfer when you accept these terms at sign-up. If you use AusGrader through your school, your school has agreed to it on your behalf under the School Terms.

Exam papers and marking guides that teachers upload are sent to Google (Gemini) to turn them into questions. Google's terms state this data may be stored or cached in any country where Google or its agents maintain facilities, so it is not limited to a single country. These uploads do not include student accounts or answers. Scanned student answer papers that teachers upload for marking are student work and are graded via OpenAI, as above.

If you start a purchase, Stripe processes your email address and payment details in the United States and other countries where Stripe or its service providers operate, including the EU and India. AusGrader never stores your card details.

Google Analytics receives usage statistics and IP addresses. Google may process this data in the United States or other countries where it operates data centres.

Vercel serves the website from its global network and keeps request logs, including IP addresses, for one day.

8. Educational Privacy

As an education-focused platform, we only collect the information necessary to provide our services. Student data is used solely to support learning and improve outcomes, not for advertising or unrelated purposes.

If you use AusGrader through your school, teachers at your school can see your responses, grades and feedback. Your school can ask us to delete your school-linked data or to switch analytics off for its users, as set out in our School Terms.

9. Data Retention

We keep account and academic data while your account is active or as long as needed to provide services. Once information is no longer required for educational, legal, or security purposes, it will be securely deleted or de-identified.

You can delete your account and associated data yourself at any time from your Profile page, or ask us to delete it. When we delete an account on request, we will confirm by email once it is done.

Backups of our database and uploaded files are kept for 100 days in Sydney, Australia. Data you delete is removed from live systems straight away and from backups within 100 days.

Application logs are kept for 12 months in Sydney, Australia, for security monitoring. They record IP addresses and account identifiers.

Grading requests sent to OpenAI are not stored for training. OpenAI may keep a request for up to 30 days to check for misuse, then deletes it. Teacher uploads sent to Google (Gemini API) are kept for up to 55 days for the same purpose, then deleted.

10. Cookies and Tracking

We use essential cookies to:

• Keep you logged in
• Remember preferences
• Maintain security

We use Google Analytics cookies on the website and web app to understand how the platform is used and improve it. Analytics is switched off for the users of any school that asks us to disable it. You can manage cookie settings in your browser, but disabling essential cookies may affect functionality.

11. Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate or incomplete information
• Request deletion of your account and data
• Opt out of non-essential communications
• Export your learning progress data

We respond to access, correction and export requests within a reasonable timeframe, usually within 30 days. Deletion requests are handled as described in Section 9.

We only send marketing email to people who have opted in to it, and every marketing email includes an unsubscribe link. Service emails (verification, password reset, security or outage notices, and changes to these terms) are not marketing.

12. Age Requirements and Parental Consent

AusGrader is designed for users aged 13 years and above.

• You must be at least 13 years old to create an account.
• If you are under 18 years of age, you must have consent from a parent or legal guardian to use this service.
• Parents and guardians who consent to their child's use of AusGrader also consent to our collection and use of their child's information as described in this Privacy Policy.

If you use AusGrader through your school, your school has agreed to our School Terms and is responsible for obtaining any consent needed from you or your parent or guardian. You do not need to confirm parental consent yourself.

13. International Users

AusGrader is designed for Australian students across all states and territories. Users from other locations may also access the platform. Account and learning data is stored on AWS servers in Sydney, Australia. However, as outlined in Section 7, exam questions and responses are processed by our AI providers for grading purposes and may be transferred to servers outside Australia.

14. Mobile Apps

This policy also applies to the AusGrader iOS and Android apps. The apps ask for camera and photo access only when you choose to photograph or upload work, and do not access your location or contacts. The apps do not run Google Analytics. The apps check for updates from our own servers in Sydney.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email or in the app at least 1 day before a material change takes effect, unless the change is required by law or reduces what we collect. Schools receive written notice under the School Terms. Continued use after a change takes effect indicates acceptance of the updated policy.

16. Contact Us

For questions, requests, or complaints about this policy, please contact our Privacy Officer at:

info@ausgrader.com

We will acknowledge a privacy complaint within 7 days, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.