Privacy Policy

We collect information you provide directly to us, such as when you create an account, subscribe to our service, or contact us for support.

**Personal Information:** - Parent/guardian name and email address - Student first name, grade level, and target exam year - School information (optional) - Payment information (only after the beta ends — we do not collect or store any payment details from beta members)

**Usage Information:** - Learning progress and assessment results - Time spent on activities - Feature usage patterns - Device and browser information

SmartPrepAI is operated by Axient AI Pty Ltd, an Australian company. We are bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme administered by the Office of the Australian Information Commissioner (OAIC).

**Our APP Commitments:** - **APP 1 – Open and transparent management:** This policy describes how we manage personal information and how you can make a complaint. - **APP 2 – Anonymity and pseudonymity:** Where practicable, you may interact with us without identifying yourself. Student profiles use first names only. - **APP 3 – Collection of solicited personal information:** We only collect personal information that is reasonably necessary for our educational services. - **APP 5 – Notification of collection:** We notify you at or before the time of collection about what we collect and why. - **APP 6 – Use and disclosure:** We only use or disclose personal information for the primary purpose for which it was collected, or a directly related secondary purpose you would reasonably expect. - **APP 8 – Cross-border disclosure:** Where data is processed overseas (e.g. cloud hosting, AI providers), we take reasonable steps to ensure the overseas recipient complies with the APPs. - **APP 11 – Security of personal information:** We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. - **APP 12 – Access to personal information:** You may request access to the personal information we hold about you at any time. - **APP 13 – Correction:** You may request correction of inaccurate or out-of-date information.

**Regulator:** The OAIC is the independent regulator responsible for privacy in Australia. If you are unsatisfied with our handling of your complaint, you may lodge a complaint with the OAIC at www.oaic.gov.au.

**Notifiable Data Breaches:** In the event of an eligible data breach likely to result in serious harm, we will notify affected individuals and the OAIC as required under the NDB scheme.

SmartPrepAI is built for school students, and protecting children's information is central to how we operate.

- **Under 13:** a parent or guardian is the sole consent authority. We require verifiable parental consent before collecting a child's personal information, and a parent can review, correct, or delete their child's information at any time. - **Under 16:** any sharing of a student's data with a tutor, tutoring practice, or school requires active parental consent **and** a distinct parental approval — a link alone is never enough. - **16 and over:** students are their own consent authority. They may use SmartPrepAI, and consent to (or decline) tutor, practice, and school connections, **with or without a parent linked** to their account. - **Safety:** at every age, a student can reach our safety and help tools directly. - **Student profiles use first names only** wherever practicable (APP 2).

For users outside Australia, we also observe the Children's Online Privacy Protection Act (COPPA) for US children under 13 and applicable GDPR provisions for EU/EEA children. These supplement — they do not replace — our primary obligations under the Australian Privacy Act 1988 (Cth).

We use the information we collect to:

- Provide, maintain, and improve our educational services - Personalise learning experiences based on student performance - Generate progress reports for parents and students - Send transactional communications (account updates, subscription notices) - Respond to your questions and requests - Monitor and analyse trends and usage - Detect, investigate, and prevent fraudulent transactions and abuse - Comply with legal obligations under Australian law

We do not sell, trade, or rent your personal information to third parties.

**We may share information:** - With service providers who perform services on our behalf (payment processing, analytics, hosting) - To comply with legal obligations or respond to lawful requests from Australian courts or regulators - To protect our rights, privacy, safety, or property - In connection with a merger, acquisition, or sale of assets (with notice to you)

**Cross-Border Disclosure (APP 8):** Your data is stored in Australia (see "Where Your Data Is Stored"). The primary overseas disclosure is AI processing by Anthropic in the United States, limited to what each task requires and never used to train third-party models. Some communication and analytics providers may also process limited data overseas. Before any overseas disclosure we take reasonable steps to ensure the recipient handles your information consistently with the APPs.

**We never share:** - Student learning data with advertisers - Personal information for marketing purposes without consent - Information with other users unless you explicitly choose to share

We implement appropriate technical and organisational measures to protect your information (APP 11):

- Encryption of data in transit (TLS/SSL) and at rest - Secure authentication mechanisms - Employee training on data protection - Access controls limiting who can view personal information - Incident response procedures aligned with the Notifiable Data Breaches scheme

While we strive to protect your information, no method of transmission or storage is 100% secure. Please contact us immediately if you believe your account has been compromised.

Your personal information is primarily stored in **Australia**. Our database and core infrastructure run on **Supabase, hosted in the Sydney region (ap-southeast-2)**. Data is encrypted in transit (TLS) and at rest.

The one routine exception is **AI processing**. When you use our AI study assistant, feedback, or when we generate practice questions, the necessary content is sent to our AI provider (**Anthropic**, which operates in the United States) to produce a response. We send only what is needed for that task, and this data is **not used to train third-party AI models**. This is a cross-border disclosure under Australian Privacy Principle 8, and we take reasonable steps to ensure it is handled consistently with the APPs.

We do not move your data offshore for any other routine purpose.

We use a small number of trusted providers to run SmartPrepAI. Each is bound to handle personal information consistently with the Australian Privacy Principles, and we share only what each needs for its function:

- **Supabase** — database, authentication, file storage — Australia (Sydney) - **Anthropic (Claude)** — AI study assistance & question generation — United States (data minimised) - **Resend** — transactional & digest email — United States/EU - **Google Analytics / PostHog** — product analytics (only with your consent) — United States/EU - **Cloudflare Turnstile** — bot / abuse protection at sign-up — global edge - **Stripe** — payment processing (when paid plans launch) — Australia/United States

We keep a current list of sub-processors and will provide it, and answer data-handling questions, on request — email us using the details below. Schools and tutoring practices requiring a data-processing agreement can contact us directly.

We retain your information for as long as your account is active or as needed to provide you services (APP 11.2).

**Retention Periods:** - Account information: Duration of subscription plus 12 months - Learning progress data: Duration of subscription plus 6 months - Payment records: As required by Australian tax and accounting laws - Support communications: 24 months after resolution

**After Account Deletion:** - Personal information is deleted or anonymised within 30 days - Aggregated, anonymised data may be retained for research and improvement - Backup copies are purged within 90 days

Under the Australian Privacy Principles, you have the following rights regarding your information:

**Access (APP 12):** Request a copy of the personal information we hold about you **Correction (APP 13):** Update or correct inaccurate information **Deletion:** Request deletion of your personal information **Complaints:** Lodge a complaint with us or directly with the OAIC if you believe your privacy has been breached **Withdraw Consent:** Withdraw previously given consent at any time

To exercise these rights, contact us via our contact form (/contact?topic=privacy) or through your account settings.

**For international users:** If you are located in the EU/EEA, you may also have rights under the GDPR including data portability, restriction of processing, and the right to object. If you are located in the US, you may have additional rights under applicable state privacy laws.

We use cookies and similar technologies to:

- Remember your preferences and settings - Authenticate users and prevent fraud - Analyse how our service is used - Improve our platform

**Types of Cookies:** - Essential: Required for the service to function - Functional: Remember your preferences - Analytics: Help us understand usage patterns

You can control cookies through your browser settings, though some features may not function properly if cookies are disabled.

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

- Posting the new policy on our website - Sending an email notification to registered users - Displaying a prominent notice within the service

Your continued use of SmartPrepAI after changes become effective constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our privacy practices, please contact us:

**Contact:** Use our contact form at /contact?topic=privacy **Mail:** Axient AI Pty Ltd (ABN 21 688 793 151) trading as SmartPrepAI, Sydney, NSW, Australia

**Privacy Officer:** For privacy-related inquiries, our Privacy Officer can be reached via /contact?topic=privacy&subject=Privacy%20Officer%20enquiry

**External Complaints:** Office of the Australian Information Commissioner (OAIC) Website: www.oaic.gov.au | Phone: 1300 363 992

We aim to respond to all inquiries within 10 business days.