Privacy Policy

1. About IndiLearn Pty Ltd

IndiLearn Pty Ltd ("IndiLearn", "we", "us", "our") is an Australian company registered in Queensland. We develop AI-powered education tools for schools. Our registered domain is indilearn.com.au.

This Privacy Policy explains how IndiLearn collects, uses, stores, and protects personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What personal information we collect

Website visitors

When you visit indilearn.com.au, we collect:

• Analytics data via Google Analytics (GA4): page views, session duration, referral source, approximate geographic location (city/country level), device type. This data is aggregated and not personally identifiable.
• Email address, if you complete our interest registration form.

School interest registrations

When a school registers interest in IndiLearn, we collect: the contact person's name, email address, school name, and any information provided in free-text fields. We use this information only to respond to the inquiry and provide updates about pilot availability.

Pilot school participants

During active pilots, IndiLearn may collect: teacher names and contact details for support purposes, and (if using the cloud-based v1 deployment) anonymised usage statistics at the session level. We do not collect personally identifiable student data through the cloud deployment path. Student names are stored as first name and initial only, scoped to the school's own deployment.

Student data — on-premise deployment

In IndiLearn's on-premise deployment, all student data — including session data, work photographs, feedback records, and assessment results — is stored and processed on the school's own Mac mini. IndiLearn does not have access to, receive, or store student data from on-premise deployments. The school is the data controller for all student data in this configuration.

Student data — cloud deployment (v1 pilot only)

In the cloud-based v1 pilot deployment, student work is transmitted to IndiLearn's Cloudflare Worker proxy for AI processing. In this configuration:

• Student work photographs and session data are transmitted to the IndiLearn proxy server.
• Data is not stored beyond the processing of the immediate request unless explicitly agreed with the pilot school.
• No student data is used for AI model training under any circumstances.
• All transmission is encrypted using TLS 1.3.
• The school must obtain appropriate consent from parents and carers before using the cloud deployment, in accordance with DET requirements for their jurisdiction.

3. How we use personal information

We use personal information only for the purposes for which it was collected:

• Email addresses from interest registrations: to respond to inquiries and send pilot availability updates. You can unsubscribe at any time.
• Analytics data: to understand how the website is used and improve our content and user experience.
• Pilot school contact information: to provide support and communicate about the pilot programme.

We do not sell personal information to third parties. We do not use personal information for advertising. We do not share personal information with third parties except as required to operate our services (e.g., Google Analytics for website analytics) or as required by law.

4. Children's privacy

IndiLearn's products are used in school settings with children. We take children's privacy with particular seriousness:

• Student data is never used for AI model training.
• Student data is stored as minimally as possible — first name and initial only, no full names, no contact details, no photographs stored beyond immediate processing needs.
• In the on-premise deployment, student data never leaves the school network and IndiLearn has no access to it.
• Schools are responsible for obtaining appropriate consent from parents and carers as required by their jurisdiction's education department policies.

5. Data security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. These include:

• TLS encryption for all data in transit.
• Access controls limiting personal data access to IndiLearn staff who require it for their role.
• No storage of student data in cloud environments beyond immediate processing requirements.
• Regular review of our security practices.

6. Data retention

We retain personal information only as long as necessary for the purposes described in this policy:

• Interest registration email addresses: retained until you unsubscribe or request deletion.
• Pilot school contact information: retained for the duration of the pilot and up to 12 months after.
• Analytics data: retained in accordance with Google Analytics' standard retention periods.
• Student data in cloud deployment: not retained beyond the immediate processing request, unless explicitly agreed with the pilot school in writing.

7. Your rights

Under the Australian Privacy Principles, you have the right to:

• Request access to personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information (subject to legal retention requirements).
• Complain about a breach of the Australian Privacy Principles.

To exercise any of these rights, contact us at privacy@indilearn.com.au.

8. Cookies and analytics

We use Google Analytics (GA4) to collect anonymised usage data. This uses cookies stored on your device. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on or by adjusting your browser's cookie settings. We do not use advertising cookies or third-party tracking cookies.

9. Third-party services

IndiLearn's website is hosted on Cloudflare Pages. Our interest registration system uses standard form submission. In the cloud deployment pilot, AI inference is processed via Anthropic's Claude API through IndiLearn's Cloudflare Worker proxy. Each of these services has their own privacy policies which govern how they handle data.

10. Contact and complaints

For privacy questions, access requests, or complaints, contact IndiLearn's privacy contact at:

• Email: privacy@indilearn.com.au
• Post: IndiLearn Pty Ltd, Sunshine Coast, QLD, Australia

If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The date of the most recent update is shown at the top of this page. We will notify pilot school contacts of material changes by email.