Privacy Policy

Personal information you provide to us. We collect personal information you voluntarily provide when you register, subscribe, or contact us. This includes:

• Account data: email address and hashed password.
• Student profile data: first name or alias, year level, Australian state/territory, and an optional student ID code (e.g. STU-0001). We do not require full legal names, dates of birth, or government identifiers for student profiles.
• Payment data: subscription status and payment confirmation. All payment instrument data (card numbers, CVV) is handled exclusively by Stripe. We receive only a payment token and subscription status. See Stripe’s Privacy Policy at stripe.com/au/privacy.
• Uploaded curriculum files: documents you upload (e.g. school term outlines) to customise worksheet generation. These are stored securely and used solely for that purpose.
• Answer sheet images: photos you upload for AI marking. These are sent to Anthropic’s API for processing and are not stored on our servers after evaluation is complete.
• Support communications: email correspondence you send us.

Information automatically collected. When you visit or use the Services, we automatically collect certain technical information that does not directly identify you, including:

• Log and usage data: IP address, browser type, device information, pages visited, date/time stamps of usage, features used, and error reports.
• Device data: device type, operating system, browser type, and language preferences.

Sensitive information. We do not process sensitive personal information (such as racial or ethnic origins, health information, biometric data, or political opinions).

We process your personal information for the following purposes:

• To create and manage user accounts. We process your email and password so you can register, log in, and maintain your account.
• To deliver the Services. We process student profile data and usage information to generate worksheets, evaluate answers, and track progress.
• To process payments and manage subscriptions. We work with Stripe to fulfil subscription billing and manage plan changes.
• To respond to user enquiries and provide support. We process contact information and support communications to resolve issues.
• To send administrative information. We send account-related emails such as registration confirmations, subscription receipts, and important policy updates.
• To enforce fair-use limits. We log worksheet generation and AI evaluation events to enforce daily and monthly usage limits per subscription tier.
• To protect the Services. We process usage data to detect abuse, fraud, and security threats.
• To identify usage trends and improve the Services. We analyse anonymised, aggregated usage patterns to improve the platform.
• To comply with legal obligations. We process information where required by law, including cooperating with law enforcement or regulatory agencies.

We only process your personal information when we have a valid legal reason to do so. Our legal bases include:

• Performance of a contract. Processing necessary to fulfil our contractual obligations to you, including providing the Services and processing payments.
• Legitimate interests. Processing reasonably necessary to achieve our legitimate business interests (e.g., service improvement, fraud prevention, security), where those interests do not override your fundamental rights and freedoms.
• Legal obligations. Processing required to comply with applicable law.
• Consent. Where we rely on consent (e.g. for non-essential communications), you may withdraw consent at any time by contacting us.

We may share your personal information with third-party vendors and service providers that perform services on our behalf. We have contracts with these parties requiring them to protect your data and use it only as instructed. We do not sell personal information to any third party.

The third parties we share information with are:

• Supabase — database hosting and authentication. Data is stored on Supabase-managed infrastructure (AWS). See supabase.com/privacy.
• Anthropic — AI worksheet generation and answer evaluation. Prompts, student profile context, and uploaded images are sent to Anthropic’s API. See anthropic.com/privacy.
• Stripe — payment processing and subscription management. See stripe.com/au/privacy.
• Vercel — web hosting and deployment infrastructure. See vercel.com/legal/privacy-policy.

We may also share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. We will notify you of any such change before it takes effect.

We may disclose your information where required by law, court order, or in connection with legal proceedings.

We retain your personal information for as long as your account is active, or as necessary to provide the Services and comply with our legal obligations. No purpose in this notice will require us keeping your personal information for longer than the period of time in which you have an active account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. If deletion is not immediately possible (e.g. because information is stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

You may request deletion of your account and all associated data at any time by emailing vkquantumapex@gmail.com. We will process deletion requests within 30 days.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These include:

• TLS/HTTPS encryption for all data in transit;
• bcrypt hashing for passwords — we never store plaintext passwords;
• row-level security (RLS) policies on our Supabase database ensuring users can only access their own data;
• access controls restricting data access to authorised personnel only.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

In the event of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

Accounts must be created by adults (parents, guardians, or tutors aged 18 or over). We do not knowingly collect personal information directly from children under 13. Student profiles are created and managed by the adult account holder.

We limit student profile data to the minimum necessary: a name or alias, year level, and state/territory. We encourage account holders to use a first name or nickname rather than a full legal name for additional privacy.

If you believe we have inadvertently collected personal information from a child under 13 without appropriate parental consent, please contact us at vkquantumapex@gmail.com and we will take steps to delete that information.

Depending on your location, you may have rights under applicable data protection laws regarding your personal information. These may include:

• The right to know whether we are processing your personal data;
• The right to access your personal data;
• The right to correct inaccurate information;
• The right to request the deletion of your personal data;
• The right to obtain a copy of the personal data you previously shared with us; and
• The right to non-discrimination for exercising your rights.

Account information. You may review or update information in your account by logging in to your account settings. To terminate your account, email us at vkquantumapex@gmail.com. We will deactivate or delete your account and information from our active databases. We may retain some information in our files to prevent fraud, troubleshoot problems, or comply with applicable legal requirements.

To exercise any of your privacy rights, please contact us at vkquantumapex@gmail.com. We will consider and act upon requests in accordance with applicable data protection laws within 30 days.

Most web browsers include a Do-Not-Track (“DNT”) feature or setting. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you in a revised version of this Privacy Notice.

As an Australian company, we collect and process your personal information under the obligations and conditions set by Australia’s Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

This Privacy Notice satisfies the notice requirements defined in the Privacy Act, including what personal information we collect, from which sources, for which purposes, and other recipients of your personal information.

At any time, you have the right to request access to or correction of your personal information by contacting us using the details in Section 12 below.

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Australian Consumer Law. Nothing in this Privacy Policy excludes, restricts, or modifies any rights or guarantees that cannot be excluded under the Australian Consumer Law, including consumer guarantees that the Service will be of acceptable quality and fit for the purpose for which it was supplied.

Yes, we will update this Privacy Notice from time to time to stay compliant with relevant laws and to reflect changes in our data practices. The updated version will be indicated by an updated “Last updated” date. If we make material changes to this Privacy Notice, we will notify you either by prominently posting a notice or by directly sending you an email notification. We encourage you to review this Privacy Notice frequently to stay informed of how we are protecting your information.

If you have questions or comments about this Privacy Notice, please contact us:

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or request deletion of your personal information. To request to review, update, or delete your personal information, please email vkquantumapex@gmail.com with your request. We will respond within 30 days and action the request in accordance with applicable data protection laws.