Privacy Policy

Who we are

ClassABC is provided by Speech Pathology for Schools to Australian schools. Schools are the controllers of the student information they enter; we handle it on their behalf and only to provide the service. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Information we collect

• Staff accounts: name, school email address, role, school and class membership, sign-in history.
• Student records entered by the school: name, student identifier, class, year level, date of birth, gender, assessment results, planning notes and reports.
• Technical information: IP address, browser type, and security and audit logs.
• We do not collect information directly from students, and students do not have accounts.

How we use information

• To provide literacy planning, assessment tracking and reporting for the school.
• To secure the service: authentication, fraud and abuse prevention, and audit logging.
• To support the school when staff contact us.
• We do not sell personal information, use it for advertising, or use student information to train AI models.

AI features

The teaching assistant uses a large language model hosted by OpenAI in the United States. Before any request leaves our systems, student names are replaced with tokens such as "Student 1" and other identifiers are redacted. Requests are sent with storage disabled. See our AI transparency statement for details.

Where information is stored

Student and staff records are stored in Australia (Sydney). A small number of service providers process limited information overseas, as set out in our subprocessor list. We take reasonable steps under APP 8 to ensure those providers protect the information.

Security

• Encryption in transit (TLS) and at rest.
• Each school's data is isolated with database row-level security.
• Single sign-on, session timeouts, and multi-factor authentication for administrators.
• Audit logging of changes to and exports of student records, and regular security testing.

Retention and deletion

School administrators can export or erase an individual student's record at any time. When a school's subscription ends we delete its data within 90 days, unless the school asks for an export first. Audit logs are kept for 12 months and AI conversation memory for 30 days. Backups expire within 30 days of deletion.

Access, correction and complaints

Requests to access or correct student information should go to the student's school, which controls the record. Staff can contact us directly. To make a privacy complaint, contact the privacy contact listed in your school's service agreement. We aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Data breaches

If a data breach is likely to cause serious harm, we notify the affected schools without undue delay and support them in notifying individuals and the OAIC under the Notifiable Data Breaches scheme.