PRIVACY POLICY

1 Who we are, what this covers

R2 Education ("we", "us", "our") is an Australian sole‑trader business that builds and runs three practice tools for Western Australian school students:

• OLNA The OLNA Trainer — practice for the WA Online Literacy and Numeracy Assessment, for students in Years 9 to 12.
• NAPLAN The NAPLAN Trainer — NAPLAN‑style practice across numeracy, reading, language conventions and writing, for Years 3, 5, 7 and 9.
• SCHOLARSHIP The Scholarship Trainer — AAS‑style practice in reasoning, mathematics, reading comprehension and written expression for students sitting independent‑school scholarship examinations (Year 5 to Year 11 entry). It is built from the NAPLAN Trainer and handles student information the same way: where this policy says NAPLAN, read it as NAPLAN and Scholarship unless a clause says otherwise.

This policy covers the homepage at r2education.com.au, all three Trainers, and every supporting system we run for them. Where the Trainers behave differently, the difference is marked with a badge like the ones above — please read those closely, because on two points (writing storage and data location) they genuinely differ.

Read it alongside our Terms of Use and our Security Policy.

Our commitment under privacy law

R2 Education is a small business operator and may fall under the $3 million annual turnover threshold at which the Privacy Act 1988 (Cth) applies automatically. We do not rely on that exemption. We handle personal information as though bound by the Australian Privacy Principles (APPs), including the Notifiable Data Breaches scheme in Part IIIC. Where a school or department needs that commitment in a contract, we will sign it.

A WA public school is itself bound by the Privacy and Responsible Information Sharing Act 2024 (WA) and by confidentiality obligations under the School Education Act 1999 (WA). Our practices are built so a school can meet those obligations while using our Trainers, and we will help it do so.

2 Privacy at a glance

3 Our role, and who we deal with

All three Trainers are supplied either to a school, for its students, or to a family, for its own child. Which one it is shapes everything below.

3.1 SCHOOL Where a school subscribes

We are a service provider to the school. It is the school, not us, that holds the relationship with the family.

• The school decides which students get accounts, what name shows on each one, what each student can access, and what a teacher writes in a student's notes.
• The school holds the relationship with families — including any notice to parents or carers and any consent its own or its department's policies require. On a school subscription we never contact parents or carers, and have no way to: we hold no parent contact details at all.
• We act on the school's instructions for student records, and handle personal information only to run the Trainers, keep them secure, and comply with the law.

If a school needs a data processing agreement, a departmental online‑services assessment or a privacy impact assessment before deploying, email hello@r2education.com.au and we will complete it.

3.2 FAMILY Where a family subscribes

There is no school in the middle, so we deal with the parent or guardian directly. That has three consequences worth being plain about.

• We hold the parent's email address, because we have to send the login details, receipts, cancellation confirmations and any price‑change notice somewhere. This is the one category of information a family subscription adds that a school subscription does not involve. Section 4.7 lists exactly what it is.
• The parent decides what display name their child uses and what the child can access, and the parent — not a teacher — authorises the child's use.
• We contact the parent about the subscription itself: logins, receipts, service notices, policy changes. Section 16 sets out the limits, including that we do not send marketing without consent.

3.3 True on both routes

• We do not use student information for our own purposes. The only profile we build of a student is the one shown back to that student and to whoever supervises them.
• We never contact a student directly. Not on either route. We hold no student email address, so we could not if we wanted to.
• We hold no payment or card details — see 4.7.

4 Information we collect

This is a complete inventory. If something is not listed here, we do not hold it.

4.1 Student account information

Created by a teacher or school administrator, or — on a family subscription — by us, from what the parent tells us at sign‑up. Identical across the Trainers. On a family subscription the class group and teacher notes fields are simply not used.

4.2 Teacher account information

Username, display name, bcrypt password hash, administrator status (full administrator or class‑scoped teacher), and the class groups a class‑scoped teacher is assigned.

4.3 Practice activity

• Question attempts — topic, difficulty, the question, the correct answer, the student's answer, whether it was right, its source, and the practice test it belonged to.
• Practice tests — which were started and finished, and when.
• Sessions — when a student worked and for how long. OLNA also keeps a per‑day attempt count used for daily‑goal streaks.
• Topic statistics — running accuracy per topic, used to adapt difficulty and draw progress charts.
• Flagged questions — questions a student or teacher marked as confusing or faulty, so we can review them.

4.4 Writing responses — the Trainers differ here

In both cases the response text is transmitted to our AI provider to be marked (section 9), and in neither case is it used to train an AI model.

4.5 Security and technical logs

• Sign‑in attempts — every attempt, successful or not, logged with the username, role, source IP address, time and outcome. This is what stops password guessing.
• Infrastructure logs — standard operational logs kept by our hosting and database providers (request times, errors, IP addresses).

4.6 AI usage records

Every AI call is metered so we can control cost and enforce fair‑use limits: the function called, the model, the outcome, token counts, cost, duration, the account that called it, and the year level, topic and difficulty requested. No question content, student answers or writing responses go into these records.

4.7 FAMILY Parent and subscription information

Collected only where a family subscribes directly, and entered by the parent on the sign‑up form on the Trainer's website. A school subscription involves none of this.

5 What we deliberately do not collect

No Trainer has any facility to collect these, and we hold none of them:

There is no third‑party analytics anywhere — no Google Analytics, no Meta pixel, no session recording, no heatmapping, no advertising SDK, no third‑party tracking cookie.

6 How we collect it

1. SCHOOL From the school — when a teacher or administrator creates or edits an account.
2. FAMILY From the parent — what they give us when they subscribe, and anything they later ask us to change.
3. FAMILY From Stripe — confirmation that a payment succeeded, failed or was refunded, and that a subscription was cancelled. We receive no card details in any of it (4.7).
4. From the student's own use — attempts, sessions and sign‑in logs are generated automatically as they work.

We do not buy, licence, scrape or otherwise obtain personal information from any third party, data broker or public source, and we do not match what we hold against any external dataset.

7 Why we use it

We will not use personal information for a materially different purpose without the agreement of the school or the parent who holds the subscription, and without consent where the law requires it.

8 Who we share it with

We never sell, rent, trade or licence personal information, and we never disclose it for anyone's advertising or marketing.

8.1 Within the school, or within the family

• SCHOOL A class teacher sees accounts, progress and results for students in their assigned class groups, and no others. Enforced on our servers, not just hidden in the interface.
• SCHOOL A school administrator sees all students and teachers at that school.
• FAMILY A parent sees the progress and results of the student or students their own subscription covers, and nothing else. A family subscription reaches no school's data, and no other family's.
• A student sees only their own account and results.

All three Trainers include an optional leaderboard showing display names and aggregate accuracy only — never usernames, account identifiers, teacher notes, individual answers or adjustment settings. A school that would rather students not be ranked can ask us to switch it off for them, and so can a parent.

8.2 Service providers

We use the providers listed in section 9, and no others. We will not add a provider that receives personal information without updating this policy first.

8.3 Required or permitted by law

We may disclose where Australian law requires or authorises it, or where necessary to lessen a serious threat to someone's life, health or safety. If we receive a compulsory request for student information we will tell the school — or, on a family subscription, the parent — unless legally prohibited.

8.4 Business changes

If a Trainer were ever transferred to another operator, personal information would move only on condition the recipient is bound by protections no weaker than this policy, and we would notify every affected school and parent in advance so they can decide whether to continue.

9 Where it is stored (overseas disclosure)

Australian Privacy Principle 8 requires us to be explicit about information leaving Australia. This is complete and current.

9.1 What that means

Student account information and practice history are stored in Australia — all three Trainers' databases are in Sydney. Three things still leave the country. Writing responses are transmitted to the United States for marking. On a family subscription, the parent's name and email are held by Stripe in the United States. And the emails we send a parent pass through Resend in the United States — a welcome email names that parent's own children by first name, username and year level, so a child's login details do travel overseas once, to their own parent. All three are disclosures of personal information to overseas recipients.

Before disclosing overseas we take reasonable steps to ensure recipients handle information consistently with the APPs: we contract only with established providers publishing enterprise privacy and security commitments, everything travels over encrypted connections, we send the AI provider the minimum needed to do the marking, and no student information sits with any provider not listed above.

9.2 AI provider and model training

Our AI provider's commercial API terms state that customer inputs and outputs are not used to train its models. Content may be retained briefly for safety and abuse monitoring, then deleted. We have not enabled, and will not enable, any arrangement under which student work trains a model.

10 Artificial intelligence

All three Trainers use AI in two or three places. The limits matter, so they are stated plainly.

10.1 Where AI is used

• Question and passage generation — some practice questions, reading passages and writing prompts are generated to a year level, topic and difficulty. No personal information about the student is involved beyond the year level and topic requested.
• Writing feedback — a response is assessed against the marking criteria, returning a level, an indicative score, criterion comments and next steps.
• OLNA Question hints — a student stuck on a question can request a hint, generated from the question itself.

10.2 This is practice feedback, not a result

No Trainer makes any automated decision with a legal or similarly significant effect on a student. All automated marking changes is which feedback text appears on screen. The only other automated process is the adaptive difficulty engine, which uses a student's own recent accuracy to choose the next question — and a teacher can override it.

Generated questions are validated against a strict format before display, and anyone can flag content that looks wrong. Student work is never used to train an AI model (section 9.2).

11 Cookies and browser storage

No Trainer sets a cookie. They use the browser's local storage for a few strictly necessary things, none readable by any other website:

Signing out clears the token and account summary; clearing site data removes everything. With no tracking or advertising cookies there is no consent banner and nothing to opt out of.

On shared or classroom devices, sign out. A token left behind stays valid on that device until it expires.

12 How long we keep it

Deleting a student removes the account and every linked record together — attempts, sessions, statistics, practice tests, writing submissions, group memberships and access grants. Deletion from live systems completes within 30 days of the request; backups follow within the backup window.

A school wanting results kept after a student leaves should export them first. Teachers can export class results at any time, and a parent can ask us for their child's results at any time (section 14).

13 How we secure it

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. In short:

• Passwords stored only as one‑way bcrypt hashes, never recoverable by anyone including us.
• All traffic encrypted in transit with HTTPS/TLS; stored data encrypted at rest.
• Every database table is closed to public access by default — no table is readable from a browser.
• A student's identity always comes from their verified sign‑in token on the server, never from what the browser claims, so nobody can read or write another student's records by changing an ID.
• Teachers are scoped to their own classes server‑side.
• Sign‑in attempts are rate limited to block password guessing.
• Only the operator holds administrative credentials; secrets live in managed environment configuration, never in source code.

Our Security Policy gives the full detail, including a frank list of current limitations. No online service can guarantee absolute security and we do not claim to.

14 Access, correction and deletion

14.1 SCHOOL Students, parents and carers at a school

The school controls the accounts, so ask the school first. A teacher or administrator can view a student's information, correct it, reset a password, deactivate the account or ask us to delete it — usually much faster than we can.

If the school cannot resolve it, email hello@r2education.com.au. We will verify the request with the school before acting, because we cannot independently confirm that someone contacting us is who they say they are or is entitled to a particular student's records.

14.2 FAMILY Parents on a family subscription

There is no school in the middle, so come straight to us at hello@r2education.com.au. We will, free of charge:

• send you everything we hold about your child, in a readable format;
• correct anything that is wrong;
• reset a password;
• delete your child's account and every record attached to it, permanently.

We verify the request by replying to the email address on the subscription — which is why it matters that you keep it current. We will not act on a request about a child from an address that does not hold their subscription, and we will not discuss a child's records with anyone who is not the parent or guardian who subscribed. If parental responsibility is shared or disputed, we will not take sides: tell us and we will act only on instructions we can properly verify.

Deleting your child's data does not require you to cancel first, and cancelling does not immediately delete it — the retention schedule in section 12 applies. If you want both, say so and we will do both.

14.3 SCHOOL Schools

On request from an authorised school contact we will, free of charge:

• provide a copy of everything we hold about a nominated student, or about all the school's students, in a machine‑readable format;
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• permanently delete a student, a class, or the school's entire dataset.

We respond within 30 days. If we refuse a request in whole or part we will explain why in writing and how to complain. Requests are free; if a large or complex one would involve substantial cost we will discuss it first, and we never charge for a correction.

15 Data breaches

Our full breach response plan is in the Security Policy. If we become aware of a suspected breach involving personal information we will:

1. Contain it immediately — revoke credentials, invalidate sessions, close the hole.
2. Assess within 72 hours — what information, whose, and what harm is likely.
3. Notify those affected without undue delay and within 72 hours of forming a reasonable belief that an eligible breach occurred — the school, or, on a family subscription, the parent directly. What happened, what was involved, what we have done, what we recommend. We notify even while assessment continues.
4. Notify the OAIC where the Notifiable Data Breaches scheme requires, and support the school in meeting its own obligations to its department and to families.
5. Report back with a written post‑incident review and the changes made to stop it recurring.

We will not delay telling a school or a parent while we investigate, and we will not minimise or withhold detail.

FAMILY On a family subscription there is no school to route a notification through, so it comes straight to you, at the email address on the subscription — which is the other reason we ask you to keep it current.

16 Marketing and advertising

We do not use student personal information for direct marketing, and no Trainer displays advertising of any kind. We disclose personal information to nobody for their own marketing.

SCHOOL We may contact a school's nominated staff about the service itself — outages, security notices, policy changes, renewals, new features. Those go to school staff at school addresses, never to students.

FAMILY We email a parent about their own subscription: login details, receipts, failed payments, cancellation confirmations, price changes, security and policy notices. These are the emails that make the subscription work, and you cannot unsubscribe from them while it is running — cancelling the subscription stops them.

17 Changes to this policy

We review this policy at least annually and whenever our handling of personal information changes. The current version always sits at r2education.com.au/privacy, with its version and effective date at the top.

For any change materially affecting how student information is handled — a new overseas recipient, a new category collected, a new purpose, a longer retention period — we give notice at least 30 days before it takes effect: to each school's nominated contact, and to each parent holding a family subscription, at the email address on it. That way you can review the change and, if you prefer, stop using the Trainer and have the data deleted before it applies.

Version 1.1 was such a change. It added family subscriptions, and with them a parent's name and email address (4.7), a new overseas recipient in Stripe (section 9) and a five‑year retention period for billing records (section 12). Section 5 flags the one claim from version 1.0 that this made inaccurate.

Version 1.2 replaced manual family account creation with a payment‑gated sign‑up form. Parent details are now entered on the Trainer's own sign‑up form rather than only on Stripe's checkout page, and the parent's password — held only as a one‑way hash — was added to 4.7. No new category of student information, no new recipient and no new retention period came with it; the matching account‑creation changes are in the Terms (6.1) and the Security Overview (6.1). It took effect before any family subscription had been sold, so no existing subscriber was affected.

Version 1.3 added Resend, the provider that delivers our email (section 9). It is a new overseas recipient, and the first one that receives anything about a student: a welcome email lists the parent's own children by first name, username and year level so that the family can sign in. It carries no results and no writing, it goes only to the parent who paid, and nothing is ever emailed to a student. It took effect before any family subscription had been sold.

Version 1.4 added the Scholarship Trainer (section 1). It is built from the NAPLAN Trainer and handles student information identically: the same categories in section 4, writing not stored (4.4), a database in Sydney (section 9), the same providers and the same retention periods. No new overseas recipient, no new category of information and no new retention period came with it, so nothing changed for OLNA or NAPLAN families or schools.

18 Contact and complaints

Include enough detail to identify the school or the subscription and, if relevant, the student. We will investigate, tell you what we find, and say what we will do about it.

If our response does not satisfy you

• SCHOOL Raise it with the school, and if needed its department — a WA public school sits within the Department of Education (WA), which has its own complaints process. This route does not exist on a family subscription; come to us, and then to a regulator below if we do not put it right.
• Office of the Australian Information Commissioner — the national privacy regulator. oaic.gov.au or 1300 363 992.
• Information Commissioner (Western Australia) — for complaints about a WA public sector body's handling of personal information under the Privacy and Responsible Information Sharing Act 2024 (WA).

You can go to a regulator at any time. You do not have to come to us first, though it is usually quicker.