PRIVACY POLICY

1 Who we are, what this covers

r2 Education ("we", "us", "our") is an Australian sole‑trader business that builds and runs two practice tools for Western Australian school students:

• OLNA The OLNA Trainer — practice for the WA Online Literacy and Numeracy Assessment, for students in Years 10 to 12.
• NAPLAN The NAPLAN Trainer — NAPLAN‑style practice across numeracy, reading, language conventions and writing, for Years 3, 5, 7 and 9.

This policy covers the homepage at r2education.com.au, both Trainers, and every supporting system we run for them. Where the two Trainers behave differently, the difference is marked with a badge like the ones above — please read those closely, because on two points (writing storage and data location) they genuinely differ.

Read it alongside our Terms of Use and our Security Policy.

Our commitment under privacy law

r2 Education is a small business operator and may fall under the $3 million annual turnover threshold at which the Privacy Act 1988 (Cth) applies automatically. We do not rely on that exemption. We handle personal information as though bound by the Australian Privacy Principles (APPs), including the Notifiable Data Breaches scheme in Part IIIC. Where a school or department needs that commitment in a contract, we will sign it.

A WA public school is itself bound by the Privacy and Responsible Information Sharing Act 2024 (WA) and by confidentiality obligations under the School Education Act 1999 (WA). Our practices are built so a school can meet those obligations while using our Trainers, and we will help it do so.

2 Privacy at a glance

3 Our role: service provider to the school

Both Trainers are supplied to schools, not to students or families directly. That shapes everything below.

• The school decides which students get accounts, what name shows on each one, what each student can access, and what a teacher writes in a student's notes.
• The school holds the relationship with families — including any notice to parents or carers and any consent its own or its department's policies require. We never contact parents or carers, and have no way to.
• We act on the school's instructions for student records, and handle personal information only to run the Trainers, keep them secure, and comply with the law.
• We do not use student information for our own purposes. The only profile we build of a student is the one shown back to that student and their teachers.

If a school needs a data processing agreement, a departmental online‑services assessment or a privacy impact assessment before deploying, email hello@r2education.com.au and we will complete it.

4 Information we collect

This is a complete inventory. If something is not listed here, we do not hold it.

4.1 Student account information

Created by a teacher or school administrator. Identical across both Trainers.

4.2 Teacher account information

Username, display name, bcrypt password hash, administrator status (full administrator or class‑scoped teacher), and the class groups a class‑scoped teacher is assigned.

4.3 Practice activity

• Question attempts — topic, difficulty, the question, the correct answer, the student's answer, whether it was right, its source, and the practice test it belonged to.
• Practice tests — which were started and finished, and when.
• Sessions — when a student worked and for how long. OLNA also keeps a per‑day attempt count used for daily‑goal streaks.
• Topic statistics — running accuracy per topic, used to adapt difficulty and draw progress charts.
• Flagged questions — questions a student or teacher marked as confusing or faulty, so we can review them.

4.4 Writing responses — the Trainers differ here

In both cases the response text is transmitted to our AI provider to be marked (section 9), and in neither case is it used to train an AI model.

4.5 Security and technical logs

• Sign‑in attempts — every attempt, successful or not, logged with the username, role, source IP address, time and outcome. This is what stops password guessing.
• Infrastructure logs — standard operational logs kept by our hosting and database providers (request times, errors, IP addresses).

4.6 AI usage records

Every AI call is metered so we can control cost and enforce fair‑use limits: the function called, the model, the outcome, token counts, cost, duration, the account that called it, and the year level, topic and difficulty requested. No question content, student answers or writing responses go into these records.

5 What we deliberately do not collect

Neither Trainer has any facility to collect these, and we hold none of them:

There is no third‑party analytics anywhere — no Google Analytics, no Meta pixel, no session recording, no heatmapping, no advertising SDK, no third‑party tracking cookie.

6 How we collect it

1. From the school — when a teacher or administrator creates or edits an account.
2. From the student's own use — attempts, sessions and sign‑in logs are generated automatically as they work.

We do not buy, licence, scrape or otherwise obtain personal information from any third party, data broker or public source, and we do not match what we hold against any external dataset.

7 Why we use it

We will not use personal information for a materially different purpose without the school's agreement, and without consent where the law requires it.

8 Who we share it with

We never sell, rent, trade or licence personal information, and we never disclose it for anyone's advertising or marketing.

8.1 Within the school

• A class teacher sees accounts, progress and results for students in their assigned class groups, and no others. Enforced on our servers, not just hidden in the interface.
• A school administrator sees all students and teachers at that school.
• A student sees only their own account and results.

Both Trainers include an optional leaderboard showing display names and aggregate accuracy only — never usernames, account identifiers, teacher notes, individual answers or adjustment settings. A school that would rather students not be ranked can ask us to switch it off for them.

8.2 Service providers

We use the providers listed in section 9, and no others. We will not add a provider that receives personal information without updating this policy first.

8.3 Required or permitted by law

We may disclose where Australian law requires or authorises it, or where necessary to lessen a serious threat to someone's life, health or safety. If we receive a compulsory request for student information we will tell the school, unless legally prohibited.

8.4 Business changes

If a Trainer were ever transferred to another operator, personal information would move only on condition the recipient is bound by protections no weaker than this policy, and we would notify every affected school in advance so it can decide whether to continue.

9 Where it is stored (overseas disclosure)

Australian Privacy Principle 8 requires us to be explicit about information leaving Australia. This is complete and current.

9.1 What that means

Student account information and practice history are stored outside Australia — in Singapore for the OLNA Trainer, Tokyo for the NAPLAN Trainer. Writing responses are transmitted to the United States for marking. Both are disclosures of personal information to overseas recipients.

Before disclosing overseas we take reasonable steps to ensure recipients handle information consistently with the APPs: we contract only with established providers publishing enterprise privacy and security commitments, everything travels over encrypted connections, we send the AI provider the minimum needed to do the marking, and no student information sits with any provider not listed above.

9.2 AI provider and model training

Our AI provider's commercial API terms state that customer inputs and outputs are not used to train its models. Content may be retained briefly for safety and abuse monitoring, then deleted. We have not enabled, and will not enable, any arrangement under which student work trains a model.

10 Artificial intelligence

Both Trainers use AI in two or three places. The limits matter, so they are stated plainly.

10.1 Where AI is used

• Question and passage generation — some practice questions, reading passages and writing prompts are generated to a year level, topic and difficulty. No personal information about the student is involved beyond the year level and topic requested.
• Writing feedback — a response is assessed against the marking criteria, returning a level, an indicative score, criterion comments and next steps.
• OLNA Question hints — a student stuck on a question can request a hint, generated from the question itself.

10.2 This is practice feedback, not a result

Neither Trainer makes any automated decision with a legal or similarly significant effect on a student. All automated marking changes is which feedback text appears on screen. The only other automated process is the adaptive difficulty engine, which uses a student's own recent accuracy to choose the next question — and a teacher can override it.

Generated questions are validated against a strict format before display, and anyone can flag content that looks wrong. Student work is never used to train an AI model (section 9.2).

11 Cookies and browser storage

Neither Trainer sets a cookie. They use the browser's local storage for a few strictly necessary things, none readable by any other website:

Signing out clears the token and account summary; clearing site data removes everything. With no tracking or advertising cookies there is no consent banner and nothing to opt out of.

On shared or classroom devices, sign out. A token left behind stays valid on that device until it expires.

12 How long we keep it

Deleting a student removes the account and every linked record together — attempts, sessions, statistics, practice tests, writing submissions, group memberships and access grants. Deletion from live systems completes within 30 days of the request; backups follow within the backup window.

A school wanting results kept after a student leaves should export them first. Teachers can export class results at any time.

13 How we secure it

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. In short:

• Passwords stored only as one‑way bcrypt hashes, never recoverable by anyone including us.
• All traffic encrypted in transit with HTTPS/TLS; stored data encrypted at rest.
• Every database table is closed to public access by default — no table is readable from a browser.
• A student's identity always comes from their verified sign‑in token on the server, never from what the browser claims, so nobody can read or write another student's records by changing an ID.
• Teachers are scoped to their own classes server‑side.
• Sign‑in attempts are rate limited to block password guessing.
• Only the operator holds administrative credentials; secrets live in managed environment configuration, never in source code.

Our Security Policy gives the full detail, including a frank list of current limitations. No online service can guarantee absolute security and we do not claim to.

14 Access, correction and deletion

14.1 Students, parents and carers

The school controls the accounts, so ask the school first. A teacher or administrator can view a student's information, correct it, reset a password, deactivate the account or ask us to delete it — usually much faster than we can.

If the school cannot resolve it, email hello@r2education.com.au. We will verify the request with the school before acting, because we cannot independently confirm that someone contacting us is who they say they are or is entitled to a particular student's records.

14.2 Schools

On request from an authorised school contact we will, free of charge:

• provide a copy of everything we hold about a nominated student, or about all the school's students, in a machine‑readable format;
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• permanently delete a student, a class, or the school's entire dataset.

We respond within 30 days. If we refuse a request in whole or part we will explain why in writing and how to complain. Requests are free; if a large or complex one would involve substantial cost we will discuss it first, and we never charge for a correction.

15 Data breaches

Our full breach response plan is in the Security Policy. If we become aware of a suspected breach involving personal information we will:

1. Contain it immediately — revoke credentials, invalidate sessions, close the hole.
2. Assess within 72 hours — what information, whose, and what harm is likely.
3. Notify the affected school without undue delay and within 72 hours of forming a reasonable belief that an eligible breach occurred — what happened, what was involved, what we have done, what we recommend. We notify even while assessment continues.
4. Notify the OAIC where the Notifiable Data Breaches scheme requires, and support the school in meeting its own obligations to its department and to families.
5. Report back with a written post‑incident review and the changes made to stop it recurring.

We will not delay telling a school while we investigate, and we will not minimise or withhold detail.

16 Marketing and advertising

We do not use student personal information for direct marketing, and neither Trainer displays advertising of any kind. We disclose personal information to nobody for their own marketing.

We may contact a school's nominated staff about the service itself — outages, security notices, policy changes, renewals, new features. Those go to school staff at school addresses, never to students, never to parents or carers.

17 Changes to this policy

We review this policy at least annually and whenever our handling of personal information changes. The current version always sits at r2education.com.au/privacy, with its version and effective date at the top.

For any change materially affecting how student information is handled — a new overseas recipient, a new category collected, a new purpose, a longer retention period — we notify each school's nominated contact at least 30 days before it takes effect, so the school can review it and, if it prefers, stop using the Trainer and have its data deleted.

18 Contact and complaints

Include enough detail to identify the school and, if relevant, the student. We will investigate, tell you what we find, and say what we will do about it.

If our response does not satisfy you

• Raise it with the school, and if needed its department — a WA public school sits within the Department of Education (WA), which has its own complaints process.
• Office of the Australian Information Commissioner — the national privacy regulator. oaic.gov.au or 1300 363 992.
• Information Commissioner (Western Australia) — for complaints about a WA public sector body's handling of personal information under the Privacy and Responsible Information Sharing Act 2024 (WA).

You can go to a regulator at any time. You do not have to come to us first, though it is usually quicker.