Privacy Policy

1. Introduction

This document sets out the privacy policy of LevelUp Exams Pty Ltd ACN 698 393 823 (referred to in this Privacy Policy as 'we', 'us' or 'our').

We are an independent educational practice platform that provides exam-style practice in numeracy, language conventions, writing and reading comprehension for students in Years 3, 5, 7 and 9. This Privacy Policy applies to visitors to our website and registered users of the platform.

We take our privacy obligations seriously and have created this Privacy Policy to explain how we collect, store, maintain, use and disclose personal information through the LevelUp Exams platform.

We are committed to protecting personal information and giving particular attention to the privacy, safety and best interests of children who use the platform. You can contact us using the details below if you have any questions or concerns.

Public pages of the platform may be browsed without creating an account or providing identifying information. An account is required to access exams, save progress and results, receive writing feedback and use paid features because those functions must be connected to an account.

By creating an account, providing personal information to us or permitting a student to use the platform, you acknowledge the handling of personal information described in this Privacy Policy. Where consent is required by law, we will seek it from the appropriate person.

We may change this Privacy Policy from time to time by posting an updated copy on our website. We encourage you to check our website regularly to ensure that you are aware of our current Privacy Policy.

2. Types of Personal Information We Collect

The personal information we collect may include the following:

• (a) Account holder information: the parent's or guardian's email address and, for email/password sign-up, a cryptographically hashed password that is not stored in readable form. We may also retain email-verification, authentication, registration and consent records, including the date and time relevant confirmations were provided;
• (b) Social sign-in information: the account holder's display name and email address received through Google or Facebook sign-in. Although those providers may return a profile-photo URL, we do not use it and strip it from the information retained by us;
• (c) Student profile information: the student's first name and year level only. We do not ask for or intentionally collect a student's surname, email address, date of birth or school;
• (d) Learning and assessment information: exam answers, free-text responses submitted through the Writing module, scores, progress, results, AI-generated feedback and records of which exams have been started or completed and when;
• (e) Free exam information: responses and results generated through a free exam are stored and retained in the same way as responses and results generated through paid exams. Where a free exam includes AI writing assessment, the written response is processed by Anthropic in the United States as described below;
• (f) Technical and usage information: IP address, browser and device information, operating system, page-view and standard web-log information, security events and pseudonymous analytics or advertising identifiers, and, on parent-facing pages only, interaction data such as clicks, scrolling, mouse movements, session recordings and heatmaps;
• (g) Correspondence: information contained in emails or other communications sent to us;
• (h) Payment information: Stripe processes payments and we do not receive, view or store payment-card or bank-account details. We may retain a record of the purchase amount, purchase date, access period and Stripe transaction reference;
• (i) Other information: any other information voluntarily provided to us or generated when the platform is used.

We do not deliberately collect sensitive information. However, because the Writing module accepts free-text responses, a student may volunteer personal or sensitive information, such as information about their health, family, religion or beliefs. Students are instructed not to include names, school details or other identifying, personal or sensitive information in their writing.

We do not actively monitor written responses for personal or sensitive information. If such information comes to our attention, we will assess whether it is reasonably necessary or permitted to retain and, if not, take reasonable steps to delete or de-identify it where lawful and practicable.

3. Personal Information of Minors

LevelUp Exams is designed for school-age students, including children under 15 years of age. Accounts must be created and controlled by a parent or guardian aged 18 years or over. During registration, the account holder must confirm that they are an adult and agree to our Terms and this Privacy Policy. The parent or guardian authorises the student's use of the platform and, where consent is required, consents to the handling of the student's personal information as described in this Privacy Policy.

We do not collect a student's email address or send marketing communications directly to students.

We seek to collect only the personal information reasonably necessary to provide the platform. We collect a student's first name and year level, together with their exam responses, written responses, progress, scores and feedback. We do not ask for or intentionally collect a student's surname, email address, date of birth or school.

We do not use children's personal information for behavioural profiling or targeted advertising. Meta Pixel, Google Ads conversion tracking, Microsoft Clarity session recording and similar advertising or behavioural analytics technologies are restricted to parent-facing pages and are not loaded on authenticated pages where students access exams, assessments, written responses, results or feedback.

We provide students with age-appropriate information about relevant privacy practices, including a reminder not to include names, school details or other personal or sensitive information in written responses.

A parent or guardian may contact us at privacy@levelupexams.com.au to access, correct or manage their child's personal information, request its deletion where available, or raise a concern about how it has been handled.

If a parent or guardian believes that a child's personal information has been collected without appropriate authority or consent, they should contact us. We will investigate promptly and, where appropriate, delete or de-identify the information.

4. How We Collect Personal Information

We may collect personal information directly from you, from a student or from third parties, including where:

• (a) an adult account holder submits an online sign-up form, uses email/password registration and verification, or signs in through Google or Facebook;
• (b) an account holder confirms their age, accepts our Terms and acknowledges this Privacy Policy;
• (c) a student uses the platform, including where exam answers, progress, results or written responses are generated and linked to the student profile or account;
• (d) you make a payment through Stripe;
• (e) you communicate with us by email or another support channel;
• (f) you interact with our website, services, content or parent-facing advertising including where technical, cookie, analytics or conversion information is generated; or
• (g) our service providers generate information needed to provide the service, including authentication records, analytics, security logs, payment confirmation and AI-generated writing feedback.

We may also collect personal information when you use our website through cookies, analytics and similar technologies. We use essential authentication and session cookies, Google Analytics for pseudonymous usage analytics, Cloudflare for hosting and security, and Meta Pixel, Google Ads conversion tracking and Microsoft Clarity session recording on parent-facing pages only. You may disable or manage cookies through your browser or any cookie controls made available on our website, although disabling essential cookies may affect the platform's operation.

Advertising and conversion-tracking technologies may collect information about visits to parent-facing pages. These technologies are not used on authenticated student, exam, assessment, written-response, results or feedback pages.

Where an enhanced conversion or advanced matching feature is enabled, a hashed identifier derived from the adult account holder's email address may be disclosed to the relevant advertising platform for conversion measurement. The advertising platform may handle that information for its own purposes in accordance with its privacy policy.

Google Analytics may collect and process data when you use websites or apps that use Google services. Further information is available at www.google.com/policies/privacy/partners/.

We use Microsoft Clarity on parent-facing pages to understand how visitors use our website, through session recordings, heatmaps and interaction data such as clicks, scrolling and mouse movement. Clarity is configured to mask text and form inputs and is not used on authenticated student, exam, assessment, written-response, results or feedback pages. Clarity uses cookies, including identifiers that Microsoft may use for its own analytics and advertising purposes. Microsoft handles this information in accordance with the Microsoft Privacy Statement, available at privacy.microsoft.com/privacystatement. You can prevent Clarity tracking by blocking or deleting cookies through your browser or any cookie controls made available on our website.

5. Use of Your Personal Information

We collect and use personal information for the following purposes:

• (a) to create, authenticate and manage accounts;
• (b) to provide the platform, save exam progress and results, and deliver AI-powered writing assessment and feedback;
• (c) to process payments and manage purchased access periods;
• (d) for record keeping and administrative purposes;
• (e) to send receipts, password resets, access-expiry notices, security alerts and other service or transactional communications;
• (f) to send marketing and promotional messages to the adult account holder where permitted by law and where they have not opted out. Marketing messages include an unsubscribe facility;
• (g) to understand how the platform is used and improve its content, functionality and user experience, including through aggregated or de-identified information where practicable and through session recordings and heatmaps of parent-facing pages;
• (h) for advertising and conversion measurement on parent-facing pages only;
• (i) to protect the platform, prevent fraud or misuse and enforce our agreements; and
• (j) to comply with legal obligations and respond to lawful requests.

Marketing and educational communications are sent only to the adult account holder. Each marketing email includes an unsubscribe facility. An account holder may also opt out by contacting privacy@levelupexams.com.au. Opting out of marketing does not prevent the delivery of necessary service communications, including receipts, password resets, security notices and access-expiry reminders.

We do not sell or rent personal information. We may disclose personal information to our employees, contractors, professional advisers and service providers only to the extent reasonably necessary for the relevant purpose. Key service providers include:

Supabase: authentication, database services and hosting in the Sydney region. Account and exam information is stored in Australia;

Anthropic: AI writing assessment. Written responses are processed in the United States;

Stripe: payment processing. LevelUp receives a transaction record but does not receive payment-card details;

Cloudflare: hosting, content delivery and security. Internet traffic may be routed through its global network;

Resend: transactional and marketing email delivery;

Google Analytics: pseudonymous usage analytics;

Microsoft Clarity: session recording, heatmaps and usage analytics on parent-facing pages only; and

Meta and Google Ads: advertising and conversion measurement on parent-facing pages only.

Personal information may be processed or stored outside Australia. Written responses submitted for AI assessment are processed by Anthropic in the United States. Stripe, Cloudflare, Google, Meta, Microsoft and Resend may also process information through infrastructure located outside Australia, including in the United States and other countries in which they or their subcontractors operate.

We take reasonable steps to select reputable service providers and assess their contractual, privacy and security safeguards. However, privacy laws and protections in overseas jurisdictions may differ from those applying in Australia.

6. Data Retention

We retain operational account information, student work and exam records while an account remains active. These records will be deleted from our live systems 24 months after the later of:

• (a) the expiry of the Account Holder's most recent paid access period; and
• (b) the last sign-in or exam activity on the account.

If an account has never had paid access, the 24-month period runs from the last sign-in or exam activity. We may, but are not required to, notify the Account Holder before deletion.

An Account Holder may request earlier deletion of their account and associated personal information. We will delete that information from our live systems, except for records we are required by law or reasonably need to retain.

We retain transaction and financial records for seven years after the relevant transaction is completed.

We also retain a limited audit record of the Account Holder's acceptance of the Terms, adult and parental confirmation, and privacy acknowledgements for seven years after the account is closed or the last transaction, whichever is later. The audit record may include a pseudonymous account identifier, the date and time of acceptance, and the wording and versions of the documents accepted. It will not be used for marketing.

Deleted information may remain in encrypted automated backups for up to seven days, after which it is overwritten. Backup copies are not used for ordinary business purposes.

We may retain information for longer where reasonably required to manage a complaint, dispute, fraud or security incident, or to comply with a legal obligation. Aggregated or de-identified information that can no longer reasonably identify an individual may be retained for platform improvement and statistical purposes.

Session recordings collected through Microsoft Clarity are retained by Microsoft for approximately 30 days, and heatmap data and any recordings we flag for review are retained for up to 9 months, after which Microsoft deletes them.

7. AI-Powered Writing Assessment

This applies to written responses submitted through both free and paid exams.

The Writing module uses Anthropic's AI service to analyse a student's written response and generate a score and feedback. The written response is sent to the United States for this purpose. We do not deliberately send the student's profile, the account holder's details or other account identifiers with the response, although the response itself may contain personal information if the student includes it.

AI-generated scores and feedback are indicative educational tools intended to support learning. They are not a substitute for assessment by a qualified teacher and are not used by us to determine school admission, eligibility, legal rights, access to an essential service or performance in an official NAPLAN examination.

An account holder may ask us to disable AI writing assessment for their account by contacting privacy@levelupexams.com.au. If disabled, the remaining platform features may continue to be used without AI writing assessment.

Written responses submitted for assessment are not used by us or, under our arrangement, by Anthropic to train an artificial intelligence model.

An account holder may contact us at privacy@levelupexams.com.au if they have concerns about an AI-generated assessment or wish to request deletion of a written response and its associated feedback.

8. Security

We take reasonable steps to ensure personal information is secure and protected from misuse, interference, loss and unauthorised access, modification or disclosure. Our information technology systems use password and authentication controls, hashed passwords, encrypted connections, server-side permissions and hosting and network security measures supplied by our providers. However, no internet-based service can guarantee absolute security.

We maintain procedures for identifying, containing and assessing suspected data breaches. Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will notify affected individuals and the relevant regulator in accordance with those requirements. We may also notify affected individuals where we consider notification appropriate, even if notification is not legally required.

9. Links

Our website may contain links to other websites. Those links are provided for convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites and we suggest you review the privacy policies of those websites before using them.

10. Requesting Access to, Correction or Deletion of Personal Information

If you wish to request access to the personal information we hold about you or your child, please contact us using the details below and include your name and contact details. We may need to verify your identity and, where the request concerns a student, your authority as their parent or guardian. In some cases, we may be unable to provide access to all personal information and, where required, we will explain why. We will deal with access requests within a reasonable timeframe.

These facilities are provided subject to information we are required or reasonably need to retain. Where applicable privacy legislation gives an individual additional rights, we will comply with those requirements.

If you believe personal information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us and we will take reasonable steps to correct it. An account holder may also request deletion of an account, student profile, exam responses, written responses and associated results. We will action a deletion request where reasonably practicable, subject to information we are required or authorised to retain. Session data collected through Microsoft Clarity is not linked to your account, and we may be unable to delete individual session data held by Microsoft before its retention period ends.

11. Complaints

If you wish to complain about how we handle personal information or believe that privacy has been seriously invaded, please contact us at privacy@levelupexams.com.au and provide your name, contact details and sufficient information for us to investigate. We will investigate the complaint promptly and aim to provide a substantive response within 30 days.

If you are not satisfied with our response and the Privacy Act applies to our handling of your personal information, you may be entitled to complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992. The OAIC will generally expect you to have first given us a reasonable opportunity to address the complaint.

12. Contact Us

For further information about this Privacy Policy or our privacy practices, or to request access, correction or deletion, or make a complaint, please contact us using the details set out below:

Name: LevelUp Exams Pty Ltd ACN 698 393 823

Privacy Enquiries: privacy@levelupexams.com.au

General Enquiries: contact@levelupexams.com.au

We may update this Privacy Policy to reflect changes to our practices, technology or applicable legal requirements. We will publish the current version on our website and update the date below. If a change materially alters how we collect, use or disclose personal information, AI-assessment information or information processed overseas, we will provide appropriate notice and obtain fresh consent where required under applicable law.