Privacy Policy

AchievoEDU PTY LTD ('AchievoEDU', 'we', 'us', 'our') is committed to protecting the privacy of all individuals who use our platform, including students, teachers, school administrators, and parents. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information, having regard to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By accessing or using the AchievoEDU platform (available at achievoedu.com.au and via our iOS and Android mobile applications), you agree to the practices described in this policy.

1. Who We Are

AchievoEDU PTY LTD is an Australian educational technology company that provides a student engagement and wellbeing platform to schools. Our platform is used by students (including minors), parents, teachers, and school administrators.

For privacy-related questions, please contact our Privacy Officer at: privacy@achievoedu.com.au

2. What Information We Collect

2.1 Student Data

• Full name and year level
• Date of birth
• School enrolment identifier (provided by the school)
• Behaviour records, points, badges, and awards
• Character competency progress and XP levels
• Store purchase and redemption history
• Attendance records (where enabled by the school)
• Daily wellbeing check-in responses (where enabled by the school)
• Device identifiers for push notifications (mobile app)

2.2 Teacher and Staff Data

• Full name, email address, and staff identifier
• School and class assignments
• Platform activity logs (behaviours recorded, reports generated)
• Login timestamps and session data

2.3 Parent and Guardian Data

• Full name and email address
• Relationship to student
• Notification preferences

2.4 Administrator Data

• Full name, email, and role
• School configuration settings and audit logs

2.5 Technical Data

• IP address and browser/device type
• Usage analytics (pages visited, features used, session duration)
• Error logs and crash reports

3. How We Use Personal Information

We use personal information solely for the following purposes:

• Delivering the AchievoEDU platform services to schools and their users
• Enabling schools to track, reward, and report on student behaviour and progress
• Sending notifications to students, parents, and staff as configured by the school
• Providing customer support and responding to queries
• Improving platform performance, features, and security
• Complying with legal obligations

We do not use student data for advertising, profiling for commercial purposes, or any purpose unrelated to the delivery of educational services.

4. Data Storage and Location

All AchievoEDU student records, our database, and backups are stored on Microsoft Azure data centres located in Australia, and stay within Australia.

Overseas processing (cross-border disclosure, APP 8): two delivery services process limited information outside Australia. Push notifications are sent through Google Firebase Cloud Messaging and Apple's Push Notification service (United States), which handle a device identifier and the notification's text. Transactional email (for example welcome, password-reset and weekly summary emails) is delivered through Resend (United States), which handles the recipient's email address and the email content. We use these providers only to deliver our own notifications and emails on your behalf, never for their own purposes, and we take reasonable steps to ensure they handle the information consistently with the Australian Privacy Principles. We are migrating transactional email to Azure Communication Services (Australia); we are also reducing the personal information contained in notification text.

Data is encrypted at rest using AES-256 encryption and in transit using TLS 1.2 or higher. Database backups are performed daily and retained for 30 days.

Journal entries that a student marks as private are visible only to that student and are not accessible to teachers, school administrators, or parents. Daily wellbeing check-in responses are stored securely and are accessible only to the school's designated pastoral care staff (see Section 6).

5. Who We Share Data With

AchievoEDU does not sell, rent, or trade personal information. We may share data only in the following limited circumstances:

• The school that enrolled the user — schools have full access to their own students' data
• Parents or guardians — limited to their own child's data, as configured by the school
• Microsoft Azure (Australia) — cloud infrastructure: hosting, database, storage and backups, subject to their Data Processing Agreement
• Google (Firebase Cloud Messaging) (United States) — push-notification delivery (device token and notification text)
• Apple (Push Notification service / APNs) (United States) — push-notification delivery to iOS devices (device token and notification text)
• Resend (United States) — transactional email delivery (recipient email address and email content); migrating to Azure Communication Services (Australia)
• EmailJS — website contact-form email delivery only (no student data is transmitted)
• Calendly (United States) — demo-booking scheduling on our public website only; processes the name, email and scheduling details you enter to book a demo (no student data)
• Law enforcement or regulatory bodies — where required by Australian law

All third-party processors are required to maintain confidentiality and comply with Australian privacy law.

6. Student Data — Special Protections

AchievoEDU recognises that student data requires heightened protection. We apply the following additional safeguards:

• Student accounts may only be created by authorised school administrators — students cannot self-register
• Student data is never shared with other schools or third parties for commercial purposes
• Student data is deleted within 30 days of a school's subscription ending, unless a longer retention is required by law
• Wellbeing check-in responses are visible only to designated pastoral care staff, not to other students
• Parents may request a copy of their child's data at any time through their school administrator

7. Data Retention

We retain personal data only for as long as necessary to deliver our services or as required by law:

• Active school accounts — data retained for the duration of the subscription plus 30 days
• Closed school accounts — data deleted within 30 days of account closure
• System logs — retained only as long as necessary for security and debugging purposes
• Backup snapshots — retained for 30 days on a rolling basis

Schools may request early deletion of their data by contacting privacy@achievoedu.com.au. Schools may also export all data at any time from the admin portal.

8. Access, Correction, and Complaints

Under the Australian Privacy Principles, individuals have the right to:

• Request access to personal information we hold about them
• Request correction of inaccurate, incomplete, or outdated information
• Request deletion of their data (subject to legal retention requirements)
• Lodge a complaint about how we handle personal information

Students and parents should direct requests through their school administrator. Staff and administrators may contact us directly at privacy@achievoedu.com.au. We acknowledge privacy enquiries within 2 business days and fulfil access, correction, and deletion requests within 10 business days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

9. Cookies and Analytics

Our public website (achievoedu.com.au) uses Google Analytics 4 to understand how visitors find and use the site — for example, which pages are viewed and general, city-level location — so we can improve it. Google Analytics sets first-party cookies and processes this data on our behalf; IP addresses are handled in a de-identified way, and we do not enable advertising personalisation or share personal information for advertising. Our demo-booking page also embeds a Calendly scheduling widget, which may set its own cookies and processes the name, email and scheduling details you enter to book a demo (Calendly is a United States provider). The AchievoEDU platform itself uses session cookies for authentication only and does not use third-party advertising cookies.

10. Security

We implement industry-standard security measures including:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for data at rest
• Role-based access control — users only see data relevant to their role
• Ongoing internal security reviews
• Automated vulnerability scanning of dependencies
• Prompt notification to affected schools in the event of an eligible data breach

11. Changes to This Policy

We may update this Privacy Policy from time to time. Schools will be notified of material changes by email at least 30 days before they take effect. The current version is always available at achievoedu.com.au/privacy.

12. Contact Us

For privacy-related enquiries, please contact:

Privacy Officer — AchievoEDU PTY LTD
Email: privacy@achievoedu.com.au
Web: achievoedu.com.au/privacy
Australia