Privacy Policy

1. About this policy

This policy explains what information Michael Bauman, trading as AICT Education ("AICT", "we") collects through the AICT website and web application (the "Service"), why, who sees it and how long it is kept. It covers two groups of people: account holders (teachers and parents, who are adults), and students (who use the Service through an account holder's class and do not have accounts).

For schools, student information is handled as described in the Classroom Data Agreement that the teacher accepts when creating a class. For homeschool families it is handled as described in the Homeschool Parent Consent. If those documents give you more protection than this policy, the more protective one applies.

2. Information we collect from account holders

• Account details: your email address, your name if you give it, your password (stored only as a secure hash, never in plain text), your time zone and notification choices.
• Records of what you accepted: when you accepted our Terms and Privacy Policy, confirmed you are 18 or older, and accepted a classroom agreement, with the version and the time.
• Where you heard of us, if you arrived through a link or code that identifies a source (for example, a code from a book).
• Billing details: handled by Stripe. We receive your Stripe customer reference, the plan, the payment status and invoice records. We never see or store your card number.
• Class information: class names, grade bands, subjects, class codes and settings.
• Security and operations records: login sessions, short-lived counters that limit repeated requests (kept for 24 hours), and standard server logs kept by our hosting provider.
• Messages you send us, for example support emails.
• If you join our updates list (you do not need an account): your email address, whether you are a teacher, parent, school leader or other, your state if you give it, where you heard of us, and a record of when you agreed to receive emails. The updates list is for adults only.
• Organisations we contact about AICT: when we contact a homeschool organisation, curriculum reviewer or publication, we keep the organisation's name and website, the business contact details it publishes for enquiries of that kind (for example a reviews or info email address), where we found them, and a record of the messages we sent and any reply. We collect these from the organisation's own public website. We do not contact individual parents this way, and we do not buy contact lists.

3. Information about students

We collect only what we need to run a lesson and show the teacher what happened. We do not collect a student's real name, email address, date of birth, photo, home address, precise location or contact details, and students do not create accounts or passwords.

Students are asked to write about their thinking and not to include their name or personal details. If a student does include personal information in their writing, we treat it as student data, protected in the same way, and deleted on the same schedule.

4. How we use information

• To provide the Service: run lessons, score reflections, write follow-up questions, show growth to the teacher or parent, and produce the reports they ask for.
• To keep students safe: check writing for signs a student may need support and tell the class teacher or parent.
• To bill you, keep accounts secure, prevent misuse and answer your questions.
• To send news and offers to people who joined our updates list and agreed to receive them. Every such email has an unsubscribe link, and we never use student information for this.
• To contact organisations that publish a way to submit products for review or listing, about AICT only. Each message includes our postal address and a way to opt out, and we stop as soon as an organisation asks us to, replies, or signs up.
• To improve the Service using combined, de-identified results only. Groups smaller than five students are never shown, and we do not try to re-identify anyone.
• To meet legal obligations.

We do not sell personal information. We do not share it for advertising. We do not show advertising in the Service. We do not build profiles of students for any purpose other than the school or family's educational use. We do not use student writing to train AI models.

5. How artificial intelligence is used

Student writing is sent securely to a third-party AI provider so that it can score reflections, write follow-up questions and check for safety concerns. The AI is instructed to ask questions rather than give answers. It does not make decisions about a student. A teacher or parent decides what to do about any flag or score.

Our AI provider is Anthropic. It processes student writing only to send back its reply to us. Under its commercial terms it may not use content we send through its business interface to train its AI models, and we never give it permission to. Under its published data-retention policy it deletes what we send, and its replies, automatically within 30 days. It may keep content longer only if its automated safety systems flag a request as a possible breach of its usage policy (up to two years), or if the law requires it. We do not use any of the provider's optional features that store content on its systems for longer, such as file storage or batch processing.

When we delete student writing at the end of a semester, copies sent to the AI provider are not deleted on that date. They are deleted under the provider's own 30-day rule described above, which means most have already been deleted by then.

AI can make mistakes. Scores and flags should be treated as one input to a person's own judgment, never the only basis for an important decision.

6. Who we share information with

We share information only with the companies that help us run the Service, listed below. Each is bound by terms that require it to protect the information and use it only for our purposes.

We may disclose information if a court order, subpoena or other law requires it. Unless the law forbids it or requires immediate disclosure, we tell the school or parent before we do, so they can respond. We do not disclose student information to protect someone's safety ourselves. The teacher or parent decides what to do about a concern. The one exception is an emergency declared by an authorized school official, where the law allows it. If our business is transferred to a company or a buyer, student information stays protected by this policy and the agreements above, the new owner must accept the same promises, and we will tell account holders in writing.

We will not give student information to any other third party, including for marketing or advertising.

7. How long we keep information

• Lesson writing and scores: until the end of the current semester, then deleted automatically. The semester ends on 15 January and 1 July. Copies sent to our AI provider are deleted by the provider within 30 days (see section 5).
• Alias lists: reset once a year at the start of the school year, or sooner if you remove an alias.
• Flagged writing: kept until the teacher opens it, then deleted after 3 days (urgent flags) or 7 days (other flags). If it is never opened it is deleted after 30 days.
• Safety log (no writing): 12 months.
• Usage records: 13 months.
• Updates list: until you unsubscribe. We then delete your state and where you heard of us, and keep only your email address, the date you unsubscribed and the record of your earlier agreement, so that we never email you again.
• Organisations we contacted: up to 24 months after our last message to them. If they asked us to stop, we keep only their address on a do-not-contact list, so that we never contact them again.
• Account details: while your account is open. When you delete your account, your classrooms, rosters, lessons and flags are deleted straight away and your subscriptions are cancelled. We may keep billing records for as long as tax and accounting law requires.

After deletion, copies can remain in our database provider's daily backups for up to 7 days, and are then overwritten. We keep each kind of information only for the reason and the time shown in this policy, we keep a written retention schedule, and we delete information that is no longer needed for the purpose it was collected.

8. How we protect information

We maintain a written information security program. Connections to the Service are encrypted. Student writing and flagged writing are encrypted when stored. Passwords are hashed. Access to student information is limited to the account holder who owns the class and to a small number of AICT staff who need it to run the Service or to respond to a support request, and our systems keep that access to what is needed. We review our security measures at least once a year and after any incident, and we keep a written plan for responding to a breach. We require our providers to protect information with reasonable security measures. Security questions can be sent to admin@aict.com.au.

No system is perfectly secure. If we find a breach that affects personal information, we notify the affected teachers, schools or parents without undue delay, and within 72 hours of confirming it or any shorter time the law or your agreement requires. We say what happened and what we are doing, and help with any notification the law requires. We begin investigating as soon as we learn of a suspected breach.

9. Children's privacy

The Service is used by children, but only under the direction of a school, a teacher or a parent. We design and run the Service to comply with the US Children's Online Privacy Protection Act (COPPA), including its 2025 amendments.

• School use: we collect student information only for the school's educational purpose and for no other commercial purpose. The teacher confirms that the school allows the Service to be used in the classroom, and an account alone does not show that a school or district has approved it. We give the school and the teacher the information a parent would be given, and we remain responsible for our own compliance.
• Homeschool use: we collect children's information only after a parent or guardian gives consent (see the Homeschool Parent Consent). We verify consent by a card payment, which is a monetary transaction for which Stripe emails the cardholder a receipt each time, together with your declaration that you are the child's parent or legal guardian. A payment alone does not prove who someone is, so if we cannot rely on it we will use another verification method before collecting a child's information.
• We do not disclose children's personal information to anyone other than the providers listed above, which we need to run the Service, and we do not use it for advertising.
• A parent can ask to see a child's information, have it deleted, or stop further collection. See the next section.

If you believe a child has given us personal information outside these arrangements, tell us at once and we will delete it.

10. Your rights and choices

You can ask to see, correct, export or delete personal information we hold about you, or about a child in your care. Residents of some US states, including California, have specific rights over their personal information, and we honor them. We do not discriminate against anyone for using their rights.

• Teachers and homeschool parents: in your dashboard you can view student results, download a student's growth summary or everything held about an alias, delete a student's data, download a class report, and delete your account and all its data.
• Parents of a student in a school class: because students are identified only by an alias, we cannot tell which alias belongs to your child. Ask your child's teacher or school, who can find the alias, show you the information, download it, or delete it. We help the teacher to do this, and will respond to a request within 10 business days.
• Anyone: email admin@aict.com.au. We may need to confirm who you are before acting, and we respond within 45 days.

You can switch off wellbeing follow-up emails in Profile. Urgent safety alerts are always sent, because a person needs to see them.

11. Cookies and tracking

The Service stores a small amount of data in your browser only to keep you signed in and remember your choices. We do not use advertising cookies or cross-site trackers. We do not respond to Do Not Track signals because we do not track people across other sites.

12. Where information is stored

Michael Bauman, trading as AICT Education is based in Australia. The Service's database and web hosting are in the United States, and student information is stored there. The person who runs the Service works from Australia and may view student information from there when needed to run the Service or answer a support request, under the safeguards in section 8. Our AI provider processes student writing on its own systems, as described in section 5.

13. Changes and contact

If we make a material change to this policy, we email account holders at least 30 days beforehand and update the date at the top of this page.

Questions or requests: Michael Bauman, trading as AICT Education, Queensland, Australia. Email admin@aict.com.au. A person will reply.