Privacy Policy

1. Introduction

Censai ("Censai," "we," "our," or "us") provides an Australian secondary mathematics and exam-preparation platform. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

We design the Service for students (including those under 18) and plan to support schools and tutoring centres. Adaptive learning profiles are a core educational purpose of the Service.

2. Who this policy applies to

• Individual students and parents/guardians using consumer accounts
• Teachers, tutors, and organisation admins when Organisation Accounts are enabled
• Website visitors interacting with marketing pages or waitlists

3. Individual accounts vs Organisation Accounts

4. Information we collect

5. How we use your information

We do not sell personal information. We do not use student learning data for advertising or behavioural marketing. We do not use student content to train foundation AI models.

• Provide practice, learning paths, and adaptive personalisation / learning profiles
• Operate Ask Censai tutoring
• Secure the Service, prevent abuse, and enforce limits
• Billing and account administration
• Transactional email (verification, password reset)
• Improve the platform using aggregated or irreversibly anonymised analytics where possible
• Meet legal obligations

6. Sharing and sub-processors

We share personal information with sub-processors only to operate the Service. See also our internal sub-processor register maintained by the team.

7. Overseas disclosure (APP 8)

Primary application data (accounts, profiles, attempts, learning metadata) is stored in Supabase in Sydney, Australia. Usage-quota counters are stored in Upstash Redis in Sydney (syd1).

Limited overseas processing occurs for AI inference (OpenAI), payment processing (Stripe), transactional email, and some hosting/edge/analytics functions. We take reasonable steps consistent with APP 8, including OpenAI organisation Data controls with API model training disabled, and other contractual/organisational safeguards.

8. Children’s privacy

You must be at least 13 to use the Service. Users under 18 must have parent/guardian consent before registering. By creating an account, you agree to our Terms and this Privacy Policy, including these requirements.

We do not use student data for advertising. We do not track behaviour outside the platform for marketing. We limit collection to what is needed for education, security, and billing.

We provide a plain-language Student Privacy Summary below. We will update consent practices as Australia’s Children’s Online Privacy Code is finalised.

9. Student Privacy Summary (plain English)

• We save your practice results to help choose better questions for you.
• If you tell us your school, we may use it to adjust question difficulty to that school’s past papers. You can skip this.
• If you use Ask Censai, your question and message are sent to an AI helper to reply — not to train AI, and not to show you ads.
• Your main learning records are stored in Australia.
• You (or a parent) can ask us to delete your account in Account settings.
• We do not sell your information.
• Questions about privacy: hello@censai.com.au

10. Retention and deletion

• We keep personal information while your account is active and as needed for the purposes above.
• You can delete your individual account in Account settings; we cascade-delete related learning records, AI usage metadata, badges, billing links (and cancel Stripe subscriptions where applicable), and auth credentials.
• Browser localStorage session data should be cleared on logout/delete from your device tools; the app clears known Censai keys after successful account deletion.
• Backups and logs expire per vendor retention after production deletion.
• Organisations may request deletion of organisation-linked data under the DPA when Organisation Accounts are used.
• Irreversibly anonymised aggregates may be retained.

11. Security

• TLS in transit; encryption at rest via our infrastructure providers
• Server-side API access to the database; Row Level Security on Supabase tables
• Least-privilege admin access with MFA on infrastructure accounts
• Secrets stored as server environment variables

12. Your rights (APP 12 & 13)

• Access — view profile and learning information in the product
• Correction — update profile/onboarding details; contact us for other corrections
• Deletion — Account settings or email hello@censai.com.au
• Complaints — email us; we aim to acknowledge within 5 business days and respond within 30 days. You may contact the OAIC at oaic.gov.au

13. Cookies and analytics

• Essential auth session cookies
• Vercel Analytics for product usage (not advertising)
• No third-party advertising cookies or social pixels

14. Ask Censai AI disclosure

When you use Ask Censai, we send the question, a hidden solution reference, your message, and optional diagrams to our AI provider (OpenAI) to generate a tutoring reply. Processing is for inference only. Our OpenAI organisation Data controls have API model training disabled. Zero Data Retention (ZDR) is not currently available on our plan; OpenAI may retain API data for a limited period for abuse monitoring and security under its API policies. We do not intentionally send your name, email, or school name in these requests.

Each request is processed to produce a reply; we store usage metadata (tokens/counts) in our Australian database, not full chat transcripts in the primary learning tables.

15. Data breaches

If we experience an eligible data breach likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme, including notifying the OAIC and affected individuals as required. Organisation customers will be notified promptly (target within 24–72 hours of a confirmed eligible breach).

16. Australian Privacy Principles summary

17. Changes

We may update this Privacy Policy as the Service evolves. Material changes to data practices will be highlighted by updating the Last Updated date and, for Organisation customers, by notice under the DPA where required.

18. Contact us

Censai

ABN 90 761 709 309

Australia

Privacy email: hello@censai.com.au

OAIC: oaic.gov.au

Organisations may request a DPA at the email above.