Privacy Policy

1. About this policy

Sigma Science Education (“we”, “us”, “Sigma”) operates Portal, an online platform for AI‑assisted exam marking, practice feedback (“SigmAI”), and progress reporting for our tutoring students, their parents/guardians, and our staff. This policy explains what personal information we collect, why, how we handle and protect it, who we share it with, and your rights. It is designed to align with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because most of our students are minors, we rely on the enrolling parent/guardian’s consent (see section 6).

2. Whose information we handle

Students (many under 18), parents/guardians who enrol them and receive reports, and our staff.

3. What personal information we collect

Students: name, email, year level, school, class/enrolment, exam and homework submissions (including photographs or scans of handwritten work), typed answers, marks and AI‑generated feedback, SigmAI practice activity, and — for account security — sign‑in times, device identifiers and IP addresses.

Parents/guardians: name, email, phone, the link to your child(ren), and records of notifications we send you.

Staff: name, work email, role and permissions, and activity/audit records.

Payments: token purchases are processed by Stripe. We receive a record that a purchase occurred and the amount; we do not collect or store your card numbers (section 8).

4. How we collect it

Directly (on enrolment, when work is submitted, and when accounts are used) and automatically (sign‑in, device and IP information for security, and bot‑protection signals on our login page via Cloudflare Turnstile).

5. Why we collect and use it

To provide the service (mark work, generate feedback and practice, produce reports), communicate results and notices, operate and secure accounts, process token purchases, and meet our legal obligations. We do not sell personal information or use it for third‑party advertising.

6. Children’s privacy and consent

Portal is for our tutoring students, including minors. Accounts are created by us on enrolment — there is no public self‑sign‑up. We rely on the enrolling parent/guardian to consent to this policy on behalf of a child not old enough to consent themselves. A parent/guardian may at any time request access to, correction of, or deletion of their child’s information (sections 11–12).

7. Who we share it with (service providers & overseas disclosure)

We use trusted service providers to run Portal, each receiving only what it needs. Some are located outside Australia (primarily the United States), so your information may be disclosed overseas. They include: Supabase (database/accounts/storage — Australia, Sydney region), Vercel (hosting), Anthropic (AI marking), Resend (email), Twilio (SMS, if enabled), Stripe (payments), Backblaze (encrypted backups) and Cloudflare (login bot‑protection).

AI processing: to mark work and generate feedback, student submissions (including images of handwritten work) are sent to our AI provider (Anthropic). Under our provider’s API terms, this content is processed to return marks/feedback and is not used to train their AI models. We share only what is needed to mark the work.

8. Payments

Token purchases are handled by Stripe via its hosted checkout. Your card details are entered on Stripe’s systems and never pass through or get stored on ours. We keep only a record that a purchase was made and its amount, for accounting.

9. How we protect your information

Row‑level security on every database table (students see only their own work; parents only their linked children’s released results), encryption in transit (HTTPS/TLS) and encrypted backups, restricted and audit‑logged admin access, and login protections (bot challenge, rate‑limiting, breached‑password blocking, single‑session controls). Secrets and API keys are held server‑side only. No system is perfectly secure, but we take reasonable steps to protect your information and to detect and respond to incidents.

10. Where your information is stored

Core data (accounts, submissions, marks) is stored in Supabase’s Sydney (Australia)region. Certain processing necessarily occurs overseas — AI marking, email/SMS delivery, payments, backups and content delivery — as listed in section 7.

11. Accessing and correcting your information

You (or a parent/guardian for a child) may request access to, or correction of, the personal information we hold. Much of it is visible in the app; for anything else, contact our Privacy Officer. We respond within a reasonable time and explain any refusal.

12. Retention and deletion

Deactivation keeps a student’s records but revokes access. Deletion permanently removes the individual’s personal information from our live systems, including submitted files. Some records are retained where the law requires (financial records for taxation; security audit logs for at least 12 months). Deleted information may persist in encrypted backups until they age out on their normal rotation, after which it is gone. To request deletion, contact our Privacy Officer.

13. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and secure your session, and load Cloudflare Turnstile on the login page for bot protection. We do not use third‑party advertising or cross‑site tracking cookies.

14. Data breaches

If a data breach likely to result in serious harm occurs, we will act in accordance with the Notifiable Data Breaches scheme, including notifying affected individuals and the OAIC where required.

15. Complaints

Contact our Privacy Officer first and we will try to resolve your concern. If you are not satisfied, you may contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

16. Changes to this policy

We may update this policy from time to time. The current version is always available at this page, with the effective date shown above. Material changes will be communicated to account holders.

17. Contact us

Privacy Officer, Sigma Science Education — [privacy@sigmascience.com.au] · [phone] · [postal address].