Privacy policy
Last updated: [date]
1. Who we are. Kestrel ("we", "us") is an online learning service for NSW HSC students, operated by [your legal name], ABN [ABN], trading as Kestrel. Contact: privacy@kestrel.courses · [postal address].
2. What we collect. We collect only what we need to run Kestrel:
- Account details: first name, email address (often a school email), year level and subjects.
- A parent's or carer's email (optional): only if a student asks us to send that person weekly progress reports. We email them once to ask, and only send reports if they confirm. Either of them can stop the reports at any time, and we then stop using the address for reports.
- Learning data: the questions you answer, your working, whether each step was correct, time spent, XP, levels, streaks, ratings and topic progress.
- Class details (if your school uses Kestrel): your school, class and teacher.
- Payment details (paid plans): handled by Stripe. We receive the payer's name, email and payment status, never full card numbers.
- Technical data: device type, browser and error reports, used to keep Kestrel working.
- Invites: if you join with a friend's invite link, we record who invited you so we can give you both a free week of Pro.
- Question reports: if you report a problem with a question, we keep the question, your note and which account sent it, so we can fix it.
We do not collect birthdates, photos, home addresses, phone numbers or precise location.
3. How we collect it. From you when you sign up and use Kestrel, from your parent or carer if they pay, and from your school if it sets up your class.
4. Why we use it. To run your account, save your progress, mark your work, adapt questions to your level, show your teacher your class progress (school accounts only), take payments, send account and progress emails (including weekly reports to a parent or carer who has confirmed they want them), answer support requests, and fix bugs. We do not sell personal information, and we do not use it for third-party advertising.
5. Children and consent. Kestrel is for students in Years 11 and 12. If a student is under 15, a parent or carer must agree before they create a personal account. When a school sets up Kestrel, the school is responsible for any consent its policies require.
6. Who we share it with. Only these service providers, to run Kestrel:
| Provider | What for | Where data is stored |
|---|---|---|
| [Supabase] | Database and sign-in | Australia (Sydney) |
| [Cloudflare] | Hosting the app | Global network; no account data stored |
| [Stripe] | Payments | Australia and overseas, as Stripe operates |
| [Resend] | Account and progress emails | [Location] |
| [Sentry] | Error reports (no answers or working) | [Location] |
| [Anthropic] | AI tutor and exam marking: the question, the student’s working and what they ask the tutor (no name or email) | United States; check Anthropic’s current data-retention terms |
Teachers at your school can see the progress of students in their classes. A friend who invited you can see that you joined, not your progress.
7. Overseas disclosure. Account and learning data are stored in Australia. Payment, email and error-report data may be processed overseas by the providers above, which are required to protect it.
8. Security. Data is encrypted in transit and at rest, access is limited to people who need it, and admin accounts use two-factor sign-in. If a data breach is likely to cause serious harm, we will notify affected users, the school and the OAIC as required.
9. How long we keep it. While your account is active. We delete it within 30 days of you deleting your account, or within 30 days after a school licence ends unless the school renews. We keep payment records for 5 years because tax law requires it.
10. Your choices. You can download or delete your data in the app's Account screen, or by emailing us. We respond within 30 days. Every email we send has a one-click unsubscribe link.
11. Cookies. We use only what's needed to keep you signed in.
12. Complaints. Contact us first at privacy@kestrel.courses; we reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
13. Changes. We'll tell users by email or in the app before any important change to this policy.