PiGrids

Document version: 2.11

1. Who we are & scope

PiGrids is operated by PiGrids Maths (ABN 36 311 779 711) ("we", "us" or "our") at pigrids.com. This policy covers the personal information we collect through the PiGrids website, learning platform, and tutoring services, and applies wherever you interact with us. We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You can browse our public pages without identifying yourself, and without giving a name at all (Australian Privacy Principle 2). An account - and therefore the personal information described below - is needed only to use the learning platform, because saved progress is inherently tied to an identified account.

2. What we collect

We collect only what we need to run the Service:

• Account information - your name, email address, password (stored securely by our authentication provider), and year level.
• Learning data - units you complete, questions you attempt, your results, and where you left off, so we can save and show your progress.
• Problem reports - if you tell us a question looks wrong, we record which question, which problem type you picked from our fixed list, and that it came from your account. You are never asked to type anything, so a report cannot contain personal information.
• Tutoring details - contact details, preferred session times, and, for students under 18, the contact details of a parent or guardian.
• Billing metadata - your subscription tier and status, as provided to us by Stripe. Your card number and other payment card details never touch our servers - they are collected and processed directly by Stripe.
• Technical data - authentication session cookies needed to keep you signed in, and technical error diagnostics (such as the type of fault, the page it occurred on, and browser and device type) when something goes wrong, so we can find and fix it. We do not use advertising trackers or third-party marketing cookies of any kind.

3. Why we collect it

We use personal information to:

• provide and improve the Service, including your account and learning progress;
• check and correct questions you tell us look wrong;
• process subscription billing and tutoring invoices through Stripe;
• arrange, confirm and support tutoring bookings;
• respond to your enquiries and provide support; and
• meet our legal obligations.

4. Children's data

PiGrids is used by school-age students. We collect only what the learning experience needs, and we never use a child's information for advertising.Accounts may only be created by adults.A student under 18 cannot register for the Service themselves - their parent or legal guardian creates and holds the account, and by doing so consents to our collection of that student's learning information and takes responsibility for supervising its use, as set out in our Terms of Service. That declaration is recorded at sign-up. Tutoring for a student under 18 additionally requires the parent or guardian to make the booking and provide their own contact details for that purpose. A parent or guardian may contact us at any time to request access to, or deletion of, their child's information.

What we never ask a child for.We never ask for a child's name, date of birth, age, email address, phone number, home address or photograph, and we do not collect any of them. There is no way to upload an image to this service at all. A child has no account and no login of their own, so we hold no way to contact a child and we never do. The only account details we hold are the account holder's: their name, their email address, the state or territory they chose, the record that they accepted these terms, and whether the account has been approved.

Learner profiles.You can create a separate profile for each person learning on your account, so their work is kept apart. A profile holds two things you choose — a nickname and a drawing from a fixed set — and, if you set one, the maths level that profile works at. We ask for a nickname, not a name: you do not need to use your child's real name, and the form says so. Profiles are created, renamed and deleted by you, and only you can see them.

What a lesson does record. When a question is answered we record which question it was, whether the answer was right, the answer itself so the work can be marked and shown back, and how long it took. Those records are attached to the learner profile that was practising, under your account. They are visible only to you, and are deleted when you delete them, when you delete that profile, or on the schedule in section 9. We do not build advertising profiles, we do not sell any of it, and we never use it to target advertising at anyone.

Deleting a child's records yourself.Deleting a learner profile deletes everything recorded under it — practice history, progress and results — permanently, straight away, without asking us. You will find it under Account → Learners.

Written for your child. The same promises, in language a child can read, are at Your privacy, explained. It is worth reading together - it says what we know, what we do not, and that they can ask you to delete it.

5. Disclosure

We never sell your personal information. We share personal information only with the service providers below, and only to the extent each needs it to perform its function for us:

• Stripe - processes subscription and tutoring payments (United States).
• Supabase - hosts our database and handles authentication (South Korea).
• Vercel - hosts and runs the website (United States).
• Cloudflare - provides our domain name service, protects and delivers the website through its global network, and routes email sent to our pigrids.com addresses (United States; requests are served from a worldwide network of servers that includes Australia).
• Google Cloud Storage- stores our encrypted database backups in a private bucket, so the backups contain the same account and learning information as the database itself (replicated across Google's Asia multi-region).
• Resend - sends transactional emails (for example, receipts and booking confirmations) (United States).
• Sentry - records technical error diagnostics so we can find and fix faults (European Union).
• Google - provides video-call links for online tutoring sessions, and hosts the mailbox that email sent to our pigrids.com addresses is forwarded to, so it processes the contents of messages you send us (United States).

We may also disclose information where required by law. Our pages sometimes link to sites we do not run - the OAIC, Stripe, a video-call link - and once you follow one of those you are on their site under their privacy policy, not ours.

6. Overseas disclosure

Most of the providers listed above store or process data on servers located outside Australia. Your account details and learning progress are stored by Supabase in South Korea. Technical error diagnostics are processed by Sentry in the European Union. Payment, hosting, email and video-call providers process data in the United States. Our database backups are held by Google Cloud Storage in its Asia multi-region, meaning they are replicated across several data centres in Asia rather than kept in one country. Cloudflare delivers our website from a global network, so some requests are handled on servers within Australia and others overseas. Where information is disclosed overseas, we take reasonable steps to ensure your information receives protection comparable to the APPs, consistent with our obligations under Australian Privacy Principle 8.

7. Marketing

We send only service emails - receipts, booking confirmations, security notices, and notices about your account or material changes to our terms. We do not send marketing email unless you have expressly opted in, and we never provide your information to third parties for their marketing.

If you have opted in, every marketing email carries a working unsubscribe link, and you can also opt out at any time by emailing [email protected]. We act on it within five working days. Opting out never affects service emails - you will still receive receipts, security notices and anything we must tell you about your account, because those are not marketing. We do not market to you by SMS, phone or post.

8. Security

We use row-level security so each account can reach only its own data, encryption in transit, and least-privilege service credentials. Card data is held by Stripe under PCI-DSS - we never hold it. No online service is completely secure, so please keep your login details to yourself.

9. Retention

We keep your account details and your progress for as long as your account exists, because a student who returns after a break should find their work still there.

Individual question records. When you answer a question - in practice, or in a practice exam - we record which question it was, what you chose or typed, and whether it was marked right. When a question asks you to type your answer, we send it to our server to check it; we keep the text you typed only where it is a short value such as a number, and for longer written answers we keep only the result, never the words you wrote. We also record when you ask to see a worked answer. We keep that question-by-question detail for 12 months. After that it is replaced by monthly totals for each topic and the individual records are deleted. The totals are what your progress is built from, so nothing you have learned is lost when the detail goes.

We delete it when you delete your account, or when you ask us to. We also delete accounts that have been inactive for 24 months, after emailing the account holder first so the account can be kept if it is still wanted. Records we are legally required to keep - tax and payment transaction records - are retained for up to seven years under Australian law, even after account deletion.

We also keep a count of how often each answer option is chosen across all students, to find questions that are unclear or wrong. Those counts are not linked to any accountand cannot be traced back to you, so we keep them for as long as the question exists.

10. Access, correction & deletion

Email [email protected]from the address on the account, saying what you want - a copy of your information, a correction, or deletion. We may ask one question to confirm it is really you, so that nobody else can obtain or delete a child's records.

We respond within 30 days, and we do not charge a fee for access, correction or deletion. If we cannot do what you asked - which for deletion means only the records we are legally required to keep, described in section 9 - we will tell you why in writing, and how to complain if you disagree.

11. Complaints

If you have a privacy concern, contact us first at [email protected] and we will try to resolve it. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Data breaches

We maintain practices to detect and respond to data breaches, and if an eligible data breach occurs we will act in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), including notifying affected individuals and the OAIC where required.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "last updated" date and, where changes are material, take reasonable steps to let you know.

14. Contact

For any privacy question or request, contact our privacy officer at PiGrids Maths (ABN 36 311 779 711) via [email protected].