Privacy Policy

Last Updated: 25 March 2026

Welcome to StudyPulse (“we,” “us,” or “our”). StudyPulse is a gamified learning platform designed primarily for VCE (Victorian Certificate of Education) students, providing instant AI-powered feedback on practice questions, intelligent analytics, gamification features, and access to high-quality question banks and resources. We recognize the importance of safeguarding the personal information you provide to us. This Privacy Policy outlines how we collect, use, disclose, and protect your information when you use our website, mobile application, and any related services (collectively, the “Services”).

We are committed to complying with all relevant data protection laws and regulations applicable in Australia, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we act on behalf of Victorian public sector organisations, we also comply with the Information Privacy Principles (IPPs) set out in the Privacy and Data Protection Act 2014 (Vic). If you are accessing the Services from outside of Australia, you acknowledge that your information may be transferred to, stored, and processed in Australia as explained in this Privacy Policy.

Please read this Privacy Policy carefully. By accessing or using our Services, you agree to the collection and use of your personal information as described in this Policy. If you do not agree with our practices, please discontinue use of our Services immediately.

1. Scope

This Privacy Policy applies to all users of StudyPulse, including students, parents, educators, or any other visitors (collectively, “users” or “you”). It covers information we collect through:

Our website(s) located at https://studypulse.au and related subdomains.
Our mobile applications (if any).
Any other products or services that we offer and that reference this Privacy Policy.

Certain third parties (e.g., schools, tutoring centers) may use our Services on behalf of students. In such cases, we expect that those entities have the necessary authority and consent to provide personal information on behalf of their students.

2. Information We Collect

We collect various types of information to provide and improve our Services. The information we collect may include:

2.1 Personal Information

Account and Profile Information: When you create an account, we may collect information such as your name, email address, username, password, year level (e.g., Year 11 or 12), school name, and subjects of interest.
Payment Information: If you choose to purchase a subscription or other paid offerings, we may collect payment details (e.g., credit card or bank information) via secure third-party payment processors like Stripe. We do not store your credit card details on our servers. School-provisioned accounts do not use Stripe — billing is handled directly between StudyPulse and the school.
Demographic Information: In some cases, we may ask for optional demographic information (e.g., age, location) to better personalize content or for analytics.

2.2 Usage Data

When you use our Services, we automatically collect certain information about your device and usage, including:

Log Data: Internet Protocol (IP) address, device type, browser type, pages visited, duration on pages, and timestamps.
Cookies & Tracking Technologies: We may use cookies, web beacons, pixels, session replay tools, and similar technologies to gather information about your interactions. For more information, see Section 7. Cookies & Other Tracking Technologies.
Activity and Performance Data: Questions attempted, answers submitted, scores, time spent on tasks, usage trends (e.g., streaks, leaderboard ranking).

StudyPulse provides instant AI-powered feedback on your submissions. When you submit written responses (including typed or handwritten answers scanned via optical character recognition (OCR)), these responses may be processed by third-party AI providers (currently Google Gemini via Vertex AI as the primary provider, with OpenAI as a fallback) to generate feedback. Your name, email, school, and other personal identifiers are never sent to AI providers. The full list of AI sub-processors and the data each receives is published below at Section 9.1. Sub-Processors.

This data is stored for:

Generating personalised analytics (e.g., identifying strengths and weaknesses).
Creating anonymized or aggregated insights to improve our Services. No student data is used for AI model training or fine-tuning — any fine-tuning uses only examination board content.

2.4 Communications

Customer Support: If you contact us via email (e.g., at [email protected]) or through support forms, we may collect the content of your message and contact details to respond to you.

2.5 Information from Third Parties

Social Login & OAuth: If you choose to log in using third-party services (e.g., Google or Microsoft Entra ID), we receive limited information (email address, first name, last name, and a unique account identifier) to facilitate account creation and authentication.
School or Organization: If your school or tutoring center purchases a bulk license, they may provide us with your name, school email address, or enrollment details.

3. How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery:
- Provide, maintain, and improve our Services.
- Facilitate AI-based question marking and feedback.
- Provide personalised question recommendations, progress tracking, and performance analytics.
- Operate leaderboards, competitions, and gamification features. Leaderboards may display your first name and school name to other authenticated users. For school-provisioned accounts, a school-only leaderboard may be enabled so that your information is only visible to users within your school.
Account Management & Security:
- Authenticate your account and ensure only authorized access to your content.
- Process your subscription payments or in-app purchases.
- Monitor and protect against fraudulent or unauthorized activities.
Personalization & Analytics:
- Tailor the content, question sets, and recommendations based on your subjects, progress, or performance.
- Conduct data analysis to improve the quality and accuracy of AI feedback, analytics dashboards, and study suggestions.
Communication:
- Respond to inquiries or support requests you submit.
- Send administrative updates (e.g., password resets, transactional emails).
- Provide updates about new features, promotional offers, or changes to our policies (where permitted by law).
Compliance & Legal Obligations:
- Enforce our Terms of Service and other usage policies.
- Comply with applicable laws, regulations, or legal processes.
Research & Development:
- Aggregate or anonymize user data for internal research and analysis, product development, troubleshooting, or improvement of AI accuracy.

4. Disclosure of Your Information

We do not sell or rent your personal information. We may share your information in the following ways:

Service Providers:
- We employ trusted third-party companies to perform tasks on our behalf (e.g., hosting, analytics, payment processing, AI marking, OCR). These partners have limited access to your information solely to perform these tasks and are obligated not to disclose or use it for other purposes. A complete list of sub-processors is published below at Section 9.1. Sub-Processors. Schools with a signed Data Processing Agreement are notified of any material changes.
Schools or Organizations:
- If your access to StudyPulse is provided by a school or institution, certain performance metrics (e.g., usage data, scores, completion stats) may be shared with that school’s administrators or teachers for educational oversight purposes.
- Data Isolation: Each school organisation’s data is logically separated. Teachers and administrators can only access data for students within their own organisation. Cross-organisation data access is prevented by application-level access controls.
Legal Requirements:
- We may disclose your information if required by law, subpoena, or if we believe in good faith that such disclosure is necessary to protect our rights, investigate fraud, ensure user safety, or respond to a government request.
Business Transfers:
- In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that deal, subject to confidentiality obligations.
With Your Consent:
- We may share information with third parties outside the above scope if we obtain your explicit consent or at your direction.

5. Children’s Privacy

StudyPulse’s Services are primarily intended for students aged 16 years and above, specifically those in VCE years (Year 11 and 12). We recognize that some students may be under 18 years old. For users under 18, we require that you review this Privacy Policy with your parent or guardian to ensure you both understand and consent to it.

Parental/Guardian Consent: If you are a parent or guardian and believe your child has provided personal information without your consent, please contact us immediately at [email protected].
Applicable Laws: We comply with relevant Australian privacy laws, including additional considerations around minors’ data.

6. Data Retention

We retain your personal information for as long as needed to provide the Services, subject to the following maximum retention periods:

Data Category	Retention Period
Account profile (name, email, school, year level)	Duration of account + 30 days after deletion
Answer submissions and AI feedback	Duration of account + 30 days after deletion
Essay submissions and uploaded images	Duration of account + 30 days after deletion
Chatbot/tutoring conversation logs	Duration of account + 30 days after deletion
De-identified usage analytics	26 months from collection
Payment and billing records	7 years from transaction (Australian tax law)
Security and audit logs	2 years from creation

If you request account deletion, we will delete or anonymize your personal information in accordance with Section 12 (Account Deletion) and the retention periods above. Payment records are retained as required by Australian tax law.

7. Cookies & Other Tracking Technologies

StudyPulse uses cookies and similar tracking technologies to personalize your experience, analyze usage trends, and maintain site security.

7.1 Cookies

Session Cookies: Temporary cookies that help you navigate the site and keep you logged in.
Persistent Cookies: Remain on your device for a set period or until you delete them, used for remembering user preferences or login details.
Authentication Cookies: Secure, httpOnly cookies used to maintain your login session. These cookies are not accessible to JavaScript and are only transmitted over HTTPS in production.

7.2 Analytics and Tracking Services

We use the following third-party analytics and tracking services:

Google Analytics (Google LLC): We use Google Analytics to understand how users interact with our Services, helping us improve the user experience. Google Analytics collects anonymised usage data including page views, session duration, and device information. For more information, see Google’s Privacy Policy.
Microsoft Clarity (Microsoft Corporation): We use Microsoft Clarity for heatmap analytics to understand how users interact with our website. Clarity may record mouse movements, clicks, and scrolls during your session. We use strict masking for all content — no user-identifiable information or text on screen is shared with or stored by Clarity. This data is processed by Microsoft and may be stored outside Australia. By using our site, you agree that we and Microsoft can collect and use this data. For more information, see Microsoft’s Privacy Statement.
Meta Pixel (Meta Platforms, Inc.): We use the Meta (Facebook) Pixel to measure the effectiveness of our advertising and to understand how users arrive at our website. The Meta Pixel collects data including page views, referral information, and conversion events (e.g., account registration, subscription purchase). This data is sent to Meta and may be used by Meta in accordance with Meta’s Data Policy. The Meta Pixel operates on both public and authenticated pages.

7.3 Analytics Controls for Schools

For accounts provisioned through a school or institutional agreement, the school may request that non-essential analytics and tracking services (Google Analytics, Microsoft Clarity, and Meta Pixel) be disabled for their students’ and teachers’ authenticated sessions. When enabled, no third-party tracking scripts are loaded for school users. Essential cookies (authentication, security) cannot be disabled as they are required for the Service to function.

7.4 Managing Cookies

You can choose to disable cookies through your browser settings, but this may limit your ability to use certain features of our Services.

8. Data Security

We implement a range of security measures to protect your personal information:

Encryption at Rest: All database clusters are encrypted at rest using AES-256 encryption (managed by the hosting provider).
Encryption in Transit: We secure all connections via TLS/SSL and enforce HTTPS for all application communications.
Network Security: We restrict database access exclusively to the private local network.
Access Controls: We limit access to personal information to employees and contractors who need it for the provision of Services.
Infrastructure Protection: We use automated, always-on DDoS mitigation to prevent downtime and protect against attacks.

No transmission method or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable laws.

9. Data Residency

We store 100% of your data in Australia. Our databases and all primary infrastructure are located exclusively in Sydney, Australia.

When you use AI-powered features, your answer text and question context (containing no personal identifiers) may be temporarily processed by AI providers whose servers are located in the United States. This data is processed in transit for the sole purpose of generating marking feedback. We have a Zero Data Retention (ZDR) agreement in place with Google Cloud (Vertex AI, including Cloud Vision OCR for image processing), meaning no prompt or image data is retained or logged by the provider after processing. We are actively pursuing a zero-data-retention agreement with OpenAI; until it is signed, OpenAI default retention policies (up to 30 days for abuse monitoring) may apply to fallback traffic.

Other third-party services that may process limited data outside Australia include: Stripe (payment processing, US — not used for school-provisioned accounts) and Mailgun (transactional email, US). Image storage (Cloudinary) is hosted in Australia, though CDN delivery may involve other regions. Client-side analytics services (Google Analytics, Microsoft Clarity, Meta Pixel) also process data in the United States — see Section 7 for details. For school accounts, these analytics services can be disabled on request.

We take reasonable steps to ensure that all overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles (APP 8), and we remain accountable for their handling of your data.

9.1 Sub-Processors

The following sub-processors may process personal information on our behalf in connection with the Service. We have data processing agreements or equivalent contractual safeguards in place with each sub-processor.

Sub-processor	Contact	Data Types & Purpose	Lawful Basis	Location
DigitalOcean, LLC	digitalocean.com / [email protected]	Application and user data — cloud infrastructure hosting	Performance of contract; legitimate interests (service delivery)	Australia
Cloudinary Ltd	cloudinary.com / [email protected]	User-uploaded images — image hosting and delivery	Performance of contract	Australia
Google LLC (Cloud Vision)	cloud.google.com / cloud.google.com/contact	Handwritten answer images (no personal identifiers attached) — handwriting recognition. Zero Data Retention (ZDR) agreement in place — Google does not retain image data after processing.	Performance of contract	United States
Google LLC (Vertex AI / Gemini)	cloud.google.com / cloud.google.com/contact	Question text, student answer text, and rubric (no personal identifiers attached) — primary AI marking and tutoring chatbot. Zero Data Retention (ZDR) agreement in place — Google does not retain prompt or completion data after processing.	Performance of contract	United States
OpenAI, L.L.C.	openai.com / [email protected]	Question text, student answer text, and rubric (no personal identifiers attached) — fallback AI marking and tutoring chatbot when the primary provider is unavailable. ZDR is being pursued; until signed, OpenAI’s default API retention (up to 30 days for abuse monitoring) may apply to fallback traffic.	Performance of contract	United States
Amazon Web Services, Inc. (S3)	aws.amazon.com / aws.amazon.com/contact-us	User-uploaded files (e.g. PDFs, photos of handwritten answers) — object storage. Hosted in Sydney (`ap-southeast-2`).	Performance of contract	Australia
Stripe, Inc.	stripe.com / [email protected]	Email and billing information — payment processing for individual subscriptions (not used for school-provisioned accounts)	Performance of contract; legal obligation	United States
Mailgun Technologies, Inc.	mailgun.com / [email protected]	Email addresses and message content — transactional email delivery	Performance of contract; legitimate interests	United States
Google LLC (Analytics)	analytics.google.com / support.google.com/analytics	Anonymised page views, session duration, device information — usage analytics (disabled on request for school-provisioned accounts)	Consent; legitimate interests	United States
Microsoft Corporation (Clarity)	clarity.microsoft.com / clarity.microsoft.com/help	Heatmap data, mouse movements and clicks with strict content masking applied — user experience analytics (disabled on request for school-provisioned accounts)	Consent; legitimate interests	United States
Meta Platforms, Inc. (Pixel)	facebook.com/business / facebook.com/business/help	Page views, conversion events, referral information — advertising attribution and measurement (disabled on request for school-provisioned accounts)	Consent	United States

Updates to sub-processors: We will update this list when we add or change sub-processors. Schools with active agreements will be notified of any material changes to sub-processors that handle their data.

Sub-processor controls for schools: As described in Section 7.3, school-provisioned accounts can request that non-essential analytics sub-processors (Google Analytics, Microsoft Clarity, Meta Pixel) be fully disabled for their users.

10. Third-Party Links and Content

StudyPulse may contain links to third-party websites or external content (e.g., external tutorials, VCE resources, third-party exam providers). We do not control these websites or their privacy practices. We encourage you to review the privacy policies of any site you visit.

11. Your Rights and Choices

You have the following rights regarding your personal information:

Access: You may request access to all personal information we hold about you.
Correction: You may request correction of any inaccurate or incomplete personal information.
Deletion: You may request deletion of your personal information. See Section 12. Account Deletion for more details.
Opt-Out of Marketing: You can opt out of receiving promotional emails by clicking “unsubscribe” in any email or by updating your account settings.

To exercise any of these rights, contact us at [email protected]. All requests are free of charge. We will acknowledge your request and provide a response within 30 days. For complex requests, we may require up to 3 months to fully resolve, and we will keep you informed of our progress. If we refuse a request, we will provide written reasons in accordance with applicable law.

12. Account Deletion

If you wish to delete your StudyPulse account:

Initiate Request: Contact us at [email protected] or use the account settings page (if available) to request deletion.
Cool-Off Period: We implement a 14-day cool-off period during which your data is not visible to others, allowing you to reverse your decision if you change your mind.
Permanent Deletion: After the cool-off period, all associated personal data will be deleted or irreversibly anonymized within 30 days, in accordance with the retention periods in Section 6. The only data retained after deletion is:
- Payment and billing records (7 years, as required by Australian tax law).
- Security and audit logs (2 years, for compliance purposes).

Important: Once your account is permanently deleted, you will lose all progress, submissions, content, and data associated with it. If your account is provided by a school, please consult with them before requesting account deletion. For school-provisioned accounts, data deletion is governed by the applicable Data Processing Agreement between StudyPulse and the school.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make material changes, we will post the updated version with a new “Last Updated” date at the top. Where required by law, we will provide you with notice and/or request your consent. We encourage you to review this Privacy Policy periodically to stay informed of our data practices.

14. Contact Us

If you have questions or concerns about this Privacy Policy, or wish to exercise any of your rights, please contact us at:

StudyPulse Pty Ltd (ACN 692945912)
Email: [email protected]
Melbourne, Australia

Thank you for trusting StudyPulse with your learning journey. We remain committed to protecting your personal information and providing a secure, efficient, and engaging study platform.

15. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us at [email protected]. We will acknowledge your complaint, investigate the issue, and provide you with a written response within a reasonable timeframe (usually 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).