Privacy Policy

Last Updated: 20 May 2026

Welcome to StudyPulse (“we,” “us,” or “our”). StudyPulse is a gamified learning platform designed primarily for VCE (Victorian Certificate of Education) students, providing instant AI-powered feedback on practice questions, intelligent analytics, gamification features, and access to high-quality question banks and resources. We recognize the importance of safeguarding the personal information you provide to us. This Privacy Policy outlines how we collect, use, disclose, and protect your information when you use our website, mobile application, and any related services (collectively, the “Services”).

We are committed to complying with all relevant data protection laws and regulations applicable in Australia, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we act on behalf of Victorian public sector organisations, we also comply with the Information Privacy Principles (IPPs) set out in the Privacy and Data Protection Act 2014 (Vic). If you are accessing the Services from outside of Australia, you acknowledge that your information may be transferred to, stored, and processed in Australia as explained in this Privacy Policy.

Please read this Privacy Policy carefully. By accessing or using our Services, you agree to the collection and use of your personal information as described in this Policy. If you do not agree with our practices, please discontinue use of our Services immediately.

1. Scope

This Privacy Policy applies to all users of StudyPulse, including students, parents, educators, or any other visitors (collectively, “users” or “you”). It covers information we collect through:

Our website(s) located at https://studypulse.au and related subdomains.
Our mobile applications (if any).
Any other products or services that we offer and that reference this Privacy Policy.

Certain third parties (e.g., schools, tutoring centers) may use our Services on behalf of students. In such cases, we expect that those entities have the necessary authority and consent to provide personal information on behalf of their students.

2. Information We Collect

We collect various types of information to provide and improve our Services. The information we collect may include:

2.1 Personal Information

Account and Profile Information: When you create an account, we may collect information such as your name, email address, username, password, year level (e.g., Year 11 or 12), school name, and subjects of interest.
Payment Information: If you choose to purchase a subscription or other paid offerings, we may collect payment details (e.g., credit card or bank information) via secure third-party payment processors like Stripe. We do not store your credit card details on our servers. School-provisioned accounts do not use Stripe — billing is handled directly between StudyPulse and the school.
Demographic Information: In some cases, we may ask for optional demographic information (e.g., age, location) to better personalize content or for analytics.

2.2 Usage Data

When you use our Services, we automatically collect certain information about your device and usage, including:

Log Data: Internet Protocol (IP) address, device type, browser type, pages visited, duration on pages, and timestamps.
Cookies & Tracking Technologies: We may use cookies, web beacons, pixels, session replay tools, and similar technologies to gather information about your interactions. For more information, see Section 7. Cookies & Other Tracking Technologies.
Activity and Performance Data: Questions attempted, answers submitted, scores, time spent on tasks, usage trends (e.g., streaks, leaderboard ranking).

StudyPulse provides instant AI-powered feedback on your submissions. When you submit written responses (including typed or handwritten answers scanned via optical character recognition (OCR)), these responses may be processed by third-party AI providers to generate feedback. Your name, email, school, and other personal identifiers are never sent to AI providers. The full list of AI sub-processors and the data each receives is published below at Section 9.1. Sub-Processors.

This data is stored for:

Generating personalised analytics (e.g., identifying strengths and weaknesses).
Creating anonymized or aggregated insights to improve our Services. No student data is used for AI model training or fine-tuning — any fine-tuning uses only examination board content.

2.4 Communications

Customer Support: If you contact us via email (e.g., at [email protected]) or through support forms, we may collect the content of your message and contact details to respond to you.

2.5 Information from Third Parties

Social Login & OAuth: If you choose to log in using third-party services (e.g., Google or Microsoft Entra ID), we receive limited information (email address, first name, last name, and a unique account identifier) to facilitate account creation and authentication.
School or Organization: If your school or tutoring center purchases a bulk license, they may provide us with your name, school email address, or enrollment details.

3. How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery:
- Provide, maintain, and improve our Services.
- Facilitate AI-based question marking and feedback.
- Provide personalised question recommendations, progress tracking, and performance analytics.
- Operate leaderboards, competitions, and gamification features. Leaderboards may display your first name and school name to other authenticated users. For school-provisioned accounts, a school-only leaderboard may be enabled so that your information is only visible to users within your school.
Account Management & Security:
- Authenticate your account and ensure only authorized access to your content.
- Process your subscription payments or in-app purchases.
- Monitor and protect against fraudulent or unauthorized activities.
Personalization & Analytics:
- Tailor the content, question sets, and recommendations based on your subjects, progress, or performance.
- Conduct data analysis to improve the quality and accuracy of AI feedback, analytics dashboards, and study suggestions.
Communication:
- Respond to inquiries or support requests you submit.
- Send administrative updates (e.g., password resets, transactional emails).
- Provide updates about new features, promotional offers, or changes to our policies (where permitted by law).
Compliance & Legal Obligations:
- Enforce our Terms of Service and other usage policies.
- Comply with applicable laws, regulations, or legal processes.
Service Quality & Safety:
- Review aggregate operational metrics (counts, timings, error rates) to troubleshoot and improve service reliability.
- Apply automated, classifier-based safety checks to inputs and outputs of AI features.

We do not use student data for product research programmes, do not share user data with third parties for research purposes, and do not use student submissions to train or fine-tune AI models.

4. Disclosure of Your Information

We do not sell or rent your personal information. We may share your information in the following ways:

Service Providers:
- We employ trusted third-party companies to perform tasks on our behalf (e.g., hosting, analytics, payment processing, AI marking, OCR). These partners have limited access to your information solely to perform these tasks and are obligated not to disclose or use it for other purposes. A complete list of sub-processors is published below at Section 9.1. Sub-Processors. Schools with a signed Data Processing Agreement are notified of any material changes.
Schools or Organizations:
- If your access to StudyPulse is provided by a school or institution, certain performance metrics (e.g., usage data, scores, completion stats) may be shared with that school’s administrators or teachers for educational oversight purposes.
- Data Isolation: Each school organisation’s data is logically separated. Teachers and administrators can only access data for students within their own organisation. Cross-organisation data access is prevented by application-level access controls.
Legal Requirements:
- We may disclose your information if required by law, subpoena, or if we believe in good faith that such disclosure is necessary to protect our rights, investigate fraud, ensure user safety, or respond to a government request.
Business Transfers:
- In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that deal, subject to confidentiality obligations.
With Your Consent:
- We may share information with third parties outside the above scope if we obtain your explicit consent or at your direction.

5. Children’s Privacy

StudyPulse’s Services are primarily intended for students aged 16 years and above, specifically those in VCE years (Year 11 and 12). We recognize that some students may be under 18 years old. For users under 18, we require that you review this Privacy Policy with your parent or guardian to ensure you both understand and consent to it.

Parental/Guardian Consent: If you are a parent or guardian and believe your child has provided personal information without your consent, please contact us immediately at [email protected].
Applicable Laws: We comply with relevant Australian privacy laws, including additional considerations around minors’ data.

6. Data Retention

We retain your personal information for as long as needed to provide the Services, subject to the following maximum retention periods:

Data Category	Retention Period
Account profile (name, email, school, year level)	Duration of account + 30 days after deletion
Answer submissions and AI feedback	Duration of account + 30 days after deletion
Essay submissions and uploaded images	Duration of account + 30 days after deletion
Chatbot/tutoring conversation logs	Duration of account + 30 days after deletion
De-identified usage analytics	26 months from collection
Payment and billing records	7 years from transaction (Australian tax law)
Security and audit logs	2 years from creation

If you request account deletion, we will delete or anonymize your personal information in accordance with Section 12 (Account Deletion) and the retention periods above. Payment records are retained as required by Australian tax law.

7. Cookies & Other Tracking Technologies

StudyPulse uses cookies and similar tracking technologies to personalize your experience, analyze usage trends, and maintain site security.

7.1 Cookies

Session Cookies: Temporary cookies that help you navigate the site and keep you logged in.
Persistent Cookies: Remain on your device for a set period or until you delete them, used for remembering user preferences or login details.
Authentication Cookies: Secure, httpOnly cookies used to maintain your login session. These cookies are not accessible to JavaScript and are only transmitted over HTTPS in production.

7.2 Analytics and Tracking Services

We use the following third-party analytics and tracking services:

Google Analytics (Google LLC): We use Google Analytics to understand how users interact with our Services, helping us improve the user experience. Google Analytics collects anonymised usage data including page views, session duration, and device information. For more information, see Google’s Privacy Policy.
Microsoft Clarity (Microsoft Corporation): We use Microsoft Clarity for heatmap analytics to understand how users interact with our website. Clarity may record mouse movements, clicks, and scrolls during your session. We use strict masking for all content — no user-identifiable information or text on screen is shared with or stored by Clarity. This data is processed by Microsoft and may be stored outside Australia. By using our site, you agree that we and Microsoft can collect and use this data. For more information, see Microsoft’s Privacy Statement.
Meta Pixel (Meta Platforms, Inc.): We use the Meta (Facebook) Pixel to measure the effectiveness of our advertising and to understand how users arrive at our website. The Meta Pixel collects data including page views, referral information, and conversion events (e.g., account registration, subscription purchase). This data is sent to Meta and may be used by Meta in accordance with Meta’s Data Policy. The Meta Pixel operates on both public and authenticated pages.

7.3 Analytics Controls for Schools

For accounts provisioned through a school or institutional agreement, the school may request that non-essential analytics and tracking services (Google Analytics, Microsoft Clarity, and Meta Pixel) be disabled for their students’ and teachers’ authenticated sessions. When enabled, no third-party tracking scripts are loaded for school users. Essential cookies (authentication, security) cannot be disabled as they are required for the Service to function.

7.4 Managing Cookies

You can choose to disable cookies through your browser settings, but this may limit your ability to use certain features of our Services.

8. Data Security

We implement a range of security measures to protect your personal information:

Encryption at Rest: All database clusters are encrypted at rest using AES-256 encryption (managed by the hosting provider).
Encryption in Transit: We secure all connections via TLS/SSL and enforce HTTPS for all application communications.
Network Security: We restrict database access exclusively to the private local network.
Access Controls: We limit access to personal information to employees and contractors who need it for the provision of Services.
Infrastructure Protection: We use automated, always-on DDoS mitigation to prevent downtime and protect against attacks.

No transmission method or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable laws.

9. Data Residency

We store 100% of your data in Australia. Our databases and all primary infrastructure are located exclusively in Sydney, Australia.

When you use AI-powered features, your answer text and question context (containing no personal identifiers) may be temporarily processed by AI providers whose servers are located in the United States. This data is processed in transit for the sole purpose of generating marking feedback. Our primary AI provider is Anthropic Claude accessed through Amazon Web Services Bedrock, which operates on a zero data retention basis: prompts and completions are not stored by AWS, are not used to train any foundation model, and are not shared with Anthropic. We are actively pursuing a zero-data-retention agreement with OpenAI; until it is signed, OpenAI default retention policies (up to 30 days for abuse monitoring) may apply to fallback traffic.

Other third-party services that may process limited data outside Australia include: Stripe (payment processing, US — not used for school-provisioned accounts) and Mailgun (transactional email, US). Image storage (Cloudinary) is hosted in Australia, though CDN delivery may involve other regions. Client-side analytics services (Google Analytics, Microsoft Clarity, Meta Pixel) also process data in the United States — see Section 7 for details. For school accounts, these analytics services can be disabled on request.

We take reasonable steps to ensure that all overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles (APP 8), and we remain accountable for their handling of your data.

9.1 Sub-Processors

The following sub-processors may process personal information on our behalf in connection with the Service. We have data processing agreements or equivalent contractual safeguards in place with each sub-processor.

Sub-processor	Contact	Data Types & Purpose	Lawful Basis	Location
DigitalOcean, LLC	digitalocean.com / [email protected]	Application and user data — cloud infrastructure hosting	Performance of contract; legitimate interests (service delivery)	Australia
Cloudinary Ltd	cloudinary.com / [email protected]	User-uploaded images — image hosting and delivery	Performance of contract	Australia
Amazon Web Services, Inc. (Bedrock, Anthropic Claude models)	aws.amazon.com / aws.amazon.com/contact-us	Question text, student answer text, rubric, and (where applicable) handwritten answer images (no personal identifiers attached): primary AI marking, handwriting recognition, and tutoring chatbot. Operates on a zero data retention basis: prompts and completions are not stored by AWS, are not used to train any foundation model, and are not shared with Anthropic.	Performance of contract	United States
OpenAI, L.L.C.	openai.com / [email protected]	Question text, student answer text, and rubric (no personal identifiers attached): fallback AI marking and tutoring chatbot when the primary provider is unavailable. ZDR is being pursued; until signed, OpenAI’s default API retention (up to 30 days for abuse monitoring) may apply to fallback traffic.	Performance of contract	United States
Amazon Web Services, Inc. (S3)	aws.amazon.com / aws.amazon.com/contact-us	User-uploaded files (e.g. PDFs, photos of handwritten answers) — object storage. Hosted in Sydney (`ap-southeast-2`).	Performance of contract	Australia
Stripe, Inc.	stripe.com / [email protected]	Email and billing information — payment processing for individual subscriptions (not used for school-provisioned accounts)	Performance of contract; legal obligation	United States
Mailgun Technologies, Inc.	mailgun.com / [email protected]	Email addresses and message content — transactional email delivery	Performance of contract; legitimate interests	United States
Google LLC (Analytics)	analytics.google.com / support.google.com/analytics	Anonymised page views, session duration, device information — usage analytics (disabled on request for school-provisioned accounts)	Consent; legitimate interests	United States
Microsoft Corporation (Clarity)	clarity.microsoft.com / clarity.microsoft.com/help	Heatmap data, mouse movements and clicks with strict content masking applied — user experience analytics (disabled on request for school-provisioned accounts)	Consent; legitimate interests	United States
Meta Platforms, Inc. (Pixel)	facebook.com/business / facebook.com/business/help	Page views, conversion events, referral information — advertising attribution and measurement (disabled on request for school-provisioned accounts)	Consent	United States

Updates to sub-processors: We will update this list when we add or change sub-processors. Schools with active agreements will be contacted proactively in advance of any material change to sub-processors that handle their data, with at least the minimum notice period set out in their Data Processing Agreement, so they have time to review and raise any concerns before the change takes effect.

Sub-processor controls for schools: As described in Section 7.3, school-provisioned accounts can request that non-essential analytics sub-processors (Google Analytics, Microsoft Clarity, Meta Pixel) be fully disabled for their users.

10. Third-Party Links and Content

StudyPulse may contain links to third-party websites or external content (e.g., external tutorials, VCE resources, third-party exam providers). We do not control these websites or their privacy practices. We encourage you to review the privacy policies of any site you visit.

11. Your Rights and Choices

You have the following rights regarding your personal information:

Access: You may request access to all personal information we hold about you.
Correction: You may request correction of any inaccurate or incomplete personal information.
Deletion: You may request deletion of your personal information. See Section 12. Account Deletion for more details.
Opt-Out of Marketing: You can opt out of receiving promotional emails by clicking “unsubscribe” in any email or by updating your account settings.

To exercise any of these rights, contact us at [email protected]. All requests are free of charge. We will acknowledge your request and provide a response within 30 days. For complex requests, we may require up to 3 months to fully resolve, and we will keep you informed of our progress. If we refuse a request, we will provide written reasons in accordance with applicable law.

12. Account Deletion

If you wish to delete your StudyPulse account:

Initiate Request: Contact us at [email protected] or use the account settings page (if available) to request deletion.
Cool-Off Period: We implement a 14-day cool-off period during which your data is not visible to others, allowing you to reverse your decision if you change your mind.
Permanent Deletion: After the cool-off period, all associated personal data will be deleted or irreversibly anonymized within 30 days, in accordance with the retention periods in Section 6. The only data retained after deletion is:
- Payment and billing records (7 years, as required by Australian tax law).
- Security and audit logs (2 years, for compliance purposes).

Important: Once your account is permanently deleted, you will lose all progress, submissions, content, and data associated with it. If your account is provided by a school, please consult with them before requesting account deletion. For school-provisioned accounts, data deletion is governed by the applicable Data Processing Agreement between StudyPulse and the school.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make material changes, we will post the updated version with a new “Last Updated” date at the top. Where required by law, we will provide you with notice and/or request your consent. We encourage you to review this Privacy Policy periodically to stay informed of our data practices.

14. Contact Us

If you have questions or concerns about this Privacy Policy, or wish to exercise any of your rights, please contact us at:

StudyPulse Pty Ltd (ACN 692945912)
Email: [email protected]
Melbourne, Australia

Thank you for trusting StudyPulse with your learning journey. We remain committed to protecting your personal information and providing a secure, efficient, and engaging study platform.

15. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us at [email protected]. We will acknowledge your complaint, investigate the issue, and provide you with a written response within a reasonable timeframe (usually 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

This section applies to you if you access StudyPulse from the European Economic Area (EEA), the United Kingdom, or Switzerland. Where it conflicts with anything above, this section wins for in-scope users.

16.1 Who we are

For these purposes:

Controller: StudyPulse Pty Ltd, Melbourne, Australia. ACN 692945912. [email protected]

16.2 Lawful basis per processing activity

For each purpose we list the legal ground we rely on under Art 6 (and Art 9 where special-category data is involved). The full processing inventory is in our internal Records of Processing (Art 30); the headline mapping is:

Purpose	Lawful basis	Notes
Create + run your account, authenticate you	Art 6(1)(b) contract	The product cannot exist without this
Mark practice answers + give feedback (incl. AI)	Art 6(1)(b) contract	The marking + feedback loop IS the product you signed up for
Mark essays, including via AI sub-processors	Art 6(1)(b) contract; if you submit special-category content within an essay, Art 9(2)(a) explicit consent	You can opt out of essay marking on a per-submission basis
Process payments + manage subscriptions	Art 6(1)(b) contract; Art 6(1)(c) legal obligation for tax records	Payments are handled by Stripe
Security logging + breach detection	Art 6(1)(f) legitimate interest	Balancing test: minimal data (IP, UA, success/fail) for a defined retention window (90 days); strong subject benefit
Transactional email (verification, password reset)	Art 6(1)(b) contract
Marketing email	Art 6(1)(a) consent	Opt-in only; unsubscribe link on every send
Analytics + session replay + ad attribution	Art 6(1)(a) consent	EU/UK/EEA visitors are not tracked without consent. These stay off by default for all EEA/UK/Swiss visitors and run only after you accept via the cookie banner; you can withdraw consent at any time.
Comply with safeguarding, law enforcement, court orders	Art 6(1)(c) legal obligation

16.3 Data Subject Rights — how to exercise them

You have the following rights under GDPR + UK GDPR. We respond to all DSR requests within one month (extendable to three for complex cases, with notice).

Article	Right	How to exercise
Art 15	Access, get a copy of all data we hold about you	Email `[email protected]` and we’ll send you a copy of your data within 30 days.
Art 16	Rectification, correct inaccurate or incomplete data	Profile page (`/profile`) or email
Art 17	Erasure (“right to be forgotten”)	Email `[email protected]` and we’ll erase your data within 30 days.
Art 18	Restriction of processing	Email `[email protected]` with the specific processing you want suspended
Art 20	Data portability, machine-readable export	Email `[email protected]` and we’ll provide a machine-readable export (same as Art 15) within 30 days; the format is documented and stable.
Art 21	Objection, to processing based on legitimate interest, or marketing	Email; we’ll stop unless we can show compelling legitimate grounds
Art 22	Decisions based solely on automated processing	AI marking + feedback is delivered directly to the student (no required teacher review step) but is advisory educational guidance only: it does not produce legal effects, does not gate progression, pay, eligibility, or any decision that “significantly affects” the user in the Art 22 sense. Where a school uses AI marking inside an assessed unit, the teacher is the decision-maker of record; raise concerns with them in the first instance.

There is no fee. We may ask for proof of identity before fulfilling a request if we have reasonable doubt — we’ll only ask for what’s necessary to verify.

16.4 Supervisory authorities

If you’re unhappy with how we’ve handled your data, you can complain to the supervisory authority in your country of residence, place of work, or place of the alleged infringement:

United Kingdom: Information Commissioner’s Office — 0303 123 1113
EU member states: find your national authority via the EDPB members list

You’re encouraged to raise concerns with us first ([email protected]); we’d rather fix the issue.

16.5 International transfers

We’re an Australian-incorporated company hosting in DigitalOcean’s Sydney region. When you use the service from the EEA / UK / Switzerland, your data is transferred from Europe to Australia and to our sub-processors. We apply appropriate safeguards for these transfers and will provide details on request.

The full sub-processor list with country and transfer mechanism is available on request.

StudyPulse is intended for students aged 16 and above and is not directed at children below the digital age of consent in their country. We do not knowingly collect personal data from such children. If you believe a child below the applicable age has provided us with personal data, contact [email protected] and we will delete it.

16.7 Retention

We keep the minimum needed for the purpose, then delete. For in-scope EU/UK/EEA users, the retention windows below mirror the global timelines in §6 and §12 (our default Australian-jurisdiction practice), tightening them where GDPR requires. The two differences worth calling out:

Account deletion: the 14-day cool-off + 30-day permanent-delete in §12 is the Australian default; under GDPR Art 17 the in-scope flow is a single 30-day grace period after the erasure request (no separate cool-off), shortened to honour the one-month DSR SLA.
Security / audit logs: the 2-year retention in §12 is the Australian-jurisdiction default; for EU/UK/EEA users we retain the LoginLog for 90 days. Aggregated, anonymised security telemetry that does not identify the user is not subject to this row.

Data	Retention (EU / UK / EEA in-scope)
Active-account profile + answers + essay submissions	Duration of account + 30 days after deletion (same as §6)
Login + security logs (identifiable)	90 days
Soft-deleted account	30-day grace period, then hard delete (Art 17)
Stripe payment records	7 years (legal obligation, tax)
Aggregated, anonymised analytics	Indefinite (no longer personal data)

16.8 Changes to this section

When we materially change how we process EU/UK personal data, we’ll notify in-app + by email at least 30 days before the change takes effect, and (where required) ask you to re-consent. Minor clarifications go live with an updated “Last Updated” date at the top.

17. Complaints (EU + UK)

For users covered by Section 16, the complaint path is:

Email [email protected] first — we acknowledge within 5 business days and aim to resolve within 30 days
If you’re not satisfied with our response, escalate to your country’s supervisory authority (see §16.4)
You also have the right to a judicial remedy under Art 79

This is in addition to the Australian Privacy Principles complaint path in Section 15.