Privacy Policy

1. Two very different privacy contexts

Mentor collects meaningfully different information depending on how it is used, and it is important to distinguish the two:

• Anonymous Practice (no sign-in required, at /practice): we do not ask for or store your name, email address, or any other information that identifies you personally. See section 3.
• School accounts (School Administrator, Teacher, and Student roles, all via Google Sign-In): we hold a limited set of information tied to a school-managed identity, described in section 3.

2. Who is responsible for this information

For school accounts, we act on the instructions of the school that registers with us: the school decides who gets a teacher or student account, what identifying information (a student number, an alias, a school email address) it provides to us for that purpose, and when an account should be removed. In privacy terms, the school is generally the primary collector of a student’s personal information (through its own enrolment and consent processes) and Vividex processes that information to provide the Service on the school’s behalf. If you are a student or parent with a question about what information a school has provided about you, your school is usually best placed to answer that, and you can also contact us directly using the details in section 13.

3. What we collect

Anonymous Practice

Using Practice without signing in does not require or collect your name, email, date of birth, or any other directly identifying information. We do record, for each practice session, the topic selected, the questions attempted, whether each answer was correct, and any automated feedback shown to you — but this record is not linked to your identity in any way. Your IP address is briefly processed (not stored in our database) to apply a rate limit that prevents abuse of the AI Mentor feature — see section 6.

School accounts

We hold the following information for each role, no more:

• School Administrator / Teacher: a display name your school provided when inviting you, your school-linked Google account identity, and (until you first sign in) the email address your school invited. We do not separately store your email address once your account is linked — it is drawn from your Google account at sign-in time.
• Student: a school-assigned student number, a display alias chosen by your school or teacher (typically a first name, not a full legal name), your school email address, and — once you first sign in — a link to your school-linked Google account identity. We do not ask for or store a student’s date of birth, home address, phone number, or full legal name unless your school has chosen to use your full name as your alias.

For every school account, we also hold: which classes and school a person belongs to; practice session records (topic, timing, number of questions answered and correct); for each question attempt, the question text, your answer, whether it was correct, and any automated feedback shown to you; and a record of which questions you asked the AI Mentor for help on (not the content of that conversation — see section 5).

We never ask any user, in any mode, for a password. Every sign-in uses Google Sign-In, and we never see or store your Google password.

4. How we collect it

School account information comes from two sources: your school (when a school administrator or teacher invites a teacher or student by school email address, alias, and student number) and Google (the identity confirmation that happens when you sign in with your school Google account). We do not collect personal information about students from any other source, and students cannot self-register a student account — a school must provision it first.

5. The AI Mentor and your information

When you use “Help Me Understand”, your messages and the current question are sent to our AI provider to generate a response. We do not store the content of an ordinary AI Mentor conversation in our database — it exists only for the length of that request. The one exception is described in section 6: a message that our automated safety check flags as a possible safeguarding concern is logged and an alert is sent, because that content needs to be reviewable by a human. Full detail on how the AI Mentor works is in our AI Use & Limitations statement.

We configure our AI provider integration to opt out of using conversation content to train their models, but a provider’s infrastructure inherently processes your message to generate a response — see section 8 for where that provider is located.

6. Safeguarding: what happens to a flagged message

The AI Mentor includes an automated check for language that may indicate a student is disclosing self-harm, suicidal thoughts, abuse, or bullying. This check is a pattern-based filter, not a human reviewer and not a clinical or crisis service — see the Child Safety / Online Safety policy for its limitations. If a message is flagged:

• the student is shown a fixed, safe response directing them to talk to a trusted adult;
• the flagged message text, the question it was sent from, and (where we can identify one) the student’s teacher, receive an automated email alert, sent using a third-party email service (see section 8);
• the flagged message and who it was alerted to are recorded, so the alert can be checked and followed up if needed.

We keep this record for accountability and follow-up rather than deleting it on a fixed schedule, and access to it is restricted to those who need it to run the Service.

7. Why we use this information

We use the information described above to:

• provide the Service, including marking answers and generating AI Mentor responses;
• let a teacher see their own students’ progress and topic coverage;
• let a school administrator manage teacher and student accounts at their school;
• operate the safeguarding alert described in section 6;
• maintain the security and integrity of the Service, including rate-limiting abuse;
• meet legal obligations and respond to lawful requests; and
• develop and improve Mentor’s content and features.

We do not sell personal information, and we do not use student information for advertising or marketing purposes.

8. Who we share information with

We use a small number of service providers to run Mentor. Each only receives the information it needs to perform its function, and none are permitted to use it for their own marketing purposes:

• Supabase — our database and authentication provider. Our Supabase project is configured to run in the Sydney, Australia region.
• Google — provides Google Sign-In. If your school uses Google Workspace for Education, your school’s own agreement with Google also applies to your Google account.
• Vercel — hosts the Mentor application. Our application functions are configured to run in the Sydney, Australia region; Vercel is a global hosting provider headquartered in the United States, and some parts of its platform (such as network routing) may be handled outside Australia.
• Anthropic, via the Vercel AI Gateway — provides the AI model behind the AI Mentor. This provider is based in the United States, so a message you send to the AI Mentor is processed on infrastructure outside Australia.
• Resend — sends the automated safeguarding alert email described in section 6. This provider is based in the United States.

We may also disclose information where required by law, to protect the safety of a student or another person, to enforce our Terms of Service or Acceptable Use Policy, or in connection with a genuine business transaction such as a merger or asset sale, in which case we would take reasonable steps to require the recipient to protect the information consistently with this policy.

8A. Disclosure overseas

As set out in section 8, some of our service providers are based in, or may process information in, the United States. Before disclosing personal information overseas we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles in relation to that information, including by relying on the provider’s own privacy and security commitments and configuring services (such as our database and application hosting) to run in Australia wherever we can. We cannot guarantee that an overseas recipient will be directly accountable under Australian privacy law in the same way we are.

9. Data security

We use several technical measures to protect the information we hold, including: no Mentor-specific passwords (sign-in is Google-only); database-level row security rules that restrict a teacher to their own students and a school administrator to their own school; encrypted transmission (HTTPS) between your browser and our servers; and restricting administrative database access to what our application needs to run. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach that is likely to result in serious harm, we will comply with our obligations under the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner where required.

10. How long we keep information

We aim to keep only what we need, for as long as we need it:

• Practice session and question-attempt records are automatically deleted 90 days after the session started, whether or not the session was linked to a signed-in student account.
• A student, teacher, or admin account that has never been signed into (provisioned by a school but not yet claimed) is automatically deleted 90 days after it was created.
• Once a student, teacher, or admin account has been signed into at least once, we do not automatically delete it based on inactivity — removing it is a manual step your school administrator can request, or you can request directly (see section 13).
• Records of a flagged safeguarding message (section 6) are not deleted on a fixed schedule, because they may need to be reviewed or followed up on later.

11. Access and correction

You can ask us to access or correct personal information we hold about you by contacting us using the details in section 13, or, for a student, by asking your school (which can also contact us on your behalf). We will respond within a reasonable time and may need to verify your identity, or your authority to act for someone else, before making a change.

12. Children’s privacy

Mentor is built for use by secondary school students, and much of the information in this policy is specifically about how we handle that. A student account can only be created by a school administrator or teacher — a child cannot sign themselves up for a student account. Where a child under the age at which they can generally make privacy decisions for themselves uses the anonymous Practice feature, we ask that a parent, guardian, or teacher be involved, as described in our Terms of Service. We design student data collection to be as minimal as reasonably possible for the Service to work — see section 3.

13. Complaints and contact

If you have a question or complaint about how we handle personal information, contact us at support@learnwithmentor.com.au. We will investigate and respond within a reasonable time. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Changes to this policy

We may update this policy from time to time, for example to reflect a change in the Service or the law. We will update the “Last updated” date above when we do, and for a material change we will take reasonable steps to notify schools with an active account.