Privacy Policy
Last Updated: June 2026
1. About SmartKidz & Our Commitment to Children's Privacy
SmartKidz (“we,” “us,” or “our”) operates an AI-powered educational platform designed for children in Years 1 to 10. We are an Australian service and our primary privacy framework is the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where SmartKidz is used by a Queensland state school or department, we also support that agency's obligations under the Queensland Information Privacy Act 2009 (including data location, access, correction, retention and breach notification). For any families outside Australia, the Children's Online Privacy Protection Act (COPPA) and the EU General Data Protection Regulation (GDPR) apply as a secondary lens.
- › We do not serve advertisements to children.
- › We do not sell children's data.
- › We do not use identifiable children's data to train general AI models.
2. Who This Policy Applies To
This policy applies to all users of SmartKidz, with special provisions for users under the age of 13 (“children”). Children under 13 may only use SmartKidz under a parent or guardian account with verifiable parental consent.
3. Information We Collect
From Parents / Guardians (Account Holders)
- › Email address: Used for account authentication and communications.
- › Password: Stored encrypted; we never see your password in plain text.
- › Subscription / Billing Information: Processed securely by Stripe; we do not store card details.
From Children (With Parental Consent)
- › First name only: Used to personalise the learning experience.
- › Year level: Used to match educational content to the right level. We do not collect a date of birth.
- › Learning activity data: Quiz answers, game scores, XP points, and progress tracking.
- › Conversations with Riley: The messages your child exchanges with the AI learning buddy during lessons and chat, so Riley can help and so we can keep the experience safe.
- › Homework Helper photos (optional): If your child uses Homework Helper, the photo of a worksheet they choose to submit. It is sent to our AI provider to read the question and is not stored after the session.
- › Learning profile: An automatically generated summary (for example common misconceptions and what helps your child learn) used only to personalise teaching.
- › Session timestamps: Recorded when the child last used the platform.
Sensitive Information (Learning Support)
Parents may optionally tell us about a child's learning support needs (for example dyslexia, ADHD, dyscalculia, autism, or being an English-as-an-additional-language learner). This is sensitive information under the Privacy Act. It is entirely optional, is collected only with your consent at the point you enter it, and is used solely to adapt how Riley teaches (for example gentler pacing and accessible reading defaults). It is never used to label your child, for advertising, or to train AI models.
Voice Data Notice
SmartKidz offers optional voice features. Riley's spoken voice is text-to-speech generated by Deepgram: we send Riley's written words and receive synthesised audio back. No child's voice is captured for this. Separately, a child can choose to talk instead of type by tapping the microphone button. When they do, their speech is streamed to Deepgram's speech-to-text service and converted to text so it can be sent to Riley exactly as if it had been typed. This spoken audio is streamed to Deepgram's Australian endpoint and processed in Australia, is used only to produce that transcript, is not stored on SmartKidz servers, and is never used for advertising or to train AI models. The microphone is only ever active while the child is holding a voice session — it never listens in the background, and the child can always type instead.
Keeping Children Safe (Safety Monitoring)
To protect children, Riley's conversations are automatically screened for unsafe content. If something concerning is detected (for example a sign of harm or an inappropriate request), the relevant message may be recorded as a safety report and the parent or guardian is alerted. We use this strictly to keep children safe, never for advertising or profiling.
Automatically Collected Technical Data
- › IP address: Used for security and fraud prevention only.
- › Device Metadata: Browser and device type to ensure platform compatibility.
- › Cookies & analytics: We use essential session cookies for login and security. We do not run any advertising, behavioural, or analytics tracking inside the child or student experience.
Data Residency Disclosure
Your account and your child's learning data are stored in our database, which is hosted in Australia (Sydney), and primary processing takes place in Australia. The AI learning buddy model itself (Anthropic's Claude, served via AWS Bedrock in Sydney, ap-southeast-2) is also processed onshore in Australia. A small number of specialist providers process limited data to deliver specific features — these are listed with their purpose and region in our Service Providers register below. Deepgram processes limited data to deliver Riley's voice in two ways: text-to-speech (we send Riley's written words, processed in the United States) and, when a child taps the microphone, speech-to-text (their spoken audio is streamed to Deepgram's Australian endpoint and processed in Australia, used only to generate the transcript and not retained by SmartKidz). We bind every provider to protect your information consistently with the Australian Privacy Principles.
4. How We Use Information & Automated Decision-Making
We use information solely to deliver the educational service, maintain security, and process payments.
- › Delivering the educational service to your child
- › Personalising learning content and difficulty to your child's progress
- › Displaying progress reports and insights to parents
- › Maintaining account security and processing payments
Automated Decision-Making (ADM)
SmartKidz uses automated systems to analyse your child's learning activity (e.g., quiz scores) to tailor lesson difficulty and track progress toward ACARA v9.0 curriculum markers. Parents have the right to request a manual review of any significant automated educational decision by contacting us.
We never use personal information or learning data for direct marketing, profiling, or AI model training.
5. Service Providers (Subprocessor Register)
We share limited data with the providers below solely to operate the Service. Each is bound by agreement to use the data only for the stated purpose, and not for advertising or to train general AI models on identifiable children's data.
| Provider | Purpose | Data Shared | Region |
|---|---|---|---|
| Supabase | Database, authentication & file storage | Account email, child first name, learning & progress data | Australia (Sydney) |
| Anthropic (Claude) via AWS Bedrock | Learning buddy (Riley) text & worksheet-photo vision | Lesson/chat text and any worksheet photo the child submits | Amazon Web Services — Sydney, Australia (ap-southeast-2) |
| Deepgram | Riley's voice — text-to-speech, and speech-to-text for the optional “talk to Riley” microphone | Riley's written words (text-to-speech); a child's spoken audio only when they tap the mic (speech-to-text), used solely to transcribe — not stored | Text-to-speech: United States. Speech-to-text: Australia (au.deepgram.com) |
| Stripe | Payment processing for parents | Parent billing details — card data is handled entirely by Stripe; we never see or store card numbers | Australia / global |
| Zoho | Transactional & account email | Parent email address and message content | Australian endpoint |
| Cloudflare | Content delivery network (CDN) & security | Network request metadata to serve and protect the site | Global edge |
| Upstash | Rate limiting & abuse prevention | Transient request counters (no learning content) | Cloud |
| Sentry | Error monitoring (only active when configured) | Technical error reports (stack traces, request metadata) — session replay is off and we do not send children's chat or learning content | United States |
| Apple App Store / Google Play | Mobile subscription billing & entitlements (parents) | Purchase and subscription status — handled by Apple/Google; no child learning data | United States / global |
6. Data Retention
- › Active accounts: Data is retained for the duration of the subscription.
- › Inactive accounts: Where an account is inactive for 12 months, its data is deleted by our scheduled retention process.
- › Upon account deletion: When you delete your account, personal data in our Australian database is permanently deleted within 30 days, and we request deletion from the providers above where they hold any related data.
7. Parental Rights
As a parent or guardian, you have the right to review, delete, or correct your child's information, and to withdraw consent at any time. To exercise these rights, email [email protected].
8. Data Security
- › TLS 1.3 encryption for all data in transit
- › AES-256 encryption for data at rest
- › Regular security reviews
If a data breach is likely to result in serious harm, we follow the Office of the Australian Information Commissioner's Notifiable Data Breaches scheme: we assess the breach, notify affected parents and guardians as soon as practicable, and notify the OAIC (and, where SmartKidz is used by a school, the relevant department or agency) where required. Our internal incident-response plan governs how we contain, assess and report a breach.
9. International Users (GDPR)
For EEA/UK users, our lawful bases for processing are contract performance, legitimate interests (security), and consent (optional features).
10. Contact Us & Complaints
For privacy questions or to exercise your rights:
- ›Email: [email protected]
Australian Complaints
If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
11. Cookie Policy
SmartKidz uses “cookies” (small text files placed on your device) strictly for essential platform functionality.
Essential Cookies
We use session cookies to authenticate your account, keep you logged in securely, and save your child's progress during an active session.
No Tracking of Children
We do not use advertising cookies or cross-site tracking. We do not run any analytics or behavioural tracking inside the child or student experience, or on any signed-in page, and we do not profile children. On our public marketing pages only, we use limited first-party page-view measurement (page path, referrer, a random first-party analytics identifier stored in your browser, and approximate location derived from a one-way-hashed IP address — the raw IP is never stored). This honours your browser's Do Not Track setting.
By using SmartKidz, you consent to the use of these essential functional cookies. The marketing-page analytics identifier is first-party measurement (not an essential cookie) and is never used for advertising.