Privacy policy
Last updated 9 September 2026
This policy explains what information StudyPro (StudyPro, we, us) collects, why, where it is held, who it is shared with, and what you can ask us to do with it. It covers this website and the StudyPro platform provided to tutoring centres and coaching colleges in Australia and New Zealand. StudyPro is a trading name; the entity responsible for your information is the entity that operates StudyPro, identified in any signed agreement with your centre and contactable at the address at the end of this policy.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For New Zealand customers and visitors we also observe the Privacy Act 2020 (NZ). Where this policy and the law differ, the law applies.
The short version
- We collect as little as the service needs. A student can be enrolled with a first name, an initial and a class.
- Your centre controls its students' and parents' information. We process it on your instructions, in a space isolated from other centres, hosted in Australia.
- We never reuse, redistribute, sell or train any model on material a centre uploads, or on its students' work.
- We never contact a centre's parents or students for any purpose other than delivering the reports and access the centre has approved, under the centre's name.
- We do not sell personal information to anyone.
- You can ask for a copy of the personal information we hold about you, a correction or a deletion at any time.
Who this policy applies to
| You are | What we hold about you | Why |
|---|---|---|
| A visitor to this website | Analytics events if enabled, and whatever you type into a form | To run the site and answer you |
| A centre owner or staff member | Your name, work email, mobile if given, centre name, suburb, enrolment band, where your material lives, and the details of our agreement | To arrange walkthroughs, samples and pilots, and to provide the service |
| A person who requests a resource | Your name, email, and the centre and role you give | To email you the link and to tell you about StudyPro |
| A parent using the "ask your centre" form | Your name, email, the centre you named, and whether we may tell the centre it was you | To contact the centre and reply to you |
| A tutor with a login | Name and work email, and the classes you're assigned to | To provide your login |
| A student on a centre's platform | First name, initial, class, and practice results. No date of birth, no personal email, no photo | To deliver the centre's practice and reports |
| A parent of a student | One email address, supplied by the centre, used only to send the centre's reports | To deliver the centre's report |
What we collect and why
On this website. If you fill in a form (booking a walkthrough, sending worksheets, requesting a template, contacting us, asking us to contact your centre, or a roadmap request) we collect the details you enter, the page you were on, and the campaign parameters in the address (for example utm_source) so we know how you found us. We record the IP address and browser type of a submission to detect abuse. Files you upload for a sample conversion are stored privately, used only to produce the sample, and deleted on request and in any case within 12 months. We use a honeypot field and a rate limit to reject automated submissions. If analytics is enabled we record page views and a small number of interaction events (a button click, a form submission) without session recording, using a first-party cookie.
How we use website enquiries. To respond, to arrange what you asked for, and to send you information about StudyPro that we think is relevant to a tutoring centre owner. Every such message carries our identity and an unsubscribe link that works in one click, as the Spam Act 2003 (Cth) and the Unsolicited Electronic Messages Act 2007 (NZ) require. We do not add parents or students to any marketing list.
On the platform, about centre staff. Login details, the classes a tutor is assigned to, and the actions taken in the platform (approving material, assigning work, sending a report), so the centre has an audit trail of its own account.
On the platform, about students. The minimum a class needs: first name, initial, class membership, and the answers, marks, time on task and hints used on practice sets. We do not collect dates of birth, student email addresses, phone numbers, photos or free-text profiles, and the platform has no student-to-student messaging and no public profiles. Messages from a centre's own tutors to its students are a per-centre setting, off by default, that the centre controls.
On the platform, about parents. One email address per student, supplied by the centre, used solely to deliver the fortnightly report and any term summary the centre approves. Reports are sent from the centre's own email address under the centre's name. We do not add parents to any list of ours and we do not contact them about anything else.
Uploaded material. The worksheets, notes and papers a centre uploads, the converted practice generated from them, and a rights basis recorded per document (own material, licensed, statutory or CLNZ licence, or unknown).
What we do not do with your material
We claim no rights in material a centre uploads or in anything derived from it. We do not reuse it for any other customer, redistribute it, sell it, or use it, or students' work on it, to train any machine-learning model, including in anonymised or aggregated form. Our own agreements with the model providers we use exclude training on customer data.
Where information is held, and overseas disclosure
All platform data at rest, including uploaded material, student records and reports, is held in Australia, in an isolated space for each centre. New Zealand customers' data is also held in Australia. Backups are encrypted and held in the same region.
Some processing happens outside Australia, and we tell you so plainly because the Privacy Act requires reasonable steps before overseas disclosure: the model providers that convert uploaded material and generate explanations process content transiently in the United States under terms that prohibit retention beyond the request and prohibit training; transactional email is sent through a provider that may route messages through the United States; this website's edge network and any analytics provider operate globally. Each of these providers is bound by contract to use information only to provide their service to us and to protect it to a standard consistent with Australian law.
Sub-processors
| Provider type | Purpose | Region |
|---|---|---|
| Cloud hosting provider | Servers, databases, storage, backups | Australia |
| Content delivery and edge network | Serving this website and the platform, form handling, private file storage | Global edge; stored data in the Asia-Pacific region |
| Transactional email provider | Sending reports and notifications from the centre's address, and replies to enquiries | United States, message content only |
| Model provider(s) | Conversion of uploaded material and generation of explanations | United States, transient processing, no retention, no training |
| Customer relationship system | Records of our contact with centre staff and website enquiries | Australia |
| Analytics provider (if enabled) | Page views and interaction events on this website | United States |
The current list with provider names is available on request and is updated before any change.
How long we keep it
| Information | Kept until |
|---|---|
| Website enquiries and uploads for sample conversion | 12 months, or deletion on request |
| Centre account and agreement records | 7 years after the agreement ends, as required for tax and legal purposes |
| Platform data for an active centre | For the life of the agreement |
| Platform data after a centre leaves | Deleted within 30 days of the agreement ending and confirmed in writing |
| Backups | Rotated within 35 days of the data they contain being deleted |
Security
Information is encrypted in transit and at rest. Access to production systems is limited to named staff with multi-factor authentication and is logged. Each centre's space is isolated from every other centre's, and no centre's material is shared with or reused for another. We test backups and we maintain a written breach response plan. If a data breach is likely to result in serious harm we will notify the affected centre without delay so it can meet its own obligations, and we will notify the Office of the Australian Information Commissioner, or the Office of the Privacy Commissioner in New Zealand, as the law requires.
Your rights
You can ask us to tell you what personal information we hold about you, to correct it, to give you a copy in a usable format, or to delete it. That is a right under the Acts named above and it applies to personal information, not to a bulk download of the platform: the platform is a hosted service, and a centre keeps its own originals of everything it uploaded copies of. Parents and students should direct requests to their centre in the first instance, because the centre controls that data; if you contact us directly we will help you reach the right person and act on the centre's instructions. Write to the support address at the foot of this page with "Privacy" in the subject line. We respond within 30 days, and we do not charge for a request unless it is manifestly unfounded or excessive, in which case we will tell you the cost first.
If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).
Cookies and analytics
This website sets a small number of cookies for essential function (for example, remembering that you dismissed a notice). If analytics is enabled we use a first-party cookie to distinguish visits. We do not use advertising cookies, we do not run session recording, and we do not share visitor data with advertising networks. You can block cookies in your browser without losing access to the site.
Children
The platform is provided to centres, not to children directly. Centres are responsible for obtaining any consent required from parents or guardians to enrol a student. We collect the minimum information necessary about students, we do not communicate with students outside the platform, and the platform contains no student-to-student messaging, no profiles and no social features; messages from a centre's own tutors to its students are a per-centre setting, off by default, that the centre controls. This website is written for adults running or choosing a tutoring centre; we do not knowingly collect personal information from a child through it, and if we learn that we have, we delete it.
Changes
We will post any change to this policy here with a new date, and we will notify centres by email before any change that affects how their students' or parents' information is handled.
Contact
Privacy enquiries: the support address in the footer of this site, with "Privacy" in the subject line. Postal enquiries: StudyPro, Melbourne, Victoria, Australia.