Privacy & Security

1. Overview

Rise Bright is the trading name of the holder of ABN 14 593 418 783, of Victoria, Australia ("we", "our", "us"). We are committed to protecting the privacy of children and families who use our educational platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Rise Bright.

Rise Bright is an Australian educational technology platform designed for children in Foundation to Year 6, with a focus on supporting neurodiverse learners.

Rise Bright is an educational service. It does not diagnose, assess or treat any condition.

2. Data we collect

2.1 Information you provide

2.2 Information we collect automatically

• Learning progress: Assessment results, lesson completion, time spent
• Technical data: Browser type, device type, IP address
• Usage data: Pages visited, features used, session duration
• Roo chats and safety reports: If you turn on Roo, your child's messages, Roo's replies, Roo's session summaries and weekly suggestions, and any safety reports (see section 5)
• Consent records: The consents you give or withdraw, and when. For our collection notice (see section 7.1), also the version you agreed to and the IP address and browser you used, your answers when we ask you about a child's profile on your parent dashboard (with the sign-in session, IP address and browser they were given from), when we first asked you about each child, and, if a school or our team set up the profile, who confirmed that your family had been given the notice and had agreed, and when
• Payment records: From Stripe, the payer's name or email address and the details of each payment, refund and subscription

2.3 Information from third-party sign-in

If you choose to sign in using Google, we receive the following information from your Google account:

2.4 Information we do NOT collect

• Home address
• Your child's school, unless the school sets up your child's profile (see section 7.1)
• Photos or images of children
• Social media profiles
• Card numbers (payments are processed by Stripe; we never receive or store card numbers)

3. How we use your data

3.1 Automated decisions

We use software, including AI, to make some decisions about your child's learning without a person reviewing each one: which questions and lessons your child sees and how hard they are, how their learning path is written, when a break is offered, and when we pause the use of your child's learning needs under section 7.3. These decisions use your child's year level, state, learning needs and interests, assessment results and practice history. They shape what your child is taught but do not decide access to the service. You can ask us what was used for a decision or ask for a person to review it by emailing support@risebright.com.au.

4. Data sharing

4.1 Third-party services

4.2 When we may disclose information

• With your consent: If you explicitly authorise us to share specific information, for example with a teacher you approve or a tutor you invite or contact, or a tutor your child's school invites once you approve them
• Schools: If a school set up your child's profile, with that school, and with a tutor the school invites for your child: your child's name and year level when the tutor is invited, and anything more only after you approve the tutor, until you remove the school's access (see section 7.1)
• Referrals: If you share your referral link, anyone who opens it sees your first name on our sign-up page. If you sign up through another family's link, the sign-up page and our welcome email show you the first name of the parent who referred you, and when you start your free trial we may email that parent your first name to tell them about their reward
• Legal requirements: If required by Australian law, court order, or government request
• Safety: To protect the safety of children or prevent harm (mandatory reporting)

Our own staff open a child's learning records for support only with the parent's separate, time-limited consent. The parent grants or declines it from an emailed link and can revoke it from their dashboard; each grant lasts 7 days and every view is logged.

4.3 Cross-border data transfer

Before we send personal information to a provider outside Australia, we take reasonable steps to make sure it handles that information consistently with the Australian Privacy Principles, mainly through the provider's written terms. We stay responsible for the information we send. Anthropic handles our requests under the Data Processing Addendum that forms part of its commercial terms.

Rise Bright primarily processes data in Australia. Some of our service providers handle data outside Australia:

• Google Sign-In (Google LLC, USA): Authentication data (email, name, profile picture) is exchanged securely via OAuth 2.0 over TLS. Through Google Sign-In we share nothing with Google beyond what sign-in needs.
• Claude AI (Anthropic, USA): For learning content, learning paths and progress insights we send your child's year level, state, learning needs, interests and assessment results, so the AI can adapt. We leave your child's name out or replace it with a placeholder. We do not send your child's learning needs while their use is paused, and Roo is paused then too (see section 7.3). If you turn on Roo, your child's chat with Roo is also sent, as your child typed it, for Roo's answers, our safety check and the session summaries Roo writes for you. For Roo's weekly suggestions to you, we send signals from the week's sessions, such as breaks taken and signs of frustration, with your child's learning needs. Roo's answers also use your child's learning needs, interests and recent answers. For Roo's answers we replace your child's first name with a placeholder. The safety check and the session summaries can include it. We cannot reliably detect other personal details a child may type, such as a friend's name, their school, or where they live. Data is transmitted via encrypted connection (TLS). Under Anthropic's commercial terms, Anthropic does not train its models on our API data.
• ZeptoMail (Zoho Corporation, India/USA): Email address and message content for the emails we send, including our newsletter if you subscribe. All data transmitted via encrypted connection (TLS). Zoho's privacy policy governs their data handling. Email open and click activity is tracked via ZeptoMail to monitor email delivery quality.
• Resend (USA): The email address and content of an email, only if ZeptoMail cannot send it.
• Stripe (Stripe Inc., USA): Your card details, which we never receive, and the payer's name, email address and payment details.
• Google Analytics, Google Fonts and Google Drive (Google LLC, USA and other countries where Google stores data): Website usage data and your IP address, only if you accept analytics cookies. Your IP address and browser details when our pages load fonts. Encrypted copies of our database backups. Also an encrypted list of the internal numbers of accounts and profiles we have erased or are about to erase, and of people whose records are under a legal hold, with dates and reason codes but no names or email addresses.

5. Data retention

We aim to keep personal information only while we need it for a purpose explained in this policy, or for as long as an Australian law requires. The table below sets out how long we keep each kind of information today. Where it says there is no end date yet, we keep that information until we set one, and we are setting one.

We are not a school. If your child's school or your home-education plan needs a record of your child's learning, download a copy from your My Data page before you remove a profile or delete your account. If you gave a teacher, tutor or school access, the reports and emails they received are kept by them under their own rules.

We do not ask for your child's date of birth. Where a period above depends on your child's age, we work it out from their year level and round up, so it is never shorter than stated.

If information is needed for a police, child protection or court matter, we keep it until that matter is finished, even if the period above has ended.

Cancelling your subscription does not delete your account or your child's records. To delete them, use your My Data page.

Our service providers keep their own copies under their own terms: Stripe for payments, our email providers for the emails we send you and the emails you send us, and Anthropic for Roo messages and other AI requests. Google stores our encrypted off-site backups. See section 4.

6. Your rights

Access and correction are your rights under the Australian Privacy Act 1988 (APPs 12 and 13), and you can complain to the OAIC. We also let you export your data, ask us to delete it, and withdraw consent:

We aim to reply to a privacy request within 5 business days and to complete it within 30 days. We may ask you to confirm who you are before we give or change information. If we refuse a request, we will tell you why in writing and how to complain.

7. Children's privacy

7.1 Who sets up a child's profile

• A child's profile is set up by a parent or guardian, or by a school that uses a school account. Before this version of our privacy policy, our team could also set up a profile when a school or a family asked us to. We no longer do
• Before you add a child, we show you our collection notice, which says what we collect about your child, why, who sees it and where it goes, and ask you to agree to it. The profile is created only once you tick the box to agree
• If your child's school sets up the profile, the school gives us your child's name and year level and your email address, and we email you an invitation. The profile is linked to your account only when you accept. Before it sets up the profile, the school must confirm to us that it has given you our collection notice and holds your consent, and we record who confirmed, when, and which version of the notice. Once the profile is linked to your account, we tell you on your parent dashboard that the school set it up and what it gave us, and you can also agree to the notice yourself. The school's confirmation stays our record of your consent either way. After you accept, the school can still see your child's name and year level, your name and email address, and your child's learning path and progress. It can also change your child's learning path, and invite or remove a tutor for your child, including a tutor you invited, without asking you. A tutor the school invites sees your child's name and year level. When the tutor accepts, we ask you, by email and on your parent dashboard, to approve or decline them, and they see anything more, such as your child's learning needs, current learning plan and progress insights, only after you approve (see section 7.3). If you decline, the school cannot invite that tutor for your child again. Until the profile is linked to your account, nobody can approve, so the tutor sees only your child's name and year level. You can end the school's access to the profile at any time with Remove school access on your parent dashboard, after you confirm your password. The school and its teachers then no longer see the profile, the tutor invitations and tutor access the school set up for your child end, and your child's learning records stay with you. Tutors you invited, and teachers from elsewhere whom you approved, keep their access. If the school's last account with us is deleted, a profile you have linked stays with you and is no longer linked to the school
• If our team set up your child's profile before this version of our privacy policy, we were given your child's name and year level, and we may have been given your email address. If you already had an account with that email address, the profile was linked to it straight away. Our team also had to confirm that your family was given our collection notice and that we held your consent, and we tell you on your parent dashboard that our team set the profile up
• If we have no record of your agreement for a child, for example because their profile was set up before we had the collection notice, we ask you on your parent dashboard. You can agree, choose Not now, or remove the profile, and your child can keep using the profile while you decide. If you choose Not now, we ask again after you next sign in. If you have not agreed within 30 days, we pause the use of your child's learning needs (see section 7.3). For a profile set up before we had the collection notice, the 30 days run from the day we introduced the notice, whether or not you have signed in since, and the dialog shows the date they end
• If we change the collection notice in a way that matters, we ask you to agree again the next time you open your parent dashboard, and if you have not agreed again within 30 days of when we ask, the pause in section 7.3 applies. We also ask a school that confirmed an earlier version to confirm again, and until it does, its earlier confirmation stays our record of your consent and we show you the new version. A change that only fixes wording does not ask again
• Parents control the settings and data sharing preferences for their child's profile. If a school set up the profile, the school can also change the learning path and invite or remove a tutor, as described above, until you remove the school's access from your dashboard. A teacher you approve can also change the weekly targets and notes in your child's learning path, and pause or resume it, even if you did not allow them to assign learning activities
• For up to 7 days after you sign in on a device, until you or your child signs out there, your sign-in stays linked to that browser. Once a child's profile has been used there, because you chose Start learning or another button on your dashboard that opens your child's learning, you entered your child's PIN, or your child signed in with their own email and PIN, going back to your parent account and its settings and sharing controls needs your Rise Bright password, whether through the Back to parent button or your tile on the profile picker. A child you handed the device to can still switch to a brother's or sister's profile with that child's PIN. Continue with Google on our sign-in page is a way into your parent account that does not ask for your Rise Bright password (see section 8.1)

7.2 Child data minimisation

• We ask for your child's name. A first name is enough
• No photos, videos, or images are collected
• Roo, our optional learning-support assistant, is the only feature in which your child communicates directly with the platform. It is off by default and requires your written consent. It is also paused for your child, even if you turned it on, if we need your agreement to our collection notice for your child and 30 days pass without it (see section 7.3). Everything else reaches you through the parent dashboard
• No social features, profiles, or child-to-child interaction

7.3 Learning needs data

If you choose to provide information about your child's learning needs (such as ADHD, dyslexia, or autism), this information is:

• Used to adapt educational content and presentation, including your child's lessons, assessments and lesson plans, except while paused (see below)
• Sent to our AI provider, Claude AI (Anthropic), so it can adapt learning content and Roo's support (see section 4.3), except while paused. It is also in our database backups. The copies we send to off-site storage are encrypted (see section 4.1)
• Used by the AI when it writes your child's learning path, which can say how the path is adapted for those needs. A school that set up your child's profile, and a teacher you approve, can see the learning path (see sections 4.2 and 7.1)
• Shown to a tutor once the tutor accepts an invitation for your child, whether you or your child's school invited them, and, if the school invited them, only after you approve that tutor on your parent dashboard (see section 7.1). The tutor sees the learning needs you ticked, and your child's current learning plan and progress insights
• Paused if we need your agreement to our collection notice for your child and 30 days pass without it (section 7.1 says when we ask and when the 30 days start). From then until you agree, we do not use your child's learning needs to adapt their lessons, we do not send them to our AI provider, and Roo is paused for your child. Your child can keep learning, the settings you chose yourself, such as a dyslexia-friendly font or reading aloud, still apply, and what a teacher, school or tutor can already see does not change. As soon as you agree, all of this starts again. Learning needs are never paused for a profile that a school or our team set up and, at that time, confirmed to us that your family had been given the notice and had agreed
• If you write anything under "Other conditions or notes" when you add your child, we email our support team a message that a parent added notes, with a link to read them. The message does not include the notes, your name or your child's name. The notes stay in your child's profile and are deleted when the profile is deleted. Only staff whose admin role allows access to children's information can open the link, and we record each time they do, with who, when and why (see section 5)
• Not used for any diagnostic or medical purposes
• Optional: the platform works without this information

7.4 Children's online privacy code

Rise Bright is preparing for the Australian Children's Online Privacy Code, which is due to be registered by December 2026. When it is registered, we will review Rise Bright against it and update this policy.

8. Security measures

8.1 Technical security

8.2 Organisational security

• Ongoing security reviews and vulnerability assessments
• Incident response procedures in place
• Staff trained on privacy and security requirements
• Principle of least privilege for data access

8.3 Data breach response

In the event of a data breach that is likely to cause serious harm:

1. We will assess the breach and contain it immediately
2. We will finish assessing a suspected breach within 30 days, and notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable once we believe an eligible breach has happened
3. We will notify affected individuals as soon as practicable
4. We will provide recommendations for protective actions

9. Cookies and local storage

9.1 Our consent model

Rise Bright uses an opt-in consent model. Google Analytics only loads after you explicitly click "Accept" on the cookie consent banner. If you decline or take no action, no Google Analytics cookies are set. Our own website statistics (the visitor_session and rb_session cookies, see section 5) are collected either way.

9.2 Cookies we use

9.3 Local storage

We also store small pieces of data in your browser's local storage, including:

9.4 Email tracking

Rise Bright uses ZeptoMail to deliver our emails (such as welcome emails, password resets, account notifications and, if you subscribe, our newsletter). These emails may include:

• Open tracking: A small, invisible image (tracking pixel) that lets us know if an email was opened and when
• Click tracking: Links in emails may be routed through our email tracking subdomain (email.risebright.com.au) to record which links are clicked

This data helps us ensure emails are being delivered successfully and that important account communications are reaching you. We use it only to check that our emails, including the newsletter if you subscribe, are delivered. We do not use it for advertising.

Email tracking data collected includes: whether the email was opened, the time of opening, and which links (if any) were clicked. Where our email provider records this, it keeps it under its own terms. We do not copy it into our own systems.

9.5 Managing your preferences

You can change your cookie consent at any time by clicking "Cookie settings" in the footer of our website, including at the bottom of this page. This will remove any existing Google Analytics cookies and show the consent banner again.

We do not use:

• Advertising cookies
• Social media cookies
• Third-party tracking cookies (beyond Google Analytics, which requires your consent)

10. Australian privacy law

10.1 Privacy Act 1988

How we apply the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth):

10.2 Notifiable Data Breaches scheme

Under the Notifiable Data Breaches (NDB) scheme, we report any eligible data breach to the OAIC and to the people affected (see section 8.3).

10.3 Regulatory contact

We will acknowledge a complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our handling of your privacy complaint, you can contact:

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992
Online complaints: www.oaic.gov.au/privacy/privacy-complaints

11. Testimonials and feedback

From time to time we run pilot programmes and ask participating families for feedback. If you choose to leave us feedback, we will only publish it on our website if you tick the explicit consent checkbox on the feedback form. Default is no consent.

What we publish

• The text of your feedback (often edited by us for length or clarity, never to change meaning)
• A display name limited to your first name plus the first letter of your last name (for example, "Sarah K.")

What we never publish

• Your child's name or any personal information about your child
• Your full name, email address, or any other contact details

Withdrawing consent

You can withdraw consent at any time from your account settings, or by emailing support@risebright.com.au. The testimonial comes down straight away when you withdraw in your account settings, and within 7 business days if you email us. Deleting your account also deletes your feedback and takes down any published testimonial.

12. Contact us

For any privacy-related questions, concerns, or requests:

Policy updates

We may update this Privacy Policy from time to time. When we make a material change, we will tell account holders the next time they sign in, with a short summary of what changed. The "Last updated" date at the top of this page shows when the policy was last revised.