Effective date: [TODO: date of publication]
findmeaschool.au is operated by [Company name] Pty Ltd, ACN [ACN — TODO], ABN [ABN — TODO], [Postal address for notices — TODO], Victoria, Australia (“we”, “us”). It helps parents and carers discover and compare Australian schools and, if they choose, build an AI-generated exam preparation plan for their child.
We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). A small business exemption may currently be available to us; we do not rely on it. Because we handle children's information, we commit to meeting the APPs in full, and to the Children's Online Privacy Code once it is registered.
You can browse the directory, map, school pages, scholarships and sources without an account. You can send feedback without giving your name or email. Saving a shortlist, keeping child profiles and using the planner need an account, because we have to keep that information for you.
We use Vercel Web Analytics, which is cookieless: it counts page views in aggregate and does not identify you or follow you across other sites. We use cookies only to keep you signed in and to remember your theme. No advertising cookies, no third-party tracking or profiling scripts.
We use information about a child only for the purpose you gave it for — building and running that child's plan — and for directly related purposes such as security and support. We do not use it for advertising or profiling and never sell it. We may disclose information where the law requires it, or where reasonably necessary to protect someone's safety.
Every optional item is optional: the directory, map, comparison and shortlist work without any child information. If you choose not to provide it, the planner has less to work from or cannot be used.
The service is for adults. Accounts are for parents, carers and guardians aged 18 or over; children do not have logins. All information about a child reaches us through the adult who holds the account. By entering it, you confirm you have parental responsibility for that child (or the authority of someone who does) and that you consent on the child's behalf to it being handled as described here.
A school report is rarely just marks. It may include your child's full name, date of birth, class and student number; attendance; results and teacher ratings; free-text comments about behaviour, wellbeing and friendships; and health, disability or learning-support information — for example a disability adjustment, an Individual Education Plan, or a therapy or intervention. That last category is sensitive information under the Privacy Act. We treat every uploaded document as if it contains sensitive information about a child.
We collect it only with your express consent, which is separate from accepting our terms. Before your first upload is processed you are shown what will happen — including that the document goes to our AI provider in the United States — and you must actively agree. You can withdraw consent at any time by turning off AI processing and deleting the documents. Withdrawal stops future processing but does not undo processing already done. Please upload only what the planner needs; remove medical or support-plan pages, or type the results in by hand instead.
Uploads are off by default, nothing about a child is ever public, and we collect the minimum the feature needs. Where your child is old enough to understand, please tell them what you are uploading and what the planner does with it.
The Office of the Australian Information Commissioner (OAIC) is developing a Children's Online Privacy Code, due to be registered by 10 December 2026. We are preparing for it now and will update this policy and our consent steps to match the Code as registered — including any requirement to notify a child, or to let an older child consent for themselves.
Some school pages may show a News & concerns section: links to official findings and news reports about the school. While it is in beta it is shown only to our moderators and to signed-in users we have invited. If you are invited, we keep your account ID on an invite list in our server settings until the beta ends or you ask to leave it. To build the section we collect, about schools rather than people:
A person reviews every item before anyone outside our moderation team sees it; concerns are never published automatically. We show headlines only from official sources or once a moderator has re-read the item at the publisher's own page — not straight from search results — and we label whether an item is an official finding, a media report or an allegation.
We aim to hold no personal information that identifies teachers, staff, students or anyone else. When software reads a headline, it replaces any person's name with a role (for example “[A teacher]”) before anything is stored; the names it found are used only to check that replacement and are then discarded. If a headline cannot be made safe, we store a fixed placeholder instead. We do not build profiles, search tools or lists of individual staff. We know a role plus a school can sometimes still point to one person, so moderators withhold headlines where that is likely.
To find and sort items we send a school's name, suburb and the public headlines or snippets returned to: Brave Search (and Google News in testing); the Vercel AI Gateway, which passes requests to an AI model provider such as Google or Anthropic; Anthropic directly; and TypeSafe's Jev classifier. These services receive public information only. We never send them account, child, chat or planner data.
Items expire 36 months after publication and are then no longer shown or counted. The only exception is an enduring official finding against a school itself, such as a regulator outcome — never one about a person. Moderation records are kept so we can show how each decision was made.
Right of reply and removal. If you are a school, a staff member or anyone else and want an item corrected, answered or removed, use our concerns process. A moderator reviews every request and can unpublish an item straight away.
We use a small number of service providers to run the service. We do not sell or give personal information to advertisers, data brokers, schools or tutoring businesses.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage: account details, child profiles, records, plans, uploaded documents, feedback and concerns. | South Korea (Seoul, on Amazon Web Services) |
| Vercel | Hosts the website and runs its server code; server logs; cookieless Web Analytics; AI Gateway that routes public-data AI requests (see News & concerns). | United States, with a global delivery network |
| Anthropic | AI models for the chat assistant, reading uploaded documents and generating plans; may also classify public news items. | United States |
| TypeSafe (Jev) | Classifies public news items about schools. Receives public information only — never account, child, chat or planner data. | [TODO: confirm TypeSafe processing location] |
| Brave Search, and Google News (testing only) | Search services we query with a school's name to find public reporting. We send search terms, not personal information about you. | United States |
| Google, Apple or Microsoft | Only if you choose to sign in with them (where offered): they confirm who you are and send us your name, email address and profile picture. | United States |
Payments (not yet live). When paid plans launch, a third-party payment provider (expected to be Stripe) will take payments; we will never see or store your card number. We will name the provider and its location here before any payment is taken.
We do not use your information for direct marketing (APP 7).
Most of what we hold is stored or processed outside Australia: the database and files in South Korea (Supabase, Seoul), and hosting and AI processing in the United States (Vercel, Anthropic). Sign-in providers, if you use them, are also in the United States. There is currently no Australian data-residency option for our AI provider, and we will not pretend otherwise. Privacy law in those countries differs from Australian law, and you may not be able to enforce the same rights there.
For the Preparation Planner we send our AI provider, Anthropic, the material a plan is built from: the uploaded document, the results and notes on the child profile, the child's year level and state, the target exam and date, and the plan being refined. Your child's name is removed before anything is sent, though a document image may still show it. Anthropic does not use commercial API data to train its models, and by default deletes API inputs and outputs within about 30 days (longer only for content flagged by its safety processes or under legal hold). It offers a zero-data-retention arrangement; we have not yet obtained one, so the 30-day default applies. We will update this policy if that changes.
Under section 16C of the Privacy Act, we remain accountable to you for how these overseas providers handle your information, as if we had handled it ourselves. If something goes wrong at one of them with data we sent, raise it with us.
From 10 December 2026, privacy policies must explain when a computer program uses personal information to make, or substantially help make, decisions that could significantly affect someone. We are explaining ours now.
The Preparation Planner. Software reads your child's information and produces a plan without a person reviewing it first. It uses the child's year level, state, target exam and date; results and comments from documents you upload or enter (including anything else in an uploaded document, such as teacher comments or support notations); interests, activities and availability; and your progress marks. It produces an assessment of apparent strengths and weaknesses, a multi-week schedule with daily activities, suggested materials with sources, and a progress tracker. Built-in limits cap daily and weekly study time and require rest days.
A plan is guidance for you, the parent. It is not a diagnosis, a prediction of a result, or a decision about any right or entitlement your child has, and it does not go to any school, exam body or third party. You remain the decision-maker. If a plan says something you think is inaccurate, regenerate or delete it, or tell us at [privacy@ address — TODO].
News & concerns. Software suggests a category and seriousness for public news items about schools; a person makes the final decision on everything that is published. This is designed not to use personal information (section 5).
You can use the whole free service without any AI processing of your child's information. Note that the chat assistant sends what you type to Anthropic, so do not paste your child's report into the chat if you do not want it processed.
We take reasonable steps to protect what we hold, including:
No online service can guarantee absolute security. Please use a strong, unique password and tell us straight away if you think your account has been accessed by someone else.
We keep personal information only as long as we need it:
Deleting removes data from our live systems immediately; a regular clean-up job also removes any stored file left behind. Copies already sent to Anthropic fall away under its 30-day default.
You can see, correct and delete most of your information yourself in the app. For anything else — including a copy of what we hold, or a correction to something an AI plan says — email [privacy@ address — TODO]. We will respond within 30 days and will not charge you. If we decline a correction, we will tell you why and attach a note of your view if you ask.
If we suspect personal information we hold has been lost or accessed without authorisation, we will act straight away to contain it and assess it within 30 days. If it is likely to cause serious harm, we will notify you and the OAIC under the Notifiable Data Breaches scheme, telling you plainly what was affected and what to do.
If you are unhappy with how we have handled personal information, email [privacy@ address — TODO] with what happened and what you would like us to do. We will acknowledge it within 5 business days and give you a written response within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney NSW 2001. The OAIC usually expects you to have raised it with us first.
We will post any update here with a new effective date. For material changes — especially any change to how a child's information is processed or where it goes — we will tell you before the change takes effect and ask for fresh consent where the law requires it.
Privacy questions and requests: [Company name] Pty Ltd, [Postal address for notices — TODO], Victoria, Australia — [privacy@ address — TODO].