Legal
Privacy Policy
Effective date: 9 July 2026
1. Who We Are
MathsHarbour is an Australian online learning platform for Year 7 mathematics. This Privacy Policy explains how we collect, use, store, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
By using MathsHarbour, you consent to the practices described in this policy.
2. Information We Collect
Parent and guardian accounts
When you register, we collect your name, email address, and account password (stored as a one-way hash). We also record your subscription status and billing history (but not your card details - see Payments below).
Student accounts
Student accounts are created by a parent or guardian. We collect the student's name and year level. We also collect educational usage data - skill progress, practice question responses, mastery levels, and tutor questions - in order to provide the service.
Payments
Payment processing is handled by Stripe. We do not store your card number, expiry, or CVV. We receive and store a Stripe customer ID, subscription ID, and subscription status. Stripe's privacy policy is available at stripe.com/au/privacy.
Communications
We use your email address to send transactional messages such as email verification, subscription confirmations, trial-ending reminders, and tutor question notifications. We do not send unsolicited marketing emails.
3. How We Use Your Information
We use personal information to:
- create and manage your account
- deliver the MathsHarbour learning experience
- process subscription payments
- send transactional emails related to your account
- respond to tutor questions submitted through the platform
- improve and develop the platform
- comply with our legal obligations
We do not sell personal information. We do not use student data for advertising purposes.
4. Children's Privacy
MathsHarbour is designed for use by school-age students. All student accounts must be created by a parent or guardian who is at least 18 years old. By adding a student to your account, you confirm you are that student's parent or legal guardian and you consent to us collecting and using the student's information as described in this policy.
We collect only the minimum information needed to provide the educational service. We do not knowingly collect information from children without parental consent, and we do not use student data for any purpose other than delivering and improving the platform.
Parents may request access to, correction of, or deletion of their child's data at any time by contacting us at [email protected].
5. Disclosure to Third Parties
We share personal information only with the following service providers, who process it on our behalf:
-
StripePayment processing. Stripe operates under its own privacy policy and is certified to PCI DSS Level 1.
-
Amazon Web Services (SES)Transactional email delivery. AWS processes email content and recipient addresses to deliver your account emails.
We do not otherwise disclose personal information to third parties unless required to do so by law or with your explicit consent.
6. Data Security
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. Measures include HTTPS encryption in transit, hashed password storage, and access controls restricting who within our team can access personal data.
No method of transmission over the internet is completely secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
7. Data Retention
We retain personal information for as long as your account is active. When you close your account, we will delete or de-identify your personal information within 90 days, except where we are required by law to retain it for longer.
Subscription billing records may be retained for 7 years to comply with Australian tax record-keeping requirements.
8. Your Rights
Under the Australian Privacy Act 1988, you have the right to:
- request access to the personal information we hold about you
- request correction of inaccurate or out-of-date information
- request deletion of your personal information (subject to legal retention obligations)
- make a complaint about how we have handled your personal information
To exercise these rights, contact us at [email protected]. We will respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice on the platform. The updated policy will take effect on the date shown at the top of this page.