Privacy policy

Who we are

BrainBase is operated by Philip Sargeson trading as BrainBase (ABN 66 741 398 543) from Brisbane, Queensland. For any privacy question, correction request or complaint, use the contact form and select “Privacy request”.

As a small business operator with an annual turnover below $3 million, we are not currently bound by the Privacy Act 1988 (Cth). We have chosen to comply with the Australian Privacy Principles anyway. Where this policy says we will do something, you can hold us to it regardless.

What we collect about children

• A first name or nickname, chosen by an adult
• An avatar, always an emoji, never a photograph
• Year level
• A four-digit PIN, stored only as a cryptographic hash and never readable, including by us
• NCCD adjustment level, per-subject settings, and adjustment notes entered by an adult
• Learning activity: flashcards, quiz results, notes, streaks, XP and badges
• Messages exchanged with the AI tutor, including anything the safety system flags
• A log of accessibility adjustments delivered, such as read-aloud use

We do not collect from children: email addresses, phone numbers, photographs, home addresses, location data, contact lists, or any advertising or tracking identifier.

What we collect about adults

Your name and email where you provide them, the content of any message you send us, and basic technical information needed to deliver the website including your IP address.

Why we collect it

• To deliver learning content at the appropriate adjustment level
• To produce the adjustment evidence log
• To let a parent or teacher review progress and tutor conversations
• To operate the safety system around the AI tutor
• To respond to enquiries and diagnose faults

We do not use personal information for advertising or direct marketing, we do not sell it, and we do not share it for any commercial purpose. There are no third-party advertising or analytics trackers in BrainBase.

Who else handles it

We name every organisation that handles personal information on our behalf.

We do not disclose personal information to anyone else, other than where required by law.

Information that leaves Australia

Your child’s personal information stays in Australia unless they use the AI tutor. Their profile, adjustment settings, learning activity, notes and evidence log are all held on servers located in Australia.

The exception is the AI tutor. When a child sends a message to Pip, that message and the context needed to answer it go to Anthropic in the United States. Nothing else about your child is sent.

You can prevent this entirely. The tutor can be switched off for any child from the admin area, and you can set a daily message limit. With it disabled, no personal information about your child leaves Australia at any point.

Cloudflare operates a global network and may route website traffic, including IP addresses, through servers outside Australia. Before disclosing personal information overseas we take reasonable steps to satisfy ourselves the recipient handles it consistently with the Australian Privacy Principles.

Where it is stored, and for how long

Application data and its database are hosted on servers located in Australia, with encrypted backups on Australian infrastructure.

• Learning activity, profiles and evidence logs are kept while the account is active
• When an account is closed, associated personal information is deleted within 30 days
• Enquiry emails are kept for 12 months, then deleted

Deletion can be requested at any time without closing the account.

How we protect it

• PINs are stored as cryptographic hashes, never readable
• Adult access sits behind separate credentials with lockout after repeated failures
• Child PIN entry is rate limited and locks out after repeated failures
• All traffic is encrypted in transit, backups encrypted at rest
• Production database access is restricted to the application

No system is perfectly secure. If a breach occurs that is likely to result in serious harm, we will notify those affected and, where applicable, the Office of the Australian Information Commissioner.

Accessing and correcting information

Parents can view and correct most information directly in the admin area, including a child’s name, avatar, year level, adjustment settings and PIN.

You may also ask us for a copy of everything we hold about your child, or ask us to correct it. We respond within 30 days and do not charge for the request. If we decline, we explain why in writing and tell you how to complain.

Complaints

Contact us first. We acknowledge complaints within 5 business days and give a substantive response within 30 days.

If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Children and consent

A child cannot create their own account. An adult sets up every profile, and consent to collect information about a child is given by that adult separately from accepting our Terms of Service.

Consent can be withdrawn at any time. Withdrawing consent for the AI tutor disables it immediately and deletes stored conversations for that child.

Changes to this policy

We post changes here and update the date above. Where a change is significant, we notify account holders directly rather than relying on you to notice.