Privacy Policy

1. About This Policy

Self Paced Learning ("we", "us", "our") operates the website at selfpaced.com.au and related services (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, store and protect your personal information. It is prepared in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the Service, you confirm that you have read and understood this policy. If you do not agree, please do not use the Service.

2. Who We Collect Information From

We collect personal information from:

• Students (including children aged 9–13 preparing for Australian school exams)
• Parents or guardians who create or oversee accounts on behalf of their child
• Teachers and tutors who use the admin portal

Children's privacy: Because our platform is primarily used by children under 13, we require that a parent or guardian review and accept this policy on the child's behalf before the child uses the Service. We do not knowingly collect personal information from children without verifiable parental or guardian consent.

3. What Information We Collect

Information you provide directly:

• Google Account information (name, email address, profile photo) obtained when you sign in via Google OAuth
• Subscription and payment details (processed by Stripe — we do not store card numbers)

Information collected automatically:

• Practice test results, answers, scores and progress data
• Session and usage data (pages visited, features used, timestamps)
• Device and browser information (type, operating system, IP address)
• Referral codes used at sign-up

Information we do not collect: We do not collect government identifiers, health information, financial account credentials, or sensitive information as defined by the Privacy Act.

4. How We Use Your Information

We use personal information to:

• Create and manage your account
• Deliver exam practice questions and track your progress
• Process payments and manage subscriptions
• Send service-related emails (account approval, subscription updates)
• Improve our question bank and platform features
• Comply with legal obligations

We do not use your information for direct marketing without your consent, and we do not sell your personal information to third parties.

5. Disclosure of Your Information

We share personal information with the following third-party service providers solely to operate the Service:

All providers are bound by their own privacy policies and applicable data protection laws. We have entered into data processing agreements with each provider where required. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs.

We do not disclose personal information to government agencies or third parties except where required by Australian law.

6. Cross-Border Data Transfers

Some of our service providers are located in the United States of America. By using the Service, you acknowledge that your personal information may be transferred to, stored and processed in the USA. We take reasonable steps to ensure that overseas recipients protect your information in a manner consistent with the Australian Privacy Principles (APP 8).

7. Data Storage and Security

We store personal information in Supabase's cloud database, hosted in data centres operated by Amazon Web Services (AWS). We implement the following security measures:

• HTTPS/TLS encryption for all data in transit
• Row-level security (RLS) policies in the database
• Authentication via Google OAuth 2.0 (no passwords stored)
• Access controls limiting which staff can access personal data

While we take reasonable precautions, no transmission over the internet is completely secure. Please notify us immediately if you suspect unauthorised access to your account.

8. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service. When you request account deletion:

• Your account and personal details will be deleted within 30 days
• Anonymised or aggregated usage data may be retained for service improvement
• We may retain records required by law (e.g. payment records for tax purposes) for up to 7 years

9. Your Rights (APP 12 & 13)

Under the Privacy Act, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate, out-of-date or incomplete information
• Request deletion of your account and personal data
• Complain about how we have handled your information

To exercise any of these rights, email us at hello@selfpaced.com.au. We will respond within 30 days. For account deletion requests, we will confirm deletion within 30 days of receiving your request.

10. Cookies and Tracking

We use the following technologies on our website:

• localStorage — to store your session token and exam type preference on your device (no expiry set; cleared when you sign out)
• Google OAuth cookies — set by Google during the sign-in process, governed by Google's Privacy Policy
• Stripe cookies — set during payment flows, governed by Stripe's Privacy Policy

We do not use tracking cookies for advertising or analytics purposes.

11. Complaints

If you believe we have breached the Australian Privacy Principles, you may:

1. Contact us at hello@selfpaced.com.au — we will investigate and respond within 30 days
2. If unsatisfied with our response, lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992

12. Changes to This Policy

We may update this policy from time to time. Where the change is material, we will notify users by email or by prominently displaying a notice on the Service. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy enquiries, requests or complaints:

Self Paced Learning
Email: hello@selfpaced.com.au
Website: selfpaced.com.au