1Introduction
ATAR Booster is an online learning platform for students studying the New South Wales Higher School Certificate (HSC). We help Year 11 and Year 12 students practise syllabus-aligned STEM questions, receive instant AI-assisted feedback and marking, and track their progress against the NESA syllabus.
Because we work with young people, we are careful with the information we hold. This policy sets out what we collect, why we collect it, how we protect it, who we share it with, and the choices and rights you have. By creating an account or otherwise using ATAR Booster, you agree to the handling of personal information as described here.
“Personal information” has the meaning given to it in the Privacy Act 1988 (Cth). Broadly, it means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
2Our commitment to student safety
ATAR Booster is designed for use by secondary-school students. We keep data collection to a minimum and put privacy first:
- We collect only the information reasonably necessary to run the platform and support learning.
- We do not build advertising or marketing profiles of students, and we do not track you across other websites or apps.
- We store the core student database and account records on infrastructure located in Australia.
- We never sell personal information, and we do not allow AI providers to use platform activity to train their models.
- We give you straightforward ways to access, correct, export and delete your information.
3Information we collect
We collect the following categories of personal information.
a. Account information
When you register for an account, we collect:
- your first name and last name;
- your school email address (registration is currently limited to recognised NSW school email domains);
- the name of your school;
- your year level (Year 11 or Year 12); and
- your expected graduation year.
Your password is not stored by us. Authentication is handled by our identity provider, Auth0, which manages sign-in and stores credentials on its Australian infrastructure. We never see or store your password.
b. Learning and educational data
As you use the platform, we record information about your learning activity, including:
- the multiple-choice options you select and the typed short-answer responses you submit;
- whether an answer was correct, the marks awarded, and the AI feedback shown to you;
- questions attempted, topics and syllabus points covered, and completion of lessons;
- time spent on questions and lessons, confidence self-ratings, attempts, and skip activity; and
- mock exam responses, timing, and results.
You submit typed text and multiple-choice selections only. The platform does not accept uploads of photos, scans, PDFs or handwritten work from students.
c. Support and communications
If you contact us, for example through a contact form or by email, we collect the information you provide, such as your name, email address and the content of your message.
d. Technical and usage information
When you sign in and use the platform, we automatically collect limited technical information needed to run the service securely, including your IP address, browser and device type, and access timestamps. IP address and browser user-agent are recorded at sign-in and used for account-security monitoring (for example, to alert us to unusual login activity).
4Information we do not collect
We keep collection to a minimum. We do not intentionally collect:
- your date of birth or age;
- your home or mailing address;
- government-issued identifiers;
- sensitive information as defined in the Privacy Act (such as health, racial or ethnic origin, religious or political information);
- social-media account details; or
- your full payment-card or bank-account details. Card payments are handled directly by our payment processor, Stripe, and we never receive or store full card numbers.
5How we collect information
We collect personal information:
- directly from you, when you create an account, use the platform, subscribe, or contact us;
- automatically, as you interact with the platform (for example, your answers, progress and technical data); and
- from our identity provider (Auth0) during sign-in, which confirms your email address and account identifier.
Wherever it is lawful and practicable to do so, we will collect personal information directly from you. If we receive information we did not ask for, we will handle it in accordance with the Privacy Act.
6How we use information
We use personal information only for purposes connected with providing and improving ATAR Booster, to:
- create and manage your account and verify your eligibility;
- run the platform: serve practice questions, mark answers, generate feedback, and track your progress;
- personalise your practice using adaptive learning and spaced-repetition models;
- manage subscriptions, billing and payments;
- respond to your enquiries and provide support;
- monitor, secure and improve the reliability, safety and quality of the platform; and
- comply with our legal obligations.
We may create and use aggregated and de-identified information (from which no individual can reasonably be identified) to understand how the platform is used, improve question quality, and develop new content. This de-identified information is not used to identify, profile or assess individual students.
7Use of artificial intelligence
ATAR Booster uses artificial intelligence to support learning. For example, it marks typed short-answer responses against a marking rubric, and generates explanations and feedback on questions. AI is a study aid that complements teachers and classroom instruction. It does not replace them.
Our AI provider and what is sent
We use OpenAI as our AI processing provider. To mark a typed short-answer response, the text of your answer is sent to OpenAI’s API together with the relevant question and marking rubric. We do not attach your name, email address, school or other account identifiers to these requests. Feedback on multiple-choice questions is generated per-question and is not linked to any individual student.
How your inputs are handled by the AI provider
- OpenAI does not use data submitted through its API to train or improve its models.
- Under OpenAI’s API terms, inputs and outputs may be retained by OpenAI for a limited period (currently up to 30 days) for abuse-monitoring and legal-compliance purposes, and then deleted, unless a longer period is required by law.
- OpenAI processes this data in the United States (see “Data location & overseas transfers” below).
Automated feedback
AI-generated marking and feedback are automated and are generally not reviewed by a person. AI can make mistakes, and feedback may occasionally be incomplete or incorrect. You should treat it as a study aid and verify important points with your teacher. See our Terms of Use for more on the limits of AI feedback.
9Data location and overseas transfers
The core student database, account records and platform content storage are hosted in Australia. Some of our service providers, however, operate overseas, so certain limited information is disclosed outside Australia:
- AI marking inputs (your typed answers, without identifiers) are processed by OpenAI in the United States;
- transactional and notification emails are sent via Mailgun, whose infrastructure we use in the European Union; and
- payment processing by Stripe may involve processing in other countries.
Before disclosing personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including APP 8 (cross-border disclosure). We keep what is sent overseas to a minimum, for example by excluding student identifiers from AI requests.
10Data security
We use reasonable technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure, including:
- encryption of data in transit (TLS) and at rest;
- credential management and sign-in handled by a specialist identity provider (Auth0), so we never store passwords;
- row-level security controls in our database so users can only access their own data;
- access to production systems restricted to authorised personnel, with multi-factor authentication; and
- server-side access controls, so the browser never connects directly to the database.
No online service can be guaranteed to be completely secure, but we regularly review our systems and take data protection seriously. If we become aware of a data breach that is likely to result in serious harm, we will assess it and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.
12Retention and deletion
We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law. While your account is active, we retain your account and learning data to provide the service and track your progress.
Deleting your account
You can ask us to delete your account and associated personal information at any time by contacting privacy@atarbooster.com.au. When you do, we will deactivate the account promptly and delete or de-identify the associated personal information within a reasonable period, except where we are required to retain certain records by law. Once an account is deleted, it can no longer be accessed.
De-identified and aggregated data
We may retain information that has been irreversibly de-identified or aggregated (so that no individual can be identified) for purposes such as improving the platform and understanding educational trends. We do not retain identifiable personal information for longer than is reasonably necessary.
13Your rights and choices
Under the Australian Privacy Principles, you may:
- Access the personal information we hold about you (APP 12). You can view much of your own account and progress data directly within the platform.
- Correct information that is inaccurate, out of date or incomplete (APP 13). You can update key profile details yourself, or ask us to correct them.
- Obtain a copy of your data, and
- Request deletion of your account and personal information.
To make any of these requests, email privacy@atarbooster.com.au. We will respond within a reasonable time and in accordance with Australian privacy law. We may need to verify your identity before acting on a request. If we decline a request (for example, where an exception applies), we will explain why.
14Children and young people
ATAR Booster is designed for secondary-school students, many of whom are under 18. We only collect information reasonably necessary for the educational service, and we do not use student data for profiling, advertising or marketing.
We encourage students under 18 to use the platform with the awareness and involvement of a parent or guardian. A parent or guardian who has concerns about a young person’s use of the platform, or who wishes to request access to or deletion of their child’s information, can contact us at privacy@atarbooster.com.au and we will assist, subject to appropriate verification.
15How we meet the Australian Privacy Principles
| Principle | How we comply |
|---|---|
| APP 1: Open and transparent management | This policy is published on our website and kept up to date. |
| APP 3: Collection | We collect only information reasonably necessary for the educational service. |
| APP 5: Notification | We tell you what we collect and why through this policy and at the point of collection. |
| APP 6: Use and disclosure | We use and disclose information only for the purposes described here, or as permitted by law. |
| APP 8: Cross-border disclosure | Overseas processing is limited and disclosed above, and we take reasonable steps to protect it. |
| APP 11: Security | We use encryption, access controls and a specialist identity provider (see Security). |
| APP 12: Access | You can access your own data in-platform or by request. |
| APP 13: Correction | You can correct your information in-platform or by request. |
16Complaints
If you have a concern or complaint about how we have handled your personal information, please contact us first at privacy@atarbooster.com.au. We will acknowledge your complaint, investigate it, and respond as promptly and fairly as we can.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
17Changes to this policy
We may update this Privacy Policy from time to time as the platform and our practices evolve. When we do, we will publish the updated version on our website and revise the “Last updated” date above. Material changes will take effect from the date they are posted, and we encourage you to review this page periodically.
18Contact us
If you have questions about this Privacy Policy, or wish to access, correct or delete your personal information, please contact us: