Privacy Policy

What we collect

• Account details you provide: name, email address, and (for teachers) school name.
• Practice activity: questions answered, scores, written responses, and AI-generated feedback.
• Class and link data: which teacher you're connected to, if you choose to link an account.
• Payment information for Plus and school purchases, processed directly by a specialist payment provider (we do not store card details).
• Website measurement data (pages visited and features used) via Vercel Analytics and Google Analytics, so we can improve ScoreReady and benefit users. If session replay is enabled, recordings may also capture how you use the product so we can find confusing or broken parts. Free-text answer boxes, written answers, and student answer or feedback text are masked and are not recorded in session replay. ScoreReady does not send names, email addresses, account IDs, school names, written answers, scores, or class data to Vercel Analytics or Google Analytics.
• Advertising measurement data when someone arrives from a ScoreReady advertisement, such as an advertising click identifier and whether a signup, practice start, or purchase occurred. We do not share your email address (hashed or otherwise), written answers, scores, progress or school with any advertising platform.

How we collect it

• Directly from you: when you create an account, join a class, answer questions, contact us or buy something.
• From your teacher or school: a class code or invitation, the class you belong to, and school purchasing details such as quotes and purchase orders.
• From Google, if you choose to sign in with Google: your name and email address.
• Automatically: security and error logs when you use ScoreReady, and website measurement on public pages as described below.

How we use it

• To run your practice attempts and generate feedback (your written answers are sent to an AI marking service for that purpose only).
• To show teachers the progress of students who have linked to their class.
• To process payments and manage any subscription, via a specialist payment provider.
• To improve the practice content and fix problems with the service.

Who we share data with

We share data only with the service providers needed to run ScoreReady: Supabase (database and authentication, Sydney), Vercel (hosting and performance analytics), OpenAI (AI marking of written answers, United States), Google (backup AI marking via Gemini if OpenAI is unavailable, website analytics and Google Ads conversion measurement on public pages), Meta (advertising measurement for Facebook and Instagram campaigns on public pages), Resend (account and receipt emails) and Stripe (payment processing). Advertising and analytics tags never load in the student, teacher or school areas of ScoreReady. We do not sell your data, and we do not share student progress with anyone other than the student's own linked teacher.

Overseas recipients

Student and teacher account, practice and class records are stored in Australia (Sydney). Some service providers process limited information outside Australia:

• OpenAI, United States: written answers and the question and marking guide, to mark them.
• Google, United States and other countries where Google operates: backup AI marking if OpenAI is unavailable, sign-in with Google, and website measurement on public pages.
• Meta, United States: advertising measurement on public pages only, with no account details.
• Microsoft (Clarity), United States: session replay on public pages, only when it is enabled, with answer text masked.
• Resend, United States: account, receipt and school emails (name and email address).
• Stripe, United States and other countries: payment processing.
• Vercel: hosting. Application servers run in Sydney; public website files may be served from edge locations worldwide.

We choose providers that protect personal information to a standard comparable with the Australian Privacy Principles, and we never send these providers more than their task needs.

Teacher check-ins

A teacher can send a student a short check-in message inside ScoreReady — for example, if the student hasn't started a set task or their practice has dropped off. Check-ins are a one-way, teacher-to-student message shown inside the student's own account; they are not sent by email and are visible only to the student and the teacher who sent them.

School licences

Some students join ScoreReady using a class code provided by their school. Where that's the case, the school has decided to make ScoreReady available to its students, is responsible for its own enrolment and consent obligations — including any parental or guardian consent its own policies require — and directs how that student's data is used within ScoreReady. ScoreReady processes that student's account, practice and progress data on the school's instructions, for the purpose of delivering practice and reporting that data to the teachers at that school.

A school licence gives ScoreReady Plus to the students it covers within the school's classes. A Class licence covers all the students in your class; Faculty and Whole school licences cover the number of students stated on the quote. A school licence runs to 31 December of its licence year. A licence bought in Term 4 covers the rest of the current year and the whole of the next school year. It ends at the end of that licence year unless the school renews it, or earlier if the school cancels it; when it ends, affected students keep their free ScoreReady account and lose Plus access, and no practice work is deleted.

A student, parent or guardian who joined through a school class and wants that data corrected or deleted can contact their school, or contact ScoreReady directly at hello@scoreready.com.au.

Analytics, advertising measurement and cookies

ScoreReady advertises on Google, Meta (Facebook and Instagram) and Reddit, and uses Google's and Meta's measurement tools to see which campaigns lead to useful actions. These tools use first-party cookies, browser information, IP-derived location, and an advertising click identifier, on public pages only. No account details, including email addresses, are shared with any advertising platform.

We use analytics and, where enabled, session recordings to improve the product and benefit users. Google and Meta receive advertising measurement data as overseas recipients. Session replay is disabled unless the owner enables it, and free-text answers and student answer or feedback content are masked and not recorded in those recordings.

ScoreReady disables Google Signals and advertising-personalisation signals in its site configuration. We do not use remarketing, Customer Match, enhanced conversions, or student account information to build advertising audiences. You can limit cookies using your browser settings or install Google's Analytics opt-out browser add-on.

Where data is stored

Your data is hosted in Australia and the Asia-Pacific region with providers independently audited to SOC 2 Type II, and it's encrypted in transit and at rest. Public website files may be served from cloud edge locations closer to visitors, but student account, practice and class-link records are kept in the application database.

Access is limited by role: students see only their own work, and teachers see only their own classes. Administrator access needs two-step verification, and anyone who can reach ScoreReady systems completes yearly security and privacy training. Account data is kept while the account is active and removed when the account is deleted; practice from a guest who never makes an account is removed within 12 months of their last activity.

AI marking data

When you request AI feedback, ScoreReady sends the AI marking service the question, marking guide or sample answer, your written response, subject/topic details, and any confidence selection you provided. We do not send payment details, passwords, teacher private notes, or unrelated class records to the AI marking prompt. AI feedback is study guidance, not an official QCAA result.

Student answers are encrypted when sent to ScoreReady and its AI provider, OpenAI, which processes them in the United States to generate feedback. OpenAI does not use data sent through its API to train its models, and keeps request logs for up to 30 days for abuse monitoring.

ScoreReady does not add student names, email addresses or internal account identifiers to normal AI prompts. However, anything a student chooses to write in an answer may be sent as part of that content, so students should not include personal or sensitive information.

Your rights

You can request a copy of your data, ask us to correct it, or delete your account from the account page at any time. Account deletion usually occurs immediately, though completion across related systems may take up to 48 hours. You can also email hello@scoreready.com.au if you need help.

Questions and complaints

Our Privacy Officer (the Founder and Director of ScoreReady) handles privacy questions, requests and complaints. Email hello@scoreready.com.au with "Privacy" in the subject. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Children and students

ScoreReady is built for secondary school students. We collect only what's needed to run practice sets and show progress to a linked teacher. We do not use student answers, scores, progress, or class links for advertising targeting or audience creation, and we share no account details with any advertising platform. Advertising and analytics tags never load in the student, teacher or school areas of ScoreReady.

Changes to this policy

If this policy changes, we'll update the date above. Continued use of ScoreReady after a change means you accept the updated policy.