Privacy policy

1. About this policy

SteadyMarks is a registered Australian business name operating under ABN 76 882 481 758. This policy applies to SteadyMarks websites, family and student accounts, practice tests, reports, emails and related support. “SteadyMarks”, “we” and “us” mean the business operating under that name.

We handle personal information in line with this policy and applicable Australian privacy law. The service is designed to minimise the information collected about children while still providing useful practice and progress information.

2. Information we collect and hold

Parent and account information

• name, email address, email-verification status and family-account details;
• password or sign-in credentials in protected form, login records and, if Google sign-in is chosen, the Google profile name, email address, email-verification status and account identifier;
• account preferences, support messages and transactional-email choices.

Child profile and learning information

• display name, year level, student username and protected PIN;
• assigned tests, answers, written responses, scores, timing, flags and completion status;
• derived practice information such as skill progress, pacing, goals, review history and, if enabled by the family, a non-identifying leaderboard alias.

Purchases and technical information

• order, package, price, currency, payment status and payment-provider reference numbers;
• device, browser, session, security and diagnostic information needed to operate and protect the service.

SteadyMarks does not receive or store full payment-card numbers. Card details are handled by the payment provider.

3. How we collect information

We collect information:

• directly from a parent or guardian during registration, family setup, purchase or support;
• from a student when they sign in, complete practice or submit a response;
• automatically when the service records a session, saves an answer, calculates a result or protects an account;
• from service providers when a person chooses Google sign-in, makes a Stripe payment or receives an account email.

We use essential cookies and similar session technology for sign-in, security and core service operation. We do not currently use advertising cookies.

4. How we use information

We use personal information to:

• create and secure parent and student access;
• assign and deliver free or purchased practice tests;
• save answers, mark responses and show explanations, progress and parent reports;
• process purchases, provide access and keep transaction records;
• send verification, password-reset, service and opted-in progress emails;
• prevent misuse, investigate faults, support users and meet legal obligations;
• improve the service using aggregated or de-identified information where practical.

5. Children’s information

A parent or guardian creates and manages each child profile. We do not ask a child to provide a separate email address. Parents should use an appropriate display name and avoid entering unnecessary information about a child in free-text responses or support messages.

Student information is used to provide the practice service to that family. Leaderboard participation is off by default and, when enabled, uses a family-selected alias that must not match the child’s name or username.

A parent or guardian may contact us to access, correct or request deletion of a child’s information. We will verify authority over the relevant family account before acting.

6. When we share information

We disclose information only as needed to operate the service, complete a requested transaction, protect users or comply with law. Current service categories include:

• Vercel for website hosting and file delivery;
• Neon for the PostgreSQL database;
• Zoho for account and service email;
• Google when a person chooses Google sign-in;
• Stripe when a parent makes a payment;
• professional advisers, regulators or authorities where reasonably necessary or legally required.

Our main application hosting and database region is Sydney, Australia. Some providers may process limited information in the United States or other overseas locations described in their own privacy information. We take reasonable steps to choose and configure providers with appropriate privacy and security protections.

We do not sell or rent personal information to data brokers, advertisers or other third parties.

7. Storage, retention and security

We use technical and organisational safeguards appropriate to the service, including access controls, protected authentication secrets, secure provider connections, logging and restricted administrative access. No online service can guarantee absolute security.

We keep personal information only for as long as reasonably needed to provide the account and purchased access, maintain learning history requested by the family, meet legal and accounting obligations, resolve disputes and protect the service. We then delete or de-identify it where reasonably practicable.

If we become aware of a data breach, we will investigate, contain it and notify affected people and regulators where required by applicable law.

8. Your choices and rights

A parent or account holder may ask us to:

• provide access to personal information we hold about them or their managed child profile;
• correct information that is inaccurate, out of date, incomplete or misleading;
• close an account or delete information, subject to legal, transaction and security retention needs;
• stop optional progress emails using the available opt-out control;
• turn off optional leaderboard participation.

We may need to verify identity and family-account authority before completing a request. We will explain if applicable law permits or requires us to refuse part of a request.

9. Questions, requests and complaints

Contact our privacy representative at support@steadymarks.com. Please describe the account, request or concern without including a child’s password or PIN.

We will acknowledge and investigate privacy complaints and aim to provide a practical response within a reasonable time. If you are not satisfied, you may contact the Office of the Australian Information Commissioner.

10. Changes to this policy

We may update this policy when the service, providers or applicable privacy requirements change. We will publish the revised policy and update the date above. We will give account holders reasonable notice where a change materially affects how existing personal information is handled.