Privacy Policy

About This Policy

Ninnovate Pty Ltd (ABN 40 693 981 270) ("Ninnovate", "we", "us", "our") is committed to protecting the privacy of everyone who uses or interacts with the ML4Schools platform, especially the students who learn with it.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We comply with the APPs and commit to this contractually with every school, regardless of our size.

ML4Schools is designed for Australian secondary schools and their students. Schools license the platform for their students and staff; the school directs what student information we hold on its behalf.

1. What Personal Information We Collect (APP 3)

We collect only the personal information reasonably necessary to run the platform. We practise data minimisation: if we don't need it to deliver learning, we don't collect it.

1.1 Students

We do not ask students to provide sensitive information, and don't intentionally collect it (as defined in s6 of the Privacy Act 1988 (Cth)): no health, racial or ethnic origin, religious, or political information.

We do not show advertising to students, sell student information, or use student information to build commercial profiles.

1.2 Teachers and school administrators

1.3 School contract and billing contacts

Name, email, phone, school name/address, and contract/billing details, provided during onboarding.

1.4 Prospective school contacts (bookings and enquiries)

If you book a walkthrough or demonstration with us (at book.ml4schools.com.au) or contact us with an enquiry, we collect your name, email address, chosen meeting time, and any details you choose to include. Our booking system is software we host on our own infrastructure, so your booking details are not sent to a third-party scheduling provider. Your name, email address, meeting time and any notes you include are written to our Google Calendar, and a Google Meet link is generated for the meeting, under Google's terms.

2. Children's Privacy

Most of our users are children (students aged 12–18). We treat all student information as our most protected category and design the platform with students' best interests in mind:

• We collect the minimum information needed for learning, and nothing for advertising or commercial profiling.
• Students access ML4Schools through their school, which authorises their account and acts as the decision-maker for their information.
• We provide a plain-language privacy summary for students so they can understand, in their own terms, what we hold and why.
• We support schools in meeting their responsibility to inform parents and carers, through our Parent Information Sheet.

We are monitoring the OAIC's Children's Online Privacy Code (to be registered by 10 December 2026) and will update our practices to meet it.

3. Why We Collect Personal Information (APP 3, APP 6)

We collect and use personal information to:

• provision and manage student and teacher accounts;
• deliver curriculum content, ML labs, quizzes, assessments and learning tools;
• let teachers track progress and give feedback;
• sync school enrolment data via Wonde;
• provide support and respond to enquiries;
• meet our legal and contractual obligations; and
• improve the platform using anonymised, aggregated analytics.

We will not use or disclose personal information for an unrelated purpose unless you would reasonably expect it and it is related to the original purpose, you consent, or we are required or authorised by law (APP 6).

4. How We Disclose Personal Information (APP 6)

We do not sell personal information and do not share it with advertisers.

5. Where Your Information Is Stored (APP 8)

ML4Schools is hosted in Google Cloud's Sydney region (australia-southeast1). Student and teacher personal information is primarily stored and processed in Australia.

Some limited technical exceptions apply:

• Transactional email: Japan. Contract-signing invitations and service notifications are delivered by Resend, Inc. from servers in Japan (AWS ap-northeast-1). These carry only the recipient's name and email address, and are sent only to school contract contacts. No student personal information is sent by email.
• Sign-in: country not fixed. Firebase Authentication runs on Google's global infrastructure and may route authentication data through data centres outside Australia. Google operates data centres in many countries and routes traffic dynamically, so it is not practicable to specify a definitive list of countries.
• Support and administration: country not fixed. A global provider such as Google or Microsoft may occasionally access information from outside Australia for support or administration. These providers operate support functions in multiple countries, so it is likewise not practicable to specify them definitively.

In each case we rely on the provider's Data Processing Addendum (which includes Standard Contractual Clauses) to ensure the information is handled consistently with the APPs (APP 8).

6. Cookies and Analytics

The ML4Schools website does not set cookies, and we do not use third-party analytics, advertising or tracking services on it.

When you sign in to the platform, your browser stores a session record locally on your device so you stay signed in. This is strictly necessary to operate the service, is held on your own device rather than sent to third parties for tracking, and is cleared when you sign out.

We do not use cookies or similar technologies for advertising, and we do not track students across other websites.

7. How We Protect Your Information (APP 11)

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure:

• Encryption in transit (TLS 1.2+) and at rest within Google Cloud;
• Access controls: role-based, least-privilege access limited to authorised personnel;
• Sign-in via your school's identity provider (Google or Microsoft SSO). Multi-factor authentication is enforced on Ninnovate staff and administrative systems;
• Audit logging of administrative and system activity;
• Data minimisation: we collect only what we need;
• Automatic account deactivation when a school's contract ends.

No online system is perfectly secure. If you believe a security incident has occurred, contact us immediately at [email protected] (Email us).

8. Keeping Information Accurate (APP 10)

We take reasonable steps to keep personal information accurate and up to date. Schools maintain student and teacher records via Wonde sync or the admin console.

9. How Long We Keep Information (APP 11.2)

When information is no longer needed, we securely delete or de-identify it. Full detail is in our Data Map, available to schools on request.

10. Accessing Your Information (APP 12)

You can ask for access to the personal information we hold about you:

• Students and teachers: contact your school first, since schools can view and update records via the admin console or Wonde.
• Others: email [email protected] (Email us) with your name, contact details, and what you're seeking.

We respond within 30 days. If we can't give access (for example, where it would affect another person's privacy), we'll explain why in writing.

11. Correcting Your Information (APP 13)

If information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, email [email protected] (Email us) to request a correction. We'll act within 30 days or explain in writing if we disagree.

12. Anonymity (APP 2)

Where lawful and practicable you may deal with us anonymously or by pseudonym. However, students and teachers need an identified account to use the platform's personalised learning features.

13. Data Breaches (NDB Scheme)

If we become aware of a data breach likely to cause serious harm, we will:

• contain and assess it immediately;
• notify the affected school(s) within 72 hours;
• work with the school to decide whether it is an Eligible Data Breach; and
• where required, support notification to the OAIC and affected individuals.

As data controllers, schools are responsible for notifying the OAIC where required under Part IIIC of the Privacy Act 1988 (Cth).

14. Complaints (APP 1)

If you're concerned about how we've handled your personal information, contact:

Ninnovate Pty Ltd, Privacy Officer
Email: [email protected] (Email us)

We'll acknowledge within 5 business days and aim to resolve within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au · 1300 363 992 · GPO Box 5218, Sydney NSW 2001.

15. Changes to This Policy

We may update this policy from time to time. We'll notify schools of material changes by email at least 14 days before they take effect, and the current version is always available on our website.

16. Contact Us

Ninnovate Pty Ltd, Privacy Officer
Email: [email protected] (Email us)