Privacy Policy.

Highlights of our policy

• Student accounts are created by parents, guardians or schools. We collect student profile information from these adults and collect or generate learning and technical information when students use Studyladder.

• For school-managed accounts, the school or education authority is responsible for having the necessary authority to provide student information and authorise use of Studyladder, including obtaining parental or guardian consent where required by law. For home-managed accounts, a parent or guardian authorises the child’s use of Studyladder.

• We collect only personal information reasonably necessary from parents, guardians, teachers and other account holders.

• We do not sell personal information. We use service providers to operate, secure and support Studyladder, as explained in our provider register.

• We collect information to provide, manage, secure and support the educational service, including accounts, learning activities, reports and rewards.

• Users can access personal information and request correction or deletion in accordance with applicable law. Requests concerning school-managed student information are handled with the responsible school or education authority.

• Routine account, billing and support communications are directed to parents, guardians, teachers or other responsible adult account holders. We do not send marketing communications to children.

• Privacy requests are handled in accordance with applicable law, including requests from children or young people themselves or from representatives lawfully acting on their behalf.

Please read this policy carefully. Contact us if you have any questions at: privacy@studyladder.com.

School-managed and home-managed accounts

Study Ladder Pty Ltd operates Studyladder. Responsibility for personal information depends on the account and the purpose for which the information is processed.

School-managed accounts

The school or education authority determines the educational purposes for which its student information is used. When Studyladder processes that information on its behalf, we follow our agreement and its documented instructions.

Where applicable law uses the terms “controller” and “processor”, the school or education authority is the controller for this processing and Study Ladder Pty Ltd acts as its processor. Studyladder remains responsible for protecting the information and meeting its own legal obligations.

Home-managed accounts

Study Ladder Pty Ltd is responsible for processing personal information to provide and manage home-account services and acts as the controller where that term applies. Parents or guardians manage their child’s account through the available controls and provide the authority required for the child’s use of Studyladder.

Other processing

Studyladder also acts as a controller where it determines its own purposes for processing information, such as managing direct customer relationships, billing and legal compliance.

Privacy requests and linked accounts

Requests concerning school-managed student information should normally be directed to the school or education authority. You can also contact privacy@studyladder.com, and we will help direct the request and assist the responsible organisation.

For home-managed information, contact Studyladder directly at privacy@studyladder.com.

Where a student account is linked to both school and home accounts, responsibilities and access permissions depend on the information involved. Linking a parent account does not automatically change responsibility for school-managed information.

What personal information does Studyladder collect?

We collect personal information about adults who register or manage accounts, including teachers, school administrators, tutors, parents and legal guardians, and about the children who use student accounts.

Personal information from adult account holders is collected when an account is created on our website or when they use or contact the service. This information may include email addresses, names, country and state, phone numbers, school name and school address.

Student accounts are created by parents, guardians or authorised school users. Student profile information may include a name or pseudonym, username or account identifier, grade, class and school details. Student email addresses are not required to use a student account.

When students use Studyladder, we also collect or generate learning and technical information. Depending on the features used, this may include answers, results, progress, login and activity records, time spent on tasks where recorded, submitted work or text where supported, IP addresses, browser and device information, and cookie or session identifiers. Information linked to a student account is treated as personal information.

Purchases and support requests may also involve billing, transaction and correspondence information. The information processed by particular service providers is described in our provider register.

Pseudonyms and non-identifying information

Where practicable, teachers may use a pseudonym when registering for the service. Teachers may also use pseudonyms or other non-identifying labels instead of students’ full names when creating or managing student profiles.

You may make general enquiries or provide feedback anonymously or using a pseudonym where practicable.

We may need to verify your identity when providing account-specific support, verifying teacher accounts, processing payments or refunds, responding to privacy requests, investigating security matters or complying with legal obligations. If identification is required, we will collect only the information reasonably necessary for that purpose.

What happens if you do not provide information?

You may choose not to provide personal information. However, some information is needed to provide particular services.

Account registration: An adult email address is required to register a parent or teacher account. Other required information is identified on the relevant registration form. Without the required information, we may be unable to create the account or provide the associated services.

Payments: Necessary billing and payment information must be provided to complete a purchase. Without it, Studyladder or its payment provider may be unable to process the payment.

Support and privacy requests: We need sufficient information to understand and respond to your request. Where necessary, we may also need to verify your identity or authority to act for another person. Without this information, we may be unable to respond fully or fulfil the request.

Optional information and features: You may withhold information identified as optional. This may limit the relevant optional feature without preventing access to services that do not require that information. AI features are optional; choices and controls are explained in Artificial intelligence and the relevant feature information.

How does Studyladder collect and process information?

• Directly from registering adult account holders and registered users through our website.
• When emails or support requests are sent to us.
• When a home-based registered user, usually a parent or guardian, creates and links a child account to their account.
• When a school-based registered user creates and links a student account to their account.
• From IP address, browser type and device type sent by your device when accessing the Studyladder website.

Student profiles are created by parents, guardians or authorised school users. We also collect information that students provide through activities and submitted work, and automatically collect or generate learning and technical information as they use the service.

Information collected through cookies, similar technologies and provider integrations is described in the cookies section and our provider register.

How does Studyladder use your information?

The information collected may be used for the following purposes:

• To send confirmation of successful registration by email.
• To personalise usernames and provide access to restricted areas of the websites.
• To communicate with adult registered users.
• To enable registered users to manage accounts, including their own personal information and child or student accounts.
• For school administration purposes.
• To create personalised features such as reports and rewards.
• To provide, secure, maintain and improve the service, respond to support requests, manage purchases and comply with applicable legal obligations.
• Where enabled, to support optional educational activities and related AI features, as explained in Artificial intelligence.

Authority and consent

School-managed accounts

The school or education authority must have the necessary authority to provide student information and authorise students’ use of Studyladder. It is responsible for identifying the applicable lawful basis, providing required privacy notices, and obtaining parental or guardian consent where required by law. Teachers and school administrators must act within the authority given to them by their school or education authority.

Where Studyladder processes student information on behalf of a school or education authority, we do so under our contract and its documented instructions. Studyladder remains responsible for meeting its own privacy and data-protection obligations.

Home-managed accounts

A parent or guardian creates or manages the child’s account and authorises their use of Studyladder. We obtain parental or guardian consent where required by applicable law.

Withdrawal of consent

Where we rely on consent to process personal information, that consent may be withdrawn at any time by contacting privacy@studyladder.com.

Results data and how it is used

Results data is limited to what is necessary for educational purposes, including learning activities, tracking progress and reports.

Results data is used to inform teachers, parents and guardians about a student’s performance and to tailor educational programs for students. Results data is also used to help us improve our resources.

Student and school results may be processed by our hosting and other service providers where necessary to deliver, secure or support Studyladder’s educational features, as explained in our provider register. These results are not sold or disclosed for advertising or marketing.

What Studyladder does not do with your information

Studyladder uses service providers to host, operate, secure and support the service. Providers acting as processors handle information on our behalf and under our instructions. Some providers act as independent controllers for particular services, as identified in our provider register.

We do not sell personal information. We do not use or disclose student information for behavioural advertising or marketing. Student profiles are used to support educational purposes.

Other disclosures may occur where required by law or authorised by valid consent. Our provider register explains the providers involved, their roles, the information processed, purposes and locations.

For how long is your information held?

We retain personal information for as long as it is needed for the purposes explained in this policy, applicable school agreements and legal obligations. When information is no longer needed, we take reasonable steps to delete it or irreversibly anonymise it, where permitted by applicable law.

Process for deleting inactive accounts – from October 2026

Teacher accounts

After 24 months without a successful login, a staged deletion process will begin. To keep their account, the teacher must successfully log in before the set deletion date.

Parent accounts

We apply the same notification process where the parent has not successfully logged in for 24 months and all student accounts linked to the parent’s account have also been inactive for 24 months.

Student inactivity means there has been no student login, learning activity or authorised educational use of the student’s records during that period. We recheck these conditions before closing the parent account. To keep their account, the parent must successfully log in before the scheduled closure date.

Account closure and recovery

On the scheduled closure date, qualifying accounts are deactivated. A recovery period begins on that date, during which the account can be restored following a verified request from an authorised account holder.

Information retained for recovery is protected, access is restricted, and it is not used for ordinary service activities. After the recovery period ends, the adult account and its associated personal information are permanently deleted, except for information that must lawfully be retained.

Linked student accounts

When a teacher or parent account is closed, linked student records may be retained for up to 90 days from the closure date to allow transfer to another responsible account holder.

Closing one adult account does not automatically delete a student account that remains linked to another authorised teacher or parent.

At the end of the 90-day period, student accounts without another authorised link or a continuing educational or legal need are deleted, or their records are irreversibly anonymised so the student is no longer identifiable.

Earlier deletion

Valid deletion requests and information that is no longer needed are handled sooner where required. The recovery and transfer periods do not override applicable deletion requirements.

Account closure and deletion requests

Users may delete accounts through the available controls or request deletion at privacy@studyladder.com. We check identity and authority where necessary and handle valid requests without undue delay and within applicable legal timeframes. Students can continue through another authorised link when an adult account is deleted.

Where appropriate and authorised, student accounts may remain for up to 90 days after adult account closure to allow transfer to another responsible account holder. If no transfer or other continuing need remains, we delete the student information at the end of that period. This does not delay valid student erasure requests.

Support emails are deleted with the linked parent or teacher account, subject to specific legal obligations or disputes.

Other retention requirements

Payment and transaction records are stored with Stripe and may remain there after account deletion for periods required by applicable law. Stripe may also retain information for its own legal obligations. Any necessary legal or dispute retention is limited to relevant information with restricted access until the requirement ends. This does not require keeping the Studyladder account or student learning records.

Information deleted from live systems may remain in protected backups until the applicable backup cycle ends. Backup copies are kept beyond ordinary use, and previous deletions are reapplied if a backup is restored.

How do registered users manage or delete their information?

• Registered users can access, update, review or amend their own personal information and the child or student information they are authorised to manage.
• Home registered users can request that their children’s personal information be amended by contacting privacy@studyladder.com.
• Teachers can request that their students’ personal information be amended by contacting privacy@studyladder.com.
• You can request deletion of your personal information, or child or student information you are authorised to manage, by contacting privacy@studyladder.com. We verify identity and authority before carrying out requests.
• Where we process student information on a school’s behalf, we coordinate with the school or education authority as appropriate.
• Deletion follows the periods and criteria above, applicable legal requirements and relevant school agreements.

If information is not available through the account controls, you may request access or correction by emailing privacy@studyladder.com. We will explain any applicable restriction when responding to a request.

Security of personal information

Studyladder is committed to implementing technical and organisational measures to take reasonable steps to protect personal information held by us from misuse, interference, loss, unauthorised access, modification or disclosure.

Studyladder staff and contractors with access to personal information are required to comply with this privacy policy and their confidentiality obligations.

Access to personal information is restricted according to roles and operational need. Authorised Studyladder personnel and relevant service providers may access or process information where necessary to operate, secure or support the service, as described in this policy and our provider register.

Data storage and security

Our primary systems are hosted by Amazon Web Services in the United States, principally Oregon. Google Cloud provides encrypted backup storage in Australia. Other storage, support and processing locations are described in our provider register.

Amazon Web Services is a major hosting provider with a range of security and data-protection certifications. Further information is available from AWS compliance information. These are AWS certifications and are not certifications held directly by Studyladder.

Studyladder backups and all student results data are encrypted before storage using industry-standard encryption.

Access to Studyladder systems for software maintenance is available only to authorised Studyladder staff through secure, encrypted channels.

Personal information may be stored or accessed outside your country of residence for hosting, backups, support and other services described in this policy. Our provider register identifies the providers involved, their purposes and principal processing locations, and links to their privacy and data-processing information. Privacy laws may differ between countries. Studyladder applies the security measures described in this policy to information under its control. Questions about overseas processing and applicable protections can be directed to privacy@studyladder.com.

Overseas storage, processing and disclosure

Studyladder uses service providers in several countries. Personal information may be stored, accessed, processed or disclosed outside your country of residence to operate, secure and support our services.

The service providers, subprocessors and other recipients register below identifies the relevant providers, information processed, purposes and known processing countries.

We take reasonable steps to protect personal information disclosed overseas, including appropriate provider assessments and contractual safeguards where applicable.

We review relevant provider arrangements and update the register when processing locations change. We identify additional likely recipient countries wherever practicable. Where a complete country list cannot practicably be specified, we describe the known locations or relevant regions and retain the reasons supporting that assessment.

Service providers, subprocessors and other recipients

Studyladder engages the organisations listed below to operate, secure, support and provide its websites, applications and services. A provider described as a processor processes personal information on Studyladder’s behalf and under its instructions. When Studyladder processes personal information on behalf of a school or other customer that is the data controller, a provider engaged to assist with that processing is also a subprocessor.

When acting as a processor, a provider may use the information only to provide its contracted services to Studyladder and not for its own advertising or other independent purposes.

A provider described as an independent controller determines its own purposes and means of processing for the relevant service and is responsible for meeting its own legal obligations. Examples in the register include payment processing, identity and security services, analytics, advertising measurement, embedded media and social-sharing functionality. Some providers perform different roles depending on the service used and its configuration.

For each provider, the register identifies its role, links to relevant privacy or data-processing information, describes the personal information processed and its purpose, explains Studyladder’s reason for using the provider, and identifies principal or other stated processing locations.

The data categories shown describe the maximum categories of personal information that may be processed through each service or integration. A provider does not receive every listed category about every user. Depending on the provider and service, information may be processed automatically as part of operating Studyladder or only when a particular feature is selected, loaded or used.

Information may be disclosed by Studyladder, collected directly by the provider or generated through the user’s interaction with the service.

Where the GDPR or UK GDPR applies and Studyladder acts as the controller, Studyladder relies, as appropriate, on performance of a contract, compliance with legal obligations, legitimate interests in providing and securing the service, or consent. The reason for use describes Studyladder’s operational reason for engaging each provider; it does not itself identify a GDPR lawful basis.

Responsibilities for school-managed and home-managed information are explained in the account-responsibilities section above. Requirements for providing student information and authorising its use are explained in the Authority and consent section.

Breach response protocols

Studyladder maintains an incident and data breach response protocol that includes procedures for containment, remediation and user notification.

These procedures support Studyladder’s response to security incidents while protecting personal information and maintaining service integrity.

Data breach notification

Studyladder will notify affected schools or education authorities by email without undue delay after becoming aware of a personal information breach affecting their data, in accordance with applicable laws and contractual obligations.

Where required, we will notify affected individuals and relevant regulators within the timeframes required by applicable privacy and data-protection laws.

Notifications will explain the nature of the breach, the information affected, the steps taken to contain and address it, and recommended steps affected individuals can take to protect themselves.

Use of cookies on our websites

Studyladder uses cookies and similar technologies to enable essential functions, including signing in, maintaining sessions and protecting the service.

Depending on the pages and features used, analytics, advertising measurement, embedded videos and social-sharing tools may also use cookies or similar technologies. The providers involved and the information they process are described in our provider register.

Responsible use for students

Studyladder encourages responsible use by students using the platform. Please read the Studyladder Rules for Students for information about using Studyladder safely and respectfully.

How will Studyladder notify changes to this policy?

Studyladder’s Privacy Policy may be amended to comply with applicable laws, reflect changes in our processes or services, or address other relevant requirements. Significant changes will be communicated to registered adult users by notifications when they log in to their accounts or by email. Users are also encouraged to check this Privacy Policy periodically to keep abreast of changes.

How to make a privacy complaint

If you believe Studyladder has mishandled personal information or breached an applicable privacy obligation, please email privacy@studyladder.com.

Describe your concern, when it occurred and the outcome you are seeking. Include enough information for us to investigate, while avoiding unnecessary personal or sensitive information.

Studyladder’s Data Security Officer, or an authorised representative, will review your complaint and arrange an investigation. We may contact you for further information and, where necessary, verify your identity or authority to act for another person.

We will acknowledge your complaint and aim to provide a substantive written response within 30 days of receiving it. Our response will explain our findings and any action taken or proposed. If more time is needed, we will explain the delay, provide an expected response date and keep you informed.

If you are dissatisfied with our response, or have not received a response within 30 days, you may contact the Office of the Australian Information Commissioner (OAIC) for complaints within its jurisdiction. Information about making a complaint is available at www.oaic.gov.au/privacy/privacy-complaints.

How to contact Studyladder

All requests for further information, concerns or questions regarding this privacy policy should be directed to Studyladder’s Data Security Officer at privacy@studyladder.com.

Study Ladder Pty Ltd operates Studyladder. The Contact Us page also provides a way to contact us about the service.

Artificial intelligence

AI register

Writing tool – planned for November 2026: Students submit written work for their teacher to assess. Teachers can assess the work themselves or choose AI-assisted assessment and feedback. When AI is selected, the student’s writing and relevant assessment instructions are sent to the AI provider identified in our provider register. Teachers review the AI assessment and feedback before using it or releasing it to the student. They can edit or override the assessment and decide whether to provide feedback to the student.

Studyladder may use AI to support educational activities and related service features. This section applies to all Studyladder AI features. Current and planned uses are identified in the AI register above and explained in the relevant feature information.

Adult control and authorisation

AI features are optional. School features must be enabled or initiated by an authorised teacher or administrator. Any AI features offered for home-managed student accounts require parent or guardian authorisation. For school use, teachers review and approve AI-assisted assessment or feedback before it is used or released to students. AI does not make final decisions about students’ grades or educational opportunities.

The requirements in School-managed and home-managed accounts and Authority and consent apply. Selecting an AI feature does not replace any required school authorisation, lawful basis or parental consent. School-authorised processing of children’s information is limited to providing the educational service to the school.

Information before use

AI features and AI-generated content will be clearly identified. Before information is processed, we will provide accessible information for the responsible school, teacher, parent or guardian, and age-appropriate information for students, about:

• The feature’s purpose, information used and results it may produce.
• The AI provider, processing countries, overseas safeguards and retention arrangements.
• Available controls, privacy rights, how to decline or stop AI processing, and how to withdraw consent where applicable.
• Possible errors, bias or inappropriate results, and the review required.

Where GDPR or UK GDPR applies, the feature information will identify the applicable controller and lawful basis for each AI processing purpose.

Information and AI providers

Depending on the feature, providers may process submitted content, relevant educational context and necessary technical information. We limit what is sent to what the feature needs and apply appropriate checks or filtering to reduce unnecessary personal or sensitive information. Submitted content may nevertheless contain personal information.

Our Service providers, subprocessors and other recipients register identifies the providers, including OpenAI, their roles, purposes, information processed and processing locations. See also Overseas storage, processing and disclosure.

We will only submit content to an AI provider after verifying that approved Zero Data Retention arrangements cover the models and features used. These controls relate to submitted content and are separate from routine provider account, billing and technical information. Applicable limitations or exceptions will be explained before use. If required protections become unavailable, we will suspend the affected processing until suitable protections are restored.

Information submitted to or generated by our AI features will not be used by Studyladder, or authorised by us to be used by AI providers, to train, develop or improve AI models. We will not opt into programmes permitting those uses. Submitted content and AI-generated outputs will not be sold or used for advertising.

Optional secondary uses of user information for AI usage analytics or stored AI personalisation will be disabled by default. Any such uses require separate information and controls, and any legally required authorisation or consent, before they are enabled.

Retention and privacy choices

Content and saved AI-generated records held by Studyladder follow For how long is your information held? Provider retention controls do not set Studyladder’s retention periods. The feature information will explain any different retention periods for temporary processing or provider records.

You can request access, correction or deletion under How do registered users manage or delete their information? To decline or stop future AI processing, use the available feature controls or email privacy@studyladder.com. For school-managed information, also contact the school; we will work with the responsible school or account holder to apply the restriction. Available services that do not require AI remain accessible.

Where processing relies on consent, you may withdraw it as explained in Authority and consent. We will stop future processing that relies on that consent. Withdrawal does not automatically delete existing records; you may request deletion separately.

Safe use and concerns

AI can make mistakes or produce biased or unsuitable results. Check results before relying on them. See our Using AI safely and responsibly guide for guidance and student-friendly help. The relevant AI feature will link to this guidance and display brief warnings about errors, bias and adult review.

Report AI errors, unfair results or harmful content through Contact Us; students should tell a teacher, parent or trusted adult. We acknowledge reports, assess their severity, investigate and respond within a reasonable period. Where appropriate, we restrict or suspend affected content or features, correct identified problems and explain the outcome or review options. Privacy and security matters follow Security of personal information, Breach response protocols, Data breach notification and How to make a privacy complaint.

Changes to AI features and processing

Before introducing a new AI feature or materially changing its processing, we will update the relevant notices and provider information and obtain any required authorisation or consent before processing begins.

We will notify affected users before planned changes to AI processing countries, aiming to provide at least seven days’ notice. For unexpected provider changes, we will notify affected users as soon as practicable and review whether processing can continue consistently with our privacy and security commitments. Required protections and any new authorisation or consent must be in place before processing continues.