Privacy Policy

Last updated: 3 June 2026 · Effective: 3 June 2026

Plain-English summary: We collect the minimum data needed to run your child's account and show learning progress. We never sell your data. We don't show ads. Parents can request a copy or deletion at any time by emailing enquiry@aceachievers.com.au.

1. Who we are

This Privacy Policy explains how Ace Achievers Education Pty Ltd (ABN: 72 680 153 860), trading as Ace Achievers ("we", "us", "our"), handles personal information collected through aceachievers.com.au and our learning platform (the "Service").

We comply with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

2. What information we collect

Category	Examples	Why we need it
Account info	Parent email, password (hashed), first name, last name, child's year level	Create and secure the account; deliver weekly progress emails
Learning data	Lesson progress, quiz answers, time spent, hint usage, mock exam scores	Track progress, generate reports, personalise practice
Payment info	Course purchased, amount, transaction ID — not full card details	Process payment and grant course access (full card data handled by Stripe)
Technical data	IP address, browser, device type, page views, error logs	Security, debugging, anonymous analytics
Communications	Emails to/from `enquiry@aceachievers.com.au`	Customer support

What we do NOT collect

We do not knowingly collect physical addresses, phone numbers, school names, or government IDs.
We do not collect full credit card numbers — these are handled directly by Stripe.
We do not use third-party advertising trackers or sell data to advertisers.

3. How we collect it

Directly from you, when you register, purchase, or use the Service.
Automatically, when you visit pages or complete lessons (cookies, browser headers, learning events).
From parents, on behalf of their child (where the child is under 18).

4. How we use it

Provide and improve the Service;
Authenticate your account and protect against fraud or abuse;
Send transactional emails (welcome, password reset, payment receipts, weekly progress reports);
Generate anonymised, aggregated analytics (e.g. "average completion rate of Lesson 3");
Respond to your enquiries;
Comply with legal obligations.

We do not use student learning data for advertising or share identifiable student profiles with third parties for marketing.

5. Children's privacy

The Service is designed for use by minors (typically aged 9–18). We take additional care:

For users under 15, accounts must be created using the parent or guardian's own email address. This email is the account holder of record and we use it to confirm parental consent before activation.
An account holder (the parent or guardian for a minor) must accept these terms before any account is created.
We keep child-identifying data to the minimum needed to operate the Service.
Parents have the right to review, correct, or delete their child's data at any time by emailing enquiry@aceachievers.com.au.
We do not market additional products directly to children.
We do not use student work (essays, answers, submissions) to train AI models.

6. Who we share data with

We share personal information only with these categories of service providers, and only the minimum required to run the Service:

Provider	Purpose	Location
Supabase	Authentication & database (account, learning progress)	USA / EU (data centre choice)
Stripe	Secure payment processing	USA & AU
Vercel	Website hosting	Global edge network
Email provider	Transactional emails (e.g. via Supabase / Resend)	USA
Google Analytics	Anonymous traffic analytics (IP anonymisation enabled)	USA

We have contracts (or rely on industry-standard data processing terms) with each provider requiring them to protect your data and use it only to deliver their service to us.

We do not sell personal information.

7. International data transfers

Some of the providers above store or process data outside Australia (primarily USA and EU). When we transfer personal information overseas, we take reasonable steps to ensure the recipient handles it consistent with the APPs. By using the Service, you consent to your data being processed in these locations.

8. How we protect your data

All connections use HTTPS encryption (TLS 1.2+).
Passwords are hashed (never stored in plaintext) by Supabase Auth.
Payment data is tokenised by Stripe — we never see your full card number.
Database access is restricted by row-level security policies — users can only read their own records.
We review access logs and update dependencies regularly to patch security vulnerabilities.

No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

9. Cookies & local storage

We use cookies and browser localStorage for essential purposes:

Authentication: keep you logged in across pages.
Preferences: remember your settings (e.g. last week viewed).
Anonymous analytics: measure page views and feature usage (Google Analytics with IP anonymisation).

We do not use advertising or cross-site tracking cookies. You can clear cookies/localStorage in your browser at any time — you will need to log in again afterwards.

10. How long we keep data

Active accounts: for as long as the account remains open.
After account deletion: personal information is deleted within 30 days; anonymised aggregate data may be retained for analytics.
Payment records: retained for 7 years as required by Australian tax law.
Support emails: retained for 2 years.

11. Your rights

Under the Australian Privacy Act, you have the right to:

Access the personal information we hold about you (or your child);
Correct inaccurate or out-of-date information;
Delete your account and personal data (subject to legal retention obligations like tax records);
Object to certain uses (e.g. opt out of non-essential analytics);
Export your data in a portable format (CSV/JSON);
Complain about how we handle your data.

To exercise any of these rights, email enquiry@aceachievers.com.au — we respond within 30 days (usually within 48 hours).

12. Complaints

If you are not happy with how we handle a privacy enquiry, you can complain to the Office of the Australian Information Commissioner (OAIC):

Website: oaic.gov.au
Phone: 1300 363 992

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by a prominent notice on the Service at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the latest version.

14. Contact us

Privacy questions, requests, or complaints:
Company: Ace Achievers Education Pty Ltd, trading as Ace Achievers
Address: Sydney CBD, NSW 2000, Australia
Email: enquiry@aceachievers.com.au