Data & Compliance

1. Our compliance posture

HSC Pal is operated from Australia and handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we work with schools, our handling of student information is intended to support — not replace — their obligations under state education and privacy law.

2. What we collect

Account & profile

• Name, email address, year level, school (optional), subjects.
• Authentication credentials (handled by Supabase Auth).
• Onboarding answers about study goals and exam dates.

Your study content

• Past work you upload: essays, exam responses, assessments, marker comments, scanned PDFs, and Word documents.
• AI-tutor chat history, practice attempts, marks we generate, and progress data.

Billing

• Subscription status and Stripe customer ID. We never see or store your full card number — Stripe handles all payment details directly.

Technical & usage

• IP address, device and browser type, page and feature usage, error reports (via Sentry), and rate-limit counters (via Upstash Redis).

3. How we use it

• To run the service: mark your work, generate personalised lessons, power the AI tutor, track your progress, and deliver practice exams.
• To keep you logged in and to enforce subscription access.
• To improve HSC Pal: diagnose bugs, measure feature usage, and prioritise fixes. We use aggregated and de-identified data wherever possible.
• To communicate about your account, subscription, and material updates to these policies.

4. We don’t train AI on your work

Your uploads, chats, and assessment responses are not used to train any AI model — neither ours nor any third party's. Our AI provider (Anthropic) processes your content to generate responses to your requests and does not train its models on customer API data under the terms of our agreement.

5. Who we share data with (sub-processors)

We use a small set of carefully chosen providers to run HSC Pal. Each only receives the data they need to perform their function.

• Supabase — database, authentication, and file storage. Hosts the bulk of your account and study data.
• Anthropic — large-language-model API powering marking, lessons, and the AI tutor. Receives the specific content needed to respond to a given request.
• Stripe — subscription billing and card processing.
• Vercel — application hosting and edge networking.
• Sentry — error and performance monitoring.
• Upstash — Redis used for rate limiting and short-lived caches.

Some of these providers are located, or process data, outside Australia (primarily the United States and the EU). By using HSC Pal you consent to your data being processed in those locations under appropriate contractual safeguards.

6. How long we keep it

• Active accounts: we keep your data for as long as your account is active so the AI tutor can reference your history.
• Cancelled subscriptions: data is retained for up to 12 months in case you resubscribe, then deleted or de-identified.
• Account deletion request: we delete personal data within 30 days of your request, except where we're required by law to keep records (for example, tax records of payments).
• Backups: deleted data may persist in encrypted backups for up to 35 days before being overwritten.

7. Security

• All traffic is served over HTTPS/TLS.
• Database access is gated by Supabase Row-Level Security, so users can only read and write their own rows.
• Production secrets are stored in Vercel's encrypted environment and rotated when staff change.
• We monitor errors and unusual activity through Sentry and Supabase audit logs.

No system is perfectly secure. If we discover a data breach that is likely to result in serious harm, we'll notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. Your rights

You can ask us to:

• Access the personal information we hold about you.
• Correct anything inaccurate or out of date.
• Delete your account and associated study data.
• Export your uploaded work and chat history.

Email privacy@hscpal.io from the address on your account. We aim to respond within 30 days.

9. Students under 18

HSC Pal is designed for high-school students. If you're under 18, a parent or guardian must agree to our Terms of Use and this policy before you create an account. Parents and guardians can email privacy@hscpal.io at any time to review or delete their child's data.

We don't knowingly collect data from children under 13. If you believe a child under 13 has signed up, contact us and we'll remove the account.

10. Cookies & analytics

We use cookies and similar technologies that are necessary for the service to work — keeping you logged in, remembering theme preferences, and protecting against abuse. We do not run third-party advertising trackers.

11. Schools & institutions

If your school sponsors your access, we may share your subscription status and aggregated usage with the sponsoring teacher or administrator. We will not share the contents of your essays, chats, or marks without your consent unless required by law.

12. Changes to this policy

We'll post any updates to this page and, for material changes, notify account holders by email at least 14 days before they take effect.

13. Contact

Privacy questions or requests: privacy@hscpal.io.
General support: support@hscpal.io.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.