This is the notice Reason Education (ABN 17 374 306 140) gives about the collection and management of personal information in the Reason Education staff portal and student app.
The Privacy Policy says how we run privacy as a business. This notice does one narrower job: it tells you, before you hand anything over, exactly what we take and what happens to it. Australian Privacy Principles 1.4 and 5 require ten specific things to be covered. They are the ten headings below, in that order, each answered rather than referred elsewhere. Section 11 is not required by the Australian Privacy Principles; it is the section a school council asks for.
Where something is not yet built, this notice says so and gives the gate it must pass.
The kinds of personal information we collect and hold
1.1Students. The whole list, and nothing outside it:
- first name and last name
- year level
- a student number we generate — ours, not the school's, not a government one
- a chosen emoji, so a young child can find their own name on a list
- answers to assessment questions
- images of handwritten working out, stored as PNG
- curriculum judgements against Victorian Curriculum 2.0 (derived from AC V9.0)
- growth history — those judgements over time
1.2Work held on the child's device. While a child is completing an assessment, their answers and their working-out drawings are held on the device they are using — in that browser's local storage, not on our servers — so that nothing is lost if the internet connection drops. That copy is erased as soon as the work reaches their teacher. It is not shared with anyone and it does not leave the device.
1.3School staff. Name, email address, school, a password hash, and a TOTP secret if a second factor has been enrolled. Also email delivery logs, sign-in attempt records, and an audit record of who viewed which child's work.
1.4Records of staff activity. When a staff member uses the portal we record what they did, when, the page they were on, and the network address their device connected from. This is what allows a school to answer "who looked at this child's record?", and it is visible to the school's own administrators.
1.5Schools. School name, and the contact details of the staff who administer the account.
1.6What we do not collect. None of the following is collected, and there is nowhere in the product to put them:
- date of birth, or age
- gender
- parent or guardian details
- home address
- health information
- financial information
- racial or ethnic origin
- Aboriginal or Torres Strait Islander status
- any government identifier
No location data of any kind is captured. There are no analytics, trackers, advertising networks or third-party assets on any page a child sees.
1.7What we call it. We call these assessment records and growth history. Nothing beyond the list above is compiled about a child.
How we collect it, and how we hold it
2.1Collected three ways, and no others. Entered or uploaded by school staff; entered by a staff member setting up their own account; or created by the child using the app — their answers, and the working out they draw on the canvas. We do not buy data, obtain it from third parties, or infer it from anything else.
2.2Held in Melbourne. On Microsoft Azure App Service and Azure Database for MySQL Flexible Server in Australia Southeast (Melbourne). Encrypted in transit and at rest.
Working-out images are held inside the database today, and move to blob storage in the same region once migrated. Same provider and same region either way — but the images sit in the database dump rather than in object storage with its own lifecycle, and any backup or recovery statement should read that way.
Every query that touches a child's information is scoped to the school that owns it, in the query itself rather than in the page that calls it.
2.3How a child signs in. With a signed, single-use QR token printed on a card — not a stored password or PIN. Where a school cannot scan, a teacher issues a short-lived one-time code that is stored hashed. No reusable student credential is stored in reversible form anywhere.
The purposes for which we collect, hold, use and disclose it
3.1One purpose. To deliver maths assessment to the school that asked for it.
3.2Concretely. That means:
- to mark answers against an answer key
- to show a teacher a child's working out
- to have a model describe the method a child used, so the teacher can read it alongside the work
- to record the curriculum judgements the teacher makes
- to show growth over time
- to run staff accounts securely
- to support the school when it asks
3.3What we do not use it for. Marketing, market research, product analytics, advertising, building a picture of a person for any other purpose, or training, fine-tuning or improving any AI model. Any commercial email is opt-in only.
The intended recipients
4.1Inside the school. The staff that school authorises. Nobody at one school can see anything belonging to another. There is no search, directory or discovery feature that crosses schools, and no data sharing between customers.
4.2Outside the school. Four sub-processors and nobody else. Each is named in full, with data types, purpose, lawful basis and country, in the Sub-Processor Register — to be published at reasoneducation.com.au/sub-processors from date golive — to be confirmed.
| Recipient | What it receives |
|---|---|
| Anthropic (United States) | The AI payload: the working-out image, the question, the answer, our own mark, a year-level band. No name, no identifier. |
| Microsoft Azure, Australia Southeast (Melbourne) | Everything, at rest and in processing. Microsoft does not access it. |
| Amazon Web Services — Amazon SES, Sydney (ap-southeast-2) | Staff name and email address, and the account and service email itself — including single-use account-recovery links. Processed in Australia. No student data, ever. |
| Have I Been Pwned | The first five characters of a SHA-1 hash, when a staff password is checked against known breaches. No password, no name, no email, no student data. |
4.3A file the school takes away. A school administrator can download the school's own activity records as a file. That file names children, and it leaves our systems for the school's own storage — the school controls it from that point, and the file itself says so.
4.4Nobody else. We disclose to no other party, in any circumstance, other than: where the individual has consented; where required or authorised by Australian law or a court or tribunal order; where permitted under privacy legislation; or where we reasonably believe disclosure is reasonably necessary for an enforcement body's enforcement-related activities. We do not sell data, and we do not share aggregated or pseudonymised data either.
The consequences if information is not provided
5.1A student's first name and year level. Needed to create the account and to give the child the right assessment. Without them, the child cannot use the service. The emoji is optional, and nothing else about a student is mandatory.
5.2A staff email address. Needed to issue the account and to send a password reset. Without it there is no account.
5.3A working-out image. Optional, in the sense that a child may leave the canvas blank; the answer is still marked. What is lost is the only thing the product exists to give the teacher — the method behind the answer.
5.4A missing field stays missing. Nothing about a child is inferred to fill a gap.
How to access and correct personal information
6.1How to ask. Email policies@reasoneducation.com.au. Mark it for the attention of the Privacy Officer.
6.2What you get, and how fast.
- Free of charge. Always, for access, correction and deletion alike.
- Acknowledged within 5 business days; completed within 30 days. Never longer than 3 months — and if a request will take more than 30 days we tell you why and give you a date.
- Most correction is faster done in the product: a teacher or school administrator can correct a student's name, year level or class at any time.
Parents and carers: please contact your child's school
The school holds the relationship with your family and decides what happens to its students' records. We act on the school's instruction, and we will always tell a school exactly what we hold and how to have it changed or removed. That mechanism is theirs to use; we do not make undertakings about a school's records to anyone else, and we do not advise a school on whether parental consent is required — that is the school's determination under its own policy and its department's guidance.
How to complain, and how we handle it
7.1Tell us. policies@reasoneducation.com.au, marked for the attention of the Privacy Officer. Then:
- We acknowledge in writing within 5 business days and name who is handling it.
- The Privacy Officer investigates — Jake Gatto, who is not the founder who writes the code. A complaint about the product is not investigated by the person who built it. Where a complaint concerns the AI, the AI Accountability Owner, Jacob Clemens, can halt a release or stop model calls while it is open, and does not need the agreement of the founder who develops the AI.
- We respond in writing within 30 days: what we found, what we are doing, and what to do if you disagree. Longer than 30 days only with a reason and a date, and never beyond 3 months.
- The outcome is either a change with a test behind it, or a written record of why no change is warranted. A complaint that produces neither has not been closed.
7.2Going elsewhere. If you are not satisfied you can complain to the Office of the Australian Information Commissioner — oaic.gov.au, 1300 363 992. If the complaint concerns a Victorian government school, the Office of the Victorian Information Commissioner — ovic.vic.gov.au — may also be able to help. You can go to either at any time; nothing here requires you to come to us first.
Our contact details for privacy
| Entity | Reason Education (ABN 17 374 306 140) |
|---|---|
| Privacy Officer | Jake Gatto |
| Privacy enquiries, access, correction, complaints | policies@reasoneducation.com.au |
| General support | policies@reasoneducation.com.au |
| Child safety concerns | policies@reasoneducation.com.au |
Whether we are likely to disclose personal information overseas
9.1Yes. One disclosure leaves Australia, and only one: the AI payload described in sections 4 and 11 goes to the model provider. It is likely to occur every time a child submits working out, from the day the model is provisioned.
9.2What we do not claim. We do not claim that nothing leaves Australian jurisdiction. What is true is that stored student data is held in Melbourne and never leaves it, and that the only information going overseas is the pseudonymised inference payload.
The countries where overseas recipients are located
| Country | Recipient | What is processed there |
|---|---|---|
| United States | Anthropic | Model inference only. The working-out image, the question, the answer, our mark, a year-level band. Nothing is retained by the provider. |
| Australia (Melbourne) | Microsoft Azure, Australia Southeast | All storage and all application processing. |
10.1Why staff email is not in that table. Staff email is sent through Amazon SES in the Sydney region (ap-southeast-2): staff names, school email addresses and single-use account-recovery links are processed in Australia and do not leave it. That provider was chosen on residency, and it is the reason there is one overseas recipient in this notice rather than two.
Three things must be done before the first mail is sent through it — domain verification, leaving the SES sandbox, and a data processing agreement carrying a breach-notification obligation. All three are due before date golive — to be confirmed. Nothing is sent through SES until they are.
10.2Before the first model call. We take reasonable steps to ensure the overseas recipient handles the information consistently with the Australian Privacy Principles: a written agreement, the no-training term confirmed in writing, zero retention on the provider's side, and a documented check that all three are in force.
The AI, and the working-out image — say this to your school council
Read this one closely
The AI is designed to receive and process personal information. We answer that question "yes". A service that answers "no" and sends a photograph of a child's handwriting to a model is answering the wrong question.
11.1The working-out image is personal information the moment it reaches the model. A child writes their name on their work because that is what children are taught to do from Foundation. The structured part of the payload cannot carry an identifier — that is asserted by 28 automated checks and the build fails without them — but the image is pixels, and pixels are not covered by a field allow-list.
11.2Four controls address it.
- The canvas invites no name. No name field, no header region, no title page.
- A child-readable instruction on the canvas — "Just your maths — no names!" — and a matching note in the teacher's run instructions, defined in one place so the two apps cannot drift.
- A blocking scan before sending. All textual content is checked against the roster of that actual class run. A hit means the page is not sent: it is routed to teacher-only review and logged. The log records that it happened and at what stage, never the name.
- A scan of the model's own response. A model echoing a classmate's name has read one off the image, and the whole response is quarantined.
The honest residual
Control 4 fires after a call has been made. It is a detection, not a prevention. So we never say "the AI can never see a name". We say: these four controls, the no-training term, and that a child may nonetheless write identifying details on their page, which we detect and quarantine where we can.
That sentence is written into the source code in capitals and asserted by a test, because it is the sentence most likely to be softened by someone in a hurry.
11.3The AI never decides a mark. Correct or incorrect is decided by our code against an answer key. The model is told the verdict; it is never asked for one. The system marks the answer; the AI describes the method; the teacher decides.
11.4The AI never talks to a child. No chatbot, no tutor, no hints, no student-facing output of any kind.
Version history
- 1.0First issue. Signed by Jake Gatto, Founder and CEO, Privacy Officer.
Next review 18 August 2027, or on any change to what we collect, who we disclose it to, or where it is processed — whichever comes first.