This procedure covers how a school, a staff member, a parent or anyone else raises a fault, a security concern, a privacy matter or a child safety complaint with Reason Education — who owns each channel, how fast we answer, and what to do if we get it wrong.
There is no contact channel in the product today. The only user-facing string is “contact ReasonEducation”, with no address behind it. A school reading that has no way to act on it. This document defines the four channels, the named owner of each, and the timeframes.
The four channels
| Channel | What it is for | Where it goes | Owner | Alternate |
|---|---|---|---|---|
| Technical and operational faults | Something is broken, blocked, or not behaving as it should — a fault report or an operational question. | policies@reasoneducation.com.au | Jacob Clemens, Founder and Security Officer | Liam Nuttman-Steet, Founder |
| Security incidents and concerns | Anything that may be a breach, a weakness or unauthorised access — including a good-faith weakness report. | policies@reasoneducation.com.au, subject line beginning SECURITY | Jacob Clemens, Security Officer | Jake Gatto, Privacy Officer |
| Privacy complaints and requests | Access, correction, export, a school’s deletion instruction, or a complaint about how we handled personal information. See Privacy Requests. | policies@reasoneducation.com.au | Jake Gatto, Privacy Officer | Jacob Clemens |
| Child safety complaints | Any concern about the safety of a child in connection with the service or a person we engage. Handled under Child Safety and Reportable Conduct. | policies@reasoneducation.com.au | Jake Gatto, Child Safety Contact | Jacob Clemens — and see section 5 |
1.1There is no phone line. Every route above is email. Anything urgent in the security or child safety categories should carry URGENT at the start of the subject line. If a child may be in immediate danger, call 000 — that is the route, not us.
1.2Security and faults share an inbox on purpose. A school reporting “something looks wrong” should not have to decide whether it is a bug or a breach — that is our judgement to make, not theirs. Anything in that inbox that could be a security matter is routed to the Security Officer within the hour and treated as security until shown otherwise.
1.3Privacy and child safety have their own addresses. Their contents are more sensitive than support traffic and are held in separate registers.
1.4Anyone may use these channels. A school, a teacher, a principal, a parent, a student’s family member, a contractor, or a member of the public. We do not require a person to be a customer, and we do not require a complaint in a particular form.
1.5These are the same four addresses used across the pack. They appear in the Privacy Policy, the Collection Notice, the Terms of Service and our incident response plan. This is the document that says who owns each one and how fast it is answered.
The student app carries no contact channel
The student app carries no contact channel and will not. A child’s route to an adult is their teacher, in the room. That is a design decision, not an omission.
Timeframes
| Category | Acknowledged | Resolved, or a plan given |
|---|---|---|
| Fault — service unusable for a school, or a live assessment blocked | 4 business hours | Same business day, or a workaround and a stated fix date |
| Fault — significant but with a workaround | 1 business day | 5 business days |
| Fault — minor or cosmetic | 1 business day | Next release, with the release named |
| Security incident or concern | Same business day | Per our incident response plan |
| Privacy complaint | 2 business days | 30 calendar days |
| Privacy request — access, correction, export, a school’s deletion instruction | 2 business days | 30 calendar days |
| Child safety complaint | Same day | Immediate action per Child Safety and Reportable Conduct; written outcome within 30 days |
2.1These are the same commitments as our incident response plan. Acknowledgement within one business day, and the same day for a child safety concern — stated here per category rather than as a single number, and tighter where the category warrants it.
2.2Acknowledgement means a person has read it and said so, naming who now owns it. An automated receipt is not an acknowledgement.
2.3A missed date is announced before it passes. If we are going to miss a resolution date, we say so before it passes, with a new date and the reason. A missed date that is announced is a delay. A missed date that is discovered is a broken promise.
What happens in each channel
3.1 Technical and operational faults
Logged in the support register with the date received, the school, what was reported and what was affected. Triaged against the severity table in section 2.
A fault that turns out to be a data or security matter is reclassified and moves to 3.2 — and the school is told it has been reclassified.
Closed with what was done, and either a code change with a test or a recorded reason no change was warranted. Where a fault affected a child’s record, the correction is made and the school is told which records changed.
3.2 Security incidents and concerns
Acknowledged the same business day, then handled under our incident response plan, which governs classification, severity, containment, evidence, notification and post-incident review. This document does not repeat it — one procedure, one place. Two things belong here rather than there.
The Privacy Officer is informed the same day where personal information may be involved. The Security Officer does not decide alone whether a matter involving student data is serious. Where the matter touches the AI, the AI Accountability Owner may halt a release or stop model calls while it is open.
Good-faith weakness reports are welcome
We will not pursue a person who reports a genuine weakness, does not access, alter or retain other people’s data while establishing it, and gives us reasonable time to fix it. Acknowledged the same business day and credited if they want to be.
3.3 Privacy complaints and requests
Owned by the Privacy Officer. Recorded in the privacy register with the date received, who raised it, what was sought and what was done. See Privacy Requests for who may ask and what they get, and the Privacy Policy for what we hold.
- A school’s request for access, correction or export of its own students’ records is actioned within 30 days.
- A parent or student request is acknowledged within 2 business days and referred to their school, because the school is the data controller for its students’ information and the relationship with the family is the school’s. We tell the person who we have referred it to and when. We do not promise deletion to a parent, and we do not tell a school whether it needs parental consent — both are the school’s to determine.
- A complaint about our own handling of personal information is investigated by the Privacy Officer and answered in writing within 30 days with what we found and what changed.
Where a privacy matter is also a data breach, our incident response plan governs the breach response and this procedure governs the complainant’s answer. Both run; neither waits for the other.
3.4 Child safety complaints
Acknowledged the same day by the Child Safety Contact, and handled under Child Safety and Reportable Conduct. In summary, and without repeating that policy:
If a child may be in immediate danger
Call 000 — before anything here.
- Where the complaint concerns a person Reason Education engages, their access is suspended immediately, before any investigation begins.
- Victoria Police and the Commission for Children and Young People are contacted where the policy requires it, and the affected school is told promptly.
- A complaint about a school’s own staff is referred to the school and, where the conduct alleged may be criminal, reported to Victoria Police by us as well. We do not treat “we told the school” as the end of our obligation.
- Every step is entered in the Child Safety Register with a date and a time.
A person may raise a child safety complaint anonymously. We act on it the same way; we simply cannot report back.
Escalation
4.1If we do not acknowledge in time. Escalate to the alternate named in section 1.
If the alternate does not respond within one further business day, escalate to Liam Nuttman-Steet by email to policies@reasoneducation.com.au, naming him in the subject line. In a company of three there is no third line — which is exactly why the alternate for every category is a different person from the owner.
4.2If you are not satisfied with the outcome. Ask in writing for a review by the other officer, who is not the person who made the decision. Answered within 10 business days.
Where the review concerns the AI, the AI Accountability Owner holds a documented right to halt a release, halt a model or prompt version change, or stop model calls. That right runs over AI development and product changes authored by Liam Nuttman-Steet — so the founder who built the change is not the person who decides whether it is halted, and a review is a real review with a real power behind it.
4.3If you are still not satisfied, you can go outside us. We would rather say so than have you find out elsewhere.
- Privacy — the Office of the Australian Information Commissioner (OAIC), and for a Victorian government school, the Office of the Victorian Information Commissioner (OVIC).
- Child safety — the Commission for Children and Young People (Victoria), and Victoria Police. For an immediate risk to a child, 000.
- Online safety — the eSafety Commissioner.
- A school’s own complaints process, which for a government school runs through the Department of Education.
Complaining to a privacy regulator
You may go to either regulator at any time, without coming to us first. We will not ask a person to exhaust our process before going to a regulator, and we will not treat having done so as a breach of any agreement.
OAIC — Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
OVIC — Office of the Victorian Information Commissioner, for a Victorian government school, ovic.vic.gov.au.
When the complaint is about one of us
5.1A person cannot receive a complaint about themselves. The rule from the child safety policy applies to every channel.
| The complaint concerns | It goes to |
|---|---|
| Jacob Clemens or Liam Nuttman-Steet | Jake Gatto, CEO and Privacy Officer |
| Jake Gatto | Jacob Clemens, CTO and Security Officer |
| Two or more founders | Liam Nuttman-Steet where uninvolved; otherwise the relevant external body in section 4, directly. We are three people, and the honest answer to “who reviews it when it is two of us” is: not us. |
Records
6.1One register per channel. Support, security (held with the incident records), privacy, and child safety. Each entry is dated: received, acknowledged, owner, what was sought, what was done, date closed, and the change made or the reason none was.
6.2Reviewed by both officers quarterly. Alongside the audit log sample and the AI quarantine counts. A quarter with no entries is recorded as empty and signed. A register nobody dates cannot be told apart from a register nobody kept.
Related documents
- Child Safety and Reportable Conduct — child safety, Working with Children checks, crisis response.
- Acceptable Use Policy — what schools and staff may do, and breach handling.
- Safety by Design — the design controls behind these commitments.
- Privacy Requests — access, correction, deletion and export in detail.
Contact details
| Entity | Reason Education |
|---|---|
| Faults and support | policies@reasoneducation.com.au — owned by Jacob Clemens, Founder and Security Officer |
| Security | policies@reasoneducation.com.au, subject line beginning SECURITY — owned by Jacob Clemens, Security Officer |
| Privacy | policies@reasoneducation.com.au — owned by Jake Gatto, Privacy Officer |
| Child safety | policies@reasoneducation.com.au — owned by Jake Gatto, Child Safety Contact. See Child Safety and Reportable Conduct. |
| Anything urgent | policies@reasoneducation.com.au with URGENT at the start of the subject line. There is no phone line and no out-of-hours cover — see clause 1.1. |
| A child in immediate danger | Call 000 first, before contacting us. |
Version history
- 1.0First issue.
Next review 18 August 2027, or on any change to the officer roles.
Signed by Jake Gatto, Founder and CEO, Privacy Officer — 18 August 2026. Countersigned by Jacob Clemens, Founder and CTO, Security Officer — 18 August 2026.