Privacy Policy

We collect the minimum needed to run an exam-practice service for families, we never sell personal information, and a parent can delete a child's data at any time.

1. Who is responsible

S & D Company Pty Ltd (Sydney, Australia) operates Aptiora and is the entity responsible for your personal information. Privacy questions and requests: [email protected].

2. What we collect

On the registration page we ask a geolocation service (ipapi.co) for the country and state of your connection, purely to pre-fill the curriculum fields. Only your IP address is sent, and you can change the selection before saving.

3. Children under 13

• We do not knowingly let a child create an account. Child accounts are created only by a verified adult account holder (parent, guardian or authorised education partner) who gives consent at that moment.
• Child accounts hold no email address, phone number, payment information or free-text profile fields.
• Parents see all of a child's activity and can rename, reset the PIN for, or delete the child at any time from Account → Children. Deleting the child removes their personal information within 30 days (aggregate, de-identified statistics may be kept).
• We do not use children's data for marketing or profiling beyond adapting question difficulty inside the product.

4. How we use information

• To provide, secure and improve the Service, including generating and calibrating questions.
• To send transactional email: sign-in codes, receipts, child credentials, plan-expiry reminders, security alerts and (if a parent opts in) the weekly progress digest. You can turn off non-essential email in Account → Settings.
• To answer support requests and investigate reported questions.
• To understand, in aggregate, how the Service is used and which channels bring new families.

We do not sell personal information, do not share it with data brokers, and do not show third-party advertising inside Aptiora.

5. Who we share it with

Prompts sent to the AI provider contain curriculum topics and question text, never your name, email or a child's identity. Some providers are outside Australia; by using the Service you consent to those disclosures, and we take reasonable steps to ensure they handle data in line with the Australian Privacy Principles.

We may also disclose information where the law requires it, or to protect the safety of a child or the integrity of the Service.

6. Cookies

We use strictly necessary cookies only: your session, a CSRF token, your language choice, theme preference, a "trusted device" token if you ask us to remember a device, a referral/campaign cookie if you arrived via a link with one (30 days), and a random visitor id used to show every visitor a consistent pricing page. There are no advertising or cross-site tracking cookies, so there is no cookie banner to dismiss.

7. Security

• Passwords are hashed with Argon2id; one-time sign-in codes are hashed and expire in 10 minutes; child PINs are stored encrypted.
• All traffic is encrypted (HTTPS, HSTS). Databases are encrypted at rest and backed up daily for 7 days.
• Accounts lock after repeated failed sign-ins; we email you when a new device signs in.
• If a data breach is likely to cause serious harm we will notify affected users and the OAIC as the Notifiable Data Breaches scheme requires.

8. Retention

• Account and learning data: while the account is open, then deleted or de-identified within 30 days of closure.
• Payment records: 7 years, as Australian tax law requires.
• Server logs: up to 90 days.
• Sign-in codes and trusted-device tokens: until used or expired (10 minutes / 30 days).

9. Your rights

• Access and export — download everything we hold about you from Account → Privacy → Export my data.
• Correction — edit your details in Account → Details, or ask us.
• Deletion — delete your account (and all child accounts) from Account → Privacy, or email us.
• Marketing — we send no marketing email to children and you can opt out of digests in Account → Settings.
• Complaints — email [email protected]; we respond within 30 days. You may also contact the Office of the Australian Information Commissioner (oaic.gov.au).

If you are in the UK or EU, you have equivalent rights under the UK GDPR / GDPR, including portability and objection; the lawful bases we rely on are contract (providing the Service), consent (children's accounts, digests) and legitimate interests (security, analytics).

10. Changes

We will post changes here and, for material changes, email account holders at least 14 days before they take effect.