Privacy Policy
How Learnable handles personal information about schools, teachers, students and other users
Our approach to student information
Learnable collects only the information reasonably needed to provide and secure the service and record authorised learning activity. Student information is not sold or used for advertising, and primary production data and backups are stored in Australia.
Contents
1. About Learnable and this policy
2. School Licences and Individual Licences
3. Personal information we collect
4. How we collect personal information
5. Why we collect, hold, use and disclose information
6. Student account identifiers
7. If information is not provided
8. AI marking and automated decisions
9. Who we disclose information to
10. Data location and overseas processing
11. How we protect personal information
17. Cookies and technical analytics
1. About Learnable and this policy
Learnable Education Pty Ltd provides the Learnable Platform, an online learning platform designed for secondary school students in Years 7 to 12 and the teachers and schools that support their learning.
This policy explains how Learnable collects, holds, uses and discloses personal information through its website, platform, licences, support and other dealings.
Learnable handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where a government school uses Learnable, Learnable also complies with obligations applying under the relevant government agreement and applicable State or Territory law.
This policy is available free of charge without an account and is provided or linked before purchase or use. Schools should make it available to students and families before Student Accounts are created.
This policy should be read with the Platform Licence Terms, the Acceptable Use Policy and User Terms, the Student AI Marking Notice, and the public Subprocessor Register at https://subprocessors.learnable.education/.
2. School Licences and Individual Licences
School Licences. Where a school or organisation holds the licence, it decides which student information is entered into Learnable and the educational purposes for which Learnable is used. Learnable handles that information on the customer’s behalf under the Contract.
Individual Licences. An individual teacher must be accredited and have the relevant school’s authority before creating Student Accounts. Learnable may request evidence of that authority.
Students, parents and guardians should normally contact the school first about student information. Learnable will assist the school with access, correction, deletion and privacy questions.
3. Personal information we collect
Teachers and school staff
-
name, email address, school or organisation and role;
-
teacher registration or accreditation details where needed to confirm eligibility for an Individual Licence;
-
authentication, session, device and security information;
-
platform activity, including classes created and teaching content accessed or authored;
-
support correspondence and enquiries; and
-
billing and payment information for direct purchases. Complete card details are provided directly to the payment provider and do not enter Learnable’s systems.
Students
-
an account identifier, which may be a name or unique school-issued identifier;
-
an email address used for account access, which may be school-controlled or de-identified;
-
the school, Workspace, classes and year level associated with the account;
-
learning information, including answers, submitted work, marks, teacher feedback, progress and results; and
-
limited authentication, session, security and technical information, including IP address, browser or device details, internal user identifiers and error information where collected.
-
AI-marking records for eligible written responses, including the proposed result, teacher override, quality feedback and safety-notification records where generated.
A Student Account requires an account identifier and email address. The account identifier may be a name or a unique school-issued identifier.
Student learning information is personal information when it is linked or reasonably linkable to a student.
Website visitors, enquirers and billing contacts
-
contact details and information provided through an enquiry, demonstration or support form;
-
website and request information collected through essential cookies, security tools and server logs; and
-
billing contact, invoice and transaction information where a licence is purchased directly.
Sensitive information
Learnable does not seek health information or other sensitive information about students. Users should not enter sensitive or unrelated personal information into free-text learning responses.
If Learnable receives unsolicited sensitive information that it is not permitted or reasonably required to retain, it will delete or de-identify that information where lawful and practicable.
The safety-screening process may create a moderation flag indicating that a response may fall within a potentially harmful content category. Learnable uses that flag only to operate the student warning and teacher-notification workflow, support incident review and protect users. It is not used to diagnose, label or profile a student.
Learnable does not collect precise GPS or device-location data, although an IP address may indicate an approximate location.
4. How we collect personal information
-
directly from teachers, staff and other adults who create an account, purchase a licence, contact Learnable or submit a form;
-
from a school or teacher who creates or administers an account;
-
from students as they complete authorised learning activities;
-
automatically through account, security, server and technical logs; and
-
from service providers involved in authentication, payment, email delivery, hosting, security, support, AI marking and safety screening.
Student information is usually supplied by the school or teacher or created through the student’s authorised learning activity.
5. Why we collect, hold, use and disclose information
-
create, administer and secure accounts and Workspaces;
-
deliver lessons, questions and learning activities and record progress and results;
-
communicate service, account, security and billing information;
-
provide support to teachers and school staff;
-
monitor, troubleshoot, protect and improve the platform;
-
administer licences, payments and financial records; and
-
comply with law and enforce agreements.
-
provide optional rubric-based AI marking for eligible predefined Learnable questions, including personal-information filtering, safety screening, student warnings and teacher notifications, where the feature is enabled and the required notices and permissions have been provided;
Learnable may create aggregated and irreversibly de-identified information for internal analytics, quality assurance and platform improvement. Learnable does not attempt to re-identify it.
Learnable does not sell personal information, use Student Data for advertising, build advertising profiles of students, display third-party advertising in the platform or disclose identifiable customer content to another customer for that customer’s purposes.
6. Student account identifiers
A school or teacher may register a student using a name or unique school-issued identifier. Learnable does not require a student’s legal name where the identifier is sufficient to distinguish the account.
The school or teacher is responsible for any record linking a school-issued identifier to the student.
7. If information is not provided
Providing personal information is not mandatory. However, Learnable may be unable to create or secure an account, record learning progress, provide support, confirm eligibility for an Individual Licence or process a payment if the information reasonably required for that purpose is not provided.
8. AI marking and automated decisions
For some predefined Learnable questions, Learnable uses OpenAI through its application programming interface to suggest a rubric-based mark for a student’s written response.
Before the response is sent, Learnable applies automated safeguards designed to remove common direct identifiers and screen for potentially harmful content. A student whose response is flagged may revise or withdraw it. If the student chooses to proceed, the teacher is notified. These safeguards reduce risk but may not identify every issue.
For marking, OpenAI receives the predefined question, the filtered student response, the predefined rubric or marking criteria and the instructions needed to apply it. Learnable does not intentionally include the student’s name, email address, school, class, Workspace or Learnable account identifier.
The AI Marking Feature is not a chatbot or tutor. It returns a proposed rubric-based result. Students may provide thumbs-up or thumbs-down feedback, and teachers can review and override any AI-generated mark. A teacher-adjusted mark is authoritative within Learnable.
Learnable does not use AI marking or safety screening alone to make decisions that significantly affect progression, placement, discipline, subject selection, wellbeing intervention or access to educational opportunities.
Learnable does not opt student responses into provider model training. OpenAI processing locations and retention arrangements are stated in the public Subprocessor Register.
The school or authorised teacher must provide the Student AI Marking Notice and obtain any parent or guardian consent required by law, school policy, a government agreement or Learnable’s AI provider before the feature is used by a minor student. Consent may be withdrawn through the school.
Students should avoid entering unnecessary personal or sensitive information in a written response. The Student AI Marking Notice provides further information about the workflow, limitations, feedback and teacher review.
9. Who we disclose information to
-
the relevant school and its authorised teachers and staff, within the permissions of the school Workspace;
-
subprocessors that provide hosting, authentication, email delivery, payment processing, monitoring, security, support and other operational services;
-
professional advisers where reasonably necessary;
-
regulators, courts, law-enforcement bodies or other authorities where required or authorised by law; and
-
a purchaser or successor in connection with a business transfer, subject to appropriate privacy protections.
-
OpenAI, where AI marking is enabled, for the limited purposes of safety-screening a filtered response and applying a predefined rubric to an eligible written response;
Learnable requires subprocessors to use information only for the contracted purpose, maintain appropriate confidentiality and security, and comply with applicable contractual privacy obligations.
Public Subprocessor Register
The current register is available at https://subprocessors.learnable.education/. It identifies each provider, contact details, information and user types involved, processing purpose and lawful basis, and the countries in which information may be processed or stored.
Learnable updates the register when material provider arrangements change. School customers will be notified where required by the Contract or applicable law.
10. Data location and overseas processing
Learnable’s primary production data and backups are stored in Australia. Its principal databases, file storage and backups use Australian-hosted Google Cloud infrastructure, and live application compute is located in Sydney.
Learnable does not employ overseas personnel with access to production data.
Limited information may be processed outside Australia by providers used for authentication, transactional email, technical logs, feature-release management, payment processing, web security, embedded media and AI services.
The countries currently involved may include Australia, the United States, Ireland, countries in the European Union and global network locations. The current provider-by-provider position is stated in the Subprocessor Register.
A provider’s country of incorporation does not by itself determine where information is stored. Learnable assesses actual service configurations and access arrangements and takes reasonable steps required by applicable privacy law before disclosing personal information overseas.
AI marking is processed by OpenAI and may involve processing in the United States or other locations stated in the Subprocessor Register. Learnable’s Australian production-hosting commitment does not mean an AI request remains in Australia.
11. How we protect personal information
Learnable uses technical and organisational safeguards appropriate to the information and service. These include:
-
encryption of information in transit and at rest;
-
role-based access controls and individual accounts;
-
authentication and session controls;
-
security logging, monitoring and error reporting;
-
regular backups; and
-
contractual security obligations for subprocessors.
Access to production information is limited to authorised personnel who need it for their role.
No system is completely secure. Users must protect sign-in details and promptly notify Learnable or their school if they suspect unauthorised access.
12. Data breaches
Learnable maintains a data-breach response process. If Learnable becomes aware of unauthorised access to, disclosure of or loss of personal information, it will promptly assess, contain and remediate the incident.
Learnable will notify affected school customers as soon as reasonably practicable and will provide the information reasonably available at that time. Learnable will provide further updates as its investigation progresses, preserve relevant evidence and cooperate with the school’s assessment and notification obligations.
This includes the Commonwealth Notifiable Data Breaches scheme and, where applicable, NSW public-sector mandatory notification requirements. External notifications will be coordinated with the school unless law requires otherwise.
13. Retention and deletion
| Information | Retention position |
|---|---|
| Customer Data after a licence ends | Available for export for a reasonable period after the licence ends, normally 30 days, unless a different period is agreed or required by a government agreement. After that period, Customer Data is deleted or irreversibly de-identified from active systems under Learnable’s retention schedule, subject to lawful retention requirements. |
| Student responses, work and results | Retained as Customer Data while the licence is active and handled under the same post-termination export and deletion process. |
| Account and security information | Retained while reasonably required to administer and secure the account, investigate incidents and meet legal obligations, then deleted or de-identified. |
| Payment and financial records | Retained for the applicable statutory period, generally at least seven years. |
| Technical logs, backups and support records | Retained for documented operational, security and legal periods, then deleted or de-identified. Residual backup copies remain protected from ordinary use and are deleted or overwritten through Learnable’s normal backup-retention cycle. |
| AI marking and safety-screening information | AI-generated marks, teacher overrides, quality feedback and safety-notification records are retained as Customer Data or safety records under Learnable’s retention schedule. OpenAI’s current retention arrangements are stated in the Subprocessor Register. |
Learnable maintains an internal retention schedule and reviews retention when the service or provider arrangements change.
14. Access and correction
Individuals may request access to or correction of personal information Learnable holds about them.
Teachers and school staff can update some account details directly. Students, parents and guardians should normally contact the school first, and Learnable will assist the school.
Requests may also be sent to legal@learnable.education. Learnable will respond within a reasonable period, ordinarily within 30 days, may verify identity and will provide written reasons if access or correction is refused.
15. Privacy complaints
Privacy complaints may be sent to the Privacy Officer at legal@learnable.education.
Learnable will acknowledge and investigate privacy complaints and will ordinarily provide a response within 30 days. If more time is reasonably required, Learnable will explain why.
If the complainant is not satisfied, they may contact the Office of the Australian Information Commissioner. A complaint concerning a NSW public school may also be raised through the school and, where applicable, the Information and Privacy Commission NSW.
16. Protections for students
Learnable is designed for secondary students in Years 7 to 12, most of whom are under 18. Student Accounts must be created or authorised by a school or authorised teacher.
-
collection is limited to information reasonably required for learning, account administration, security and support;
-
student information is not sold, used for advertising or used to send marketing communications;
-
the platform does not display third-party advertising;
-
students cannot normally discover or access users or information belonging to another school;
-
solely automated high-impact educational decisions are not used; and
-
students can raise privacy concerns with a teacher, parent, guardian or Learnable.
17. Cookies and technical analytics
Learnable uses essential cookies and similar technologies for sign-in, security, session management, preferences and platform operation.
Infrastructure and security providers may process IP address, browser and request information to protect the service and measure aggregate performance.
Learnable does not use third-party advertising or behavioural-targeting cookies in the Learnable Platform and does not use student activity for advertising.
Where a teacher embeds third-party video or media in a lesson, the student’s browser may contact that provider directly. The current providers and processing locations are described in the Subprocessor Register.
18. Marketing communications
Learnable may send product information to adult customers and people who have asked to receive it, in accordance with the Spam Act 2003 (Cth). Marketing messages include an unsubscribe mechanism.
Service, billing and security notices are not marketing. Learnable does not send marketing communications to Student Accounts.
19. Changes to this policy
Learnable reviews this policy at least annually and whenever a material change occurs. The version and last-updated date appear at the beginning of the policy.
Learnable will notify school and individual teacher customers when it makes a material change to this policy. Before beginning a materially new use of Student Data, including through AI, Learnable will update the relevant notice and obtain any agreement or consent required by law or the Contract.
20. Contact us
| Privacy Officer | Learnable Education Pty Ltd Level 12, 64 York Street, Sydney NSW 2000, Australia |
|---|---|
| Privacy and legal email | legal@learnable.education |
| General school enquiries | schools@learnable.education |
| Subprocessor Register | https://subprocessors.learnable.education/ |