Privacy Policy for Ember Education Pty Ltd

1. Introduction - who we are and what this policy covers

EMBER EDUCATION PTY LTD (“Ember”, “we”, “us” or “our”) provides Lantern, an AI-assisted report-writing platform for schools.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains:

• what personal information we collect and hold;
• how we collect, use and disclose that information;
• who we share it with;
• whether information is disclosed overseas;
• how we protect and retain information;
• how individuals may access and correct their information; and
• how privacy complaints may be made.

Lantern is designed for use by teachers and other school staff. Students and parents do not access Lantern directly. We generally receive student information from schools, which remain responsible for their direct relationships with students and parents.

This policy applies to personal information handled through Lantern and through our website, sales, support and business activities.

2. Definitions

For the purposes of this Policy:

Personal information means information (or an opinion) about a person, which could reasonably identify them.

Sensitive information is a category of personal information that can include race or ethnicity, political opinions or membership, religious or philosophical beliefs, professional or trade association or union membership, sexual preferences or practices, criminal records, health information or genetic/biometric information such as fingerprints. If applicable, Ember has additional obligations for the management of sensitive information (including health information).

3. The kinds of personal information we collect and hold

Student information

The information we process may include:

• student names and year levels;
• teacher observations, notes and comments about students;
• school report-writing guidelines and templates;
• report content generated through Lantern; and
• edited and final report content retained by the school within the platform.

Some student information may constitute sensitive information under the Privacy Act, including information relating to health, disability, wellbeing or behavioural matters.

Teacher and staff information

We may collect:

• names;
• work email addresses;
• job titles and roles;
• login and authentication information;
• usage information relating to Lantern; and
• teacher writing-style profiles used to assist report drafting.

School information

We collect information relating to school accounts, administrators and authorised users.

Website, enquiry and support information

Where a person visits our website, requests a demonstration or contacts us, we may collect contact details and information provided in the course of those interactions.

We may also collect limited technical information about how our website is used, including through cookies or similar technologies. This information may include IP addresses, browser information, device information and website usage data. We may use this information to operate, maintain and improve our website and related services.

Billing information

We may collect billing and account information necessary to manage subscriptions and payments. Payment processing may be provided by third-party payment providers.

Technical information

We collect technical and security information such as account identifiers, device information and IP addresses to operate, maintain and secure the platform.

4. How we collect personal information

We collect personal information directly from:

• schools;
• teachers and other authorised users;
• individuals who contact us; and
• use of our website and services.

In the case of students, personal information is generally provided to us by the relevant school.

Where Lantern generates report content based on information entered by teachers, that generated content may itself contain personal information.

We collect only the information reasonably necessary to provide and support Lantern and related services.

5. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information to:

• provide Lantern and its report-writing functionality;
• generate and edit draft student reports;
• provide reporting and analysis tools requested by schools;
• manage user accounts and authentication;
• provide customer support;
• maintain, support and secure the platform, and improve its functionality;
• comply with legal obligations; and
• otherwise operate our business.

We do not use student information to train third-party AI models.

We will only use or disclose personal information for the purpose for which it was collected, a related purpose that would reasonably be expected, or where otherwise permitted or required by law.

If we receive personal information that is unsolicited or not reasonably necessary, we will destroy or de-identify it where appropriate.

6. Consent

Schools are responsible for their relationships with students and parents and, under our arrangements with schools, are responsible for providing any required privacy notices and obtaining any required consents in relation to student information provided to Lantern.

Where consent is relied upon, schools should ensure that students and parents are provided with clear information regarding:

• the use of Lantern;
• the role of AI in generating draft report content;
• the categories of information processed; and
• any relevant third-party service providers.

Requests to withdraw consent relating to student information should generally be directed to the relevant school.

7. Who we share information with

We do not sell personal information.

We may disclose personal information to third-party service providers that assist us to operate Lantern and our business.

We take reasonable steps to ensure that our service providers handle personal information appropriately and in accordance with applicable privacy requirements.

A teacher always reviews and approves AI-generated report content before it is used.

8. Overseas disclosures

Some of our service providers may process or access information outside Australia.

For example:

• user authentication services may involve overseas processing of teacher login information;
• payment providers may process billing information overseas; and
• certain support or administrative functions of service providers may be performed from outside Australia.

Where personal information is disclosed overseas, we take reasonable steps to ensure that it is handled consistently with the Australian Privacy Principles.

At the time of publication, student report content is intended to be hosted and processed within Australia, subject to the operation of our service-provider arrangements.

9. How we keep information secure

We use a range of technical and organisational measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

These measures include:

• encryption of information in transit and at rest;
• role-based access controls;
• secure cloud hosting;
• monitoring and logging of access and activity;
• staff access restrictions; and
• incident response procedures.

We also maintain governance and operational measures designed to support compliance with privacy laws, including privacy management processes, staff responsibilities and incident response procedures.

Where we become aware of an eligible data breach, we will comply with our obligations under the Notifiable Data Breaches scheme.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required by law.

Where a school ceases using Lantern, we will provide an opportunity to retrieve relevant data before deleting it in accordance with our retention practices.

Information may remain in secure backup systems for a limited period before being permanently deleted.

Schools remain responsible for retaining official student records and final reports in accordance with any applicable legal or operational record-keeping requirements.

11. Access and correction

Individuals may request access to personal information we hold about them and may request correction of inaccurate, incomplete or out-of-date information.

Because student information is generally handled on behalf of schools, requests relating to student information should usually be made through the relevant school.

We will respond to requests in accordance with the Privacy Act.

12. Privacy complaints

If you have a privacy concern or complaint, please contact us using the details below.

We will investigate complaints and respond within a reasonable period.

If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

13. Direct marketing

We may send information about Lantern and related services to school staff and other contacts who have engaged with us.

Recipients may opt out of receiving marketing communications at any time.

We do not use student information for direct marketing purposes.

14. Artificial intelligence and automated decision-making

Lantern uses AI-assisted tools to generate draft report content. As with any AI-assisted technology, generated content may contain inaccuracies or may not fully reflect the intended context. For that reason, teachers remain responsible for reviewing, editing and approving all report content before it is finalised or communicated.

Lantern does not independently assess students or make educational decisions about them. Teachers remain responsible for reviewing, editing and approving all report content before it is finalised or communicated.

Nothing is automatically published to students or parents.

We will continue to monitor developments relating to automated decision-making obligations under the Privacy Act and update this policy where required.

15. Contact us

• Privacy Officer: [PLACEHOLDER: Privacy Officer name]
• Email: privacy@embereducation.com.au
• Postal Address: [PLACEHOLDER: registered postal address]
• ABN: [PLACEHOLDER: 11-digit ABN]
• ACN: 693 296 409

If you have any privacy questions, requests or complaints, please contact us using the details above.