Privacy Policy

1. What personal information we collect

We collect the following categories of personal information:

All users: Full name, email address, phone number, date of birth, account login credentials, profile photo (optional), session history, review content, payment transaction records.

Tutors only: ATAR score, uploaded ATAR result document, Working With Children Check number and state, government-issued photo identity document, bank BSB and account number, university name and degree, school type attended.

Students and Parents only: Student year level, school type targeted, subjects of interest, parent or guardian name and relationship confirmation.

Automatically collected: IP address, browser type and version, device type, pages viewed, session durations, and general usage data collected via cookies and analytics tools.

2. How we collect personal information

We collect personal information directly from you when you register an account, complete your profile, submit a tutor application, make or receive a booking, or communicate with us.

We also collect information automatically through your use of the Platform via cookies, server logs, and analytics tools.

3. Why we collect and how we use personal information

We use your personal information for the following purposes:

• To create and manage your account
• To verify tutor credentials including ATAR and WWCC status
• To facilitate bookings and payments between Students and Tutors
• To generate and distribute Google Meet session links
• To process payments and tutor payouts via Stripe
• To send transactional emails including booking confirmations, session reminders, and payment notifications via Resend
• To investigate and resolve disputes
• To comply with our legal obligations including child protection laws
• To improve the Platform through analytics and user feedback

4. Legal bases for processing (Australian Privacy Act)

We rely on the following bases for processing personal information under the Privacy Act 1988 (Cth):

• Contract: Processing necessary to perform our contractual obligations to you
• Legal obligation: Processing required to comply with applicable laws including child protection and financial regulation
• Legitimate interests: Processing for our legitimate business interests where those interests are not overridden by your rights
• Consent: Where you have given explicit consent, including for optional communications

5. Disclosure of personal information

We do not sell your personal information to any third party.

We share personal information only with the following categories of recipients and only to the extent necessary:

• Stripe Inc.— payment processing. Stripe’s privacy policy is at stripe.com/au/privacy
• Resend — transactional email delivery
• Google Cloud Storage — secure encrypted document and file storage
• Google LLC— Google Meet session links and Google OAuth sign-in. Google’s privacy policy is at policies.google.com/privacy
• Legal authorities — where we are required by law, court order, or regulatory authority to disclose information, including but not limited to child protection agencies and NSW Police

We do not share your personal information with third parties for marketing purposes.

6. Children’s personal information

CramClass treats personal information about individuals under 18 with heightened care. We collect only the minimum information necessary to operate the Platform. We do not use children’s personal information for advertising or profiling purposes. Access to a student’s account information is restricted to the parent or guardian who created the account, and to CramClass staff for operational purposes.

Where a parent or guardian requests deletion of a student’s personal information, we will comply within thirty (30) days subject to any legal retention obligations.

7. Data storage and security

Your personal information is stored on a managed PostgreSQL database. Uploaded documents are stored by Google Cloud Storage using encrypted storage.

CramClass implements reasonable technical and organisational security measures including HTTPS encryption, access controls, and role-based data access restrictions to protect your personal information against unauthorised access, use, disclosure, or destruction.

No method of transmission or storage is completely secure. In the event of a data breach that is likely to result in serious harm, CramClass will comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) and notify affected individuals and the Office of the Australian Information Commissioner where required.

8. Cookies and analytics

CramClass uses session cookies solely for the purpose of maintaining your login session. We do not use third-party advertising cookies or tracking pixels. We may use aggregate, anonymised analytics data to understand how the Platform is used and to improve it.

You may disable cookies in your browser settings, but doing so may affect your ability to use the Platform.

9. Retention of personal information

We retain your personal information for as long as your account is active. Upon account closure, we will delete or de-identify your personal information within thirty (30) days, except where retention is required by law (for example, financial transaction records required to be retained under the Corporations Act 2001 (Cth) or taxation laws) or where retention is necessary to resolve outstanding disputes.

Tutor credential documents (ATAR, WWCC, identity) are deleted within thirty (30) days of account closure unless they are the subject of an ongoing investigation.

10. Your rights under the Australian Privacy Principles

Under the Privacy Act 1988 (Cth), you have the right to:

• Access your personal information that we hold about you
• Correct inaccurate or incomplete personal information
• Request deletion of your personal information, subject to legal retention requirements
• Complain about how we have handled your personal information

To exercise any of these rights, contact us at privacy@cramclass.com. We will respond within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

11. Cross-border disclosure

Some of our third-party service providers (including Stripe and UploadThing) process data outside Australia. Where we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles under APP 8.3.

12. Contact and complaints

For privacy enquiries or complaints: privacy@cramclass.com

For general enquiries: hello@cramclass.com

For legal matters: legal@cramclass.com

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least fourteen (14) days before the changes take effect. The current version will always be available at cramclass.com/privacy.