Privacy Policy

Effective date: 25 July 2026 · Last updated: 6 October 2026

This Privacy Policy explains how Acreate (ABN 48 580 697 259, "we", "us", "our") collects, uses, discloses and protects personal information when you use acreate.com.au and app.acreate.com.au (together, the "Service").

We handle personal information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). This policy applies regardless of whether the Privacy Act formally applies to our business at a given point in time — see "A note on the Privacy Act" below.

1. Scope

This policy covers information we collect through the Service: our marketing site, the Acreate web application, our AI worksheet-generation features, and our customer support channels. It does not cover third-party websites we link to, or the separate privacy practices of the service providers listed in section 5, which are governed by their own privacy policies.

2. Information we collect

We do not ask for sensitive information (such as health, disability, racial or ethnic information). Please do not include it in student notes, lesson notes, worksheet topics, custom instructions, or uploaded files unless it is necessary and you have the authority to provide it.

A note on uploaded files and third-party information

If you upload a worksheet, past exam, or student work sample to be cloned into a new worksheet, please remove or avoid including any other person's personal information (for example, a student's full name or handwriting on a submitted worksheet) before uploading, unless you have the authority to share it with us for this purpose. Uploaded reference files are sent to OpenAI to describe the worksheet's structure; see sections 5 and 8 for AI processing and provider retention.

3. How we collect information

• Directly from you — when you create an account, subscribe to a paid plan, generate or upload a worksheet, create a class, add a student or lesson record, upload a logo, or contact support.
• Automatically — through cookies and similar technologies when you use the Service. See our Cookie Policy for details and how to manage your preferences.
• From service providers — our authentication provider (Clerk) and payment provider (Stripe) pass us account and billing status information needed to run the Service.

4. Why we collect, hold, use and disclose personal information

We collect and use personal information to:

• create and administer your account and authenticate you;
• generate worksheets and related content using our AI provider based on your inputs;
• organise student learning records, track lessons and progress, and prepare recommendations and parent updates;
• process payments, manage subscriptions, trials and invoices, and calculate applicable tax;
• provide customer support and respond to enquiries;
• maintain, secure, debug and improve the Service, including through error monitoring and product analytics;
• communicate with you about your account, billing and usage (for example trial reminders, failed payments and alerts when you approach your worksheet allowance), and send product updates and tips. You can unsubscribe from usage alerts and product updates at any time using the link in each email or in Settings → Notifications; emails about your subscription and billing are always sent;
• comply with our legal and tax obligations; and
• enforce our Terms of Service and Acceptable Use Policy.

We do not sell personal information, and we do not use your worksheet content to train AI models on behalf of third parties (see section 8).

5. Who we share information with

We share personal information only with the service providers who help us run Acreate, and only to the extent needed for the purposes above:

We may also disclose personal information if required by law, to protect our rights or the safety of others, or in connection with a business transfer (such as a merger or acquisition), in which case we will take reasonable steps to ensure the recipient handles it consistently with this policy.

6. Overseas disclosure

Several of our service providers (Clerk, Stripe, DeepInfra, OpenAI, PostHog, Resend, Vercel, and Supabase, depending on its configured region) store or process data on servers located outside Australia, including in the United States. Before disclosing personal information overseas, we take reasonable steps to ensure recipients handle it consistently with the Australian Privacy Principles, including by relying on providers' published data-processing terms and security certifications. By using the Service, you acknowledge that your personal information may be handled outside Australia and may not always receive the same level of protection as under Australian law.

7. Data retention

We retain personal information for as long as your account is active, and for a reasonable period afterwards to comply with legal, tax and accounting obligations, resolve disputes, and enforce our agreements. When you delete your account (see section 11), we delete data associated with that account from our active systems, including its worksheets, classes, student and lesson records, uploaded logo and usage records, and remove your address from our email contact list, subject to records that must be retained by law (for example, transaction records Stripe retains for tax purposes). Deleting a personal account does not itself delete an organisation that the account holder belongs to or owns. When a Clerk organisation is deleted, we cancel its subscription and remove its organisation data from our active database and its uploaded logo from file storage, including shared worksheets, classes, student records and related lesson records. Copies in backups and records held by service providers may follow their own retention periods.

8. Artificial intelligence and automated processing

Acreate uses DeepInfra to run a DeepSeek model for production worksheet generation. We also use OpenAI to read uploaded reference files, generate certain teaching plans, and draft some Tutor Pro recommendations and parent updates. These features may process the worksheet inputs, student learning context and lesson evidence described in section 5. Lesson notes and student notes are included in some AI requests only when the student profile's AI notes option is enabled; structured lesson evidence, including scores and understanding ratings, may still be sent for those features. DeepInfra describes its inference service as zero retention; OpenAI says API inputs and outputs are not used for model training by default, but may retain data under its API data controls. We do not promise that either provider deletes every request immediately after processing. Generated content may contain errors and should be reviewed by a qualified educator before use with students. AI output supports educator decisions; it does not make decisions about access to the Service or legal or similarly significant decisions about a person.

9. Cookies and analytics

We use essential cookies to keep you signed in and to keep the Service secure, and — only if you accept them — browser analytics cookies to understand visits and interactions. Separately, when you are signed in, our servers record limited first-party lifecycle events such as account creation, subscription status changes, and successful worksheet or teaching-plan creation. These server events do not set analytics cookies and are used to operate, measure and improve the Service. They contain configuration metadata (for example subject, year level and question count), but never worksheet prompts, generated worksheet content, uploaded files or raw error messages. See our Cookie Policy for details.

10. Security

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include access controls, encryption in transit, and Supabase's encryption of stored data at the infrastructure level. Student and parent fields are stored as ordinary database columns; we do not currently apply separate application-level or per-field encryption to them. Student tables are accessible through authorised server-side functions, with access limited according to account and organisation roles. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Access, correction and account deletion

You can access and update most of your account information at any time from Settings → Account. You can delete individual worksheets, classes, student profiles and lesson records in the app. To delete your entire account and the personal information associated with it, use the account-deletion option in Settings → Account, or contact us at support@acreate.com.au. For deletion of an organisation and its shared data, contact us at that address or use your organisation-management controls where available. We will action deletion requests as soon as reasonably practicable, subject to the retention exceptions in section 7.

You may also request access to, or correction of, personal information we hold about you by contacting us using the details in section 15. We will respond within a reasonable timeframe and will only refuse a request in the circumstances permitted by the Privacy Act, in which case we will explain why.

12. Children and young people

The Service is intended for use by educators, tutors and parents, and account holders must be at least 16 years old. We do not knowingly collect information directly from children under 16, but account holders can create records about students, including children. Educators, tutors and parents who add a student record or upload a student's work must have authority to provide that information and should include only what is needed for the learning purpose. If you believe a person under 16 has created an account or student information has been added without proper authority, please contact us so we can address it.

13. Complaints

If you have a concern about how we've handled your personal information, please contact us first using the details in section 15 so we can try to resolve it. If you're not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or for legal or operational reasons. We will update the "Last updated" date above and, for material changes, provide additional notice (such as an in-app notice or email).

15. Contact us

For any questions about this policy or how we handle your personal information, contact:

Acreate support@acreate.com.au