Effective 1 May 2026 · Edsthetic · ABN 70 939 441 240
Edsthetic is an Australian EdTech company based in Torquay, Victoria. We build Writeiq™ and Allocateiq™ for Australian schools. We take the privacy of student and staff data seriously and handle it under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1. What information we collect
We collect the minimum information needed to operate our products. This varies by product:
Product
Information collected
Who provides it
Writeiq™
Student first name, year level, class, writing submissions, assessment results
School staff
Writeiq™
Teacher name, email (for SSO accounts)
School staff
Allocateiq™
Specialist name, phone, email, hours, availability, training programs
School coordinator
Allocateiq™
Student name, year level, NCCD level, class list
School coordinator
Both products
School name, contact name, email (licence contact)
School
We do not collect student surnames, addresses, dates of birth, or any biometric data unless explicitly provided by the school.
2. How we use this information
To provide the Writeiq and Allocateiq services to your school
To store assessment and timetabling data so it is available across sessions
To provide technical support when you contact us
To send service-related notices (not marketing)
We do not use student data for:
Training any machine learning or artificial intelligence model
Advertising or marketing to students, parents, or schools
Profiling or selling to third parties
Any purpose unrelated to operating the product your school has licensed
3. Where your data is stored
School data is stored in Supabase on Amazon Web Services, Sydney region (ap-southeast-2). This includes student records, writing submissions, staff credentials, and NCCD data.
When a student’s typed writing is submitted for criterion-level analysis, the text of the writing piece is processed by Claude models on Amazon Bedrock within the Australian boundary (AWS Sydney / Melbourne) to generate IWAF-aligned feedback suggestions and criterion-level analysis for teacher review. No student names, class names, or school identifiers are included in these API calls. When handwritten or printed writing is scanned for transcription using the Writeiq Vision add-on, an image of the scanned page is sent to the same Australian-region service. Because each page needs to be matched back to the correct student, whatever the student has written at the top of the page (typically a name, or a student ID if your school prefers) is read and returned with the transcription; Vision is optional and can be turned off at the school level. The applicable terms prohibit the use of submitted data for model training. Writing text and scan images are processed transiently and are not retained beyond the request.
Supabase edge functions (licence validation, email delivery) run on a globally-distributed compute network and may be processed in the nearest available region.
Australian processing. As of 25 July 2026, model processing is also Australian. Writing analysis, scan transcription and lesson generation run on Amazon Bedrock within the Australian boundary (AWS Sydney ap-southeast-2 and Melbourne ap-southeast-4), on AWS-managed infrastructure under the AWS Data Processing Addendum, using the same Claude models as before. Data is processed transiently, is not retained, and is not used to train models. Storage remains AWS Sydney. This is enforced in our code and in our AWS permissions rather than by configuration alone: a request that cannot be served within Australia fails and is retried onshore. There is no automatic fallback to an overseas region.
Edsthetic uses the following subprocessors. Each operates under a Data Processing Agreement or equivalent contractual obligation:
Amazon Web Services - Amazon Bedrock (Sydney / Melbourne, Australia) - criterion-level writing analysis and IWAF-aligned feedback suggestions for teacher review, scan transcription (Vision add-on), and lesson plan generation. Claude models operated by AWS inside the Australian boundary; data processed transiently, not retained, and not used to train models. Typed-submission path contains no student or school identifiers; Vision path includes the image of the scanned page, which is matched back to the correct student using the name (or student ID, if the school prefers) written at the top. Before 25 July 2026 this processing was performed by Anthropic in the United States.
Microsoft - Azure AI Document Intelligence (Australia East) - handwriting layout extraction for the optional Vision feature. Reads a scanned page and returns the lines, words, confidence scores and their positions so a teacher can check the transcript against the original before marking; it does not produce scores or feedback. Only used for scanned work, never for typed submissions. The page image includes whatever the student wrote at the top. Processed in Azure's Australia East region, transiently, and not used to train models; residency is enforced in code, so a configuration that does not attest Australia East disables the feature rather than sending page images elsewhere.
Netlify (United States, CDN global) - application hosting; no personal data stored
PostHog (EU region) - anonymous product analytics; captures only page views and navigation events. No student data, submission content, names, licence keys, or PINs.
Sentry (United States) - error monitoring and crash reporting; 90-day retention. PIN hashes, licence keys, authorisation headers, and student-name fields are scrubbed before transmission. No submission content is ever sent.
Amazon Web Services - SES (Sydney, Australia) - transactional email delivery (invitations, notifications, report delivery); recipient address and message body only, no submission content.
Cloudflare (global edge, Sydney POP) - edge protection: web application firewall, DDoS mitigation, TLS termination; no stored school data.
Stripe (United States) - only when billing is active - payment processing for paid deployments; billing details only, no student, staff, or school content.
Full details of each subprocessor, including the specific data processed and protective controls applied, are set out on our Security page.
Parent writing reports are generated in the teacher's browser and sent directly from their own school email client. No parent contact details or report content passes through Edsthetic servers.
Supabase implements row-level security at the database layer.
Each school's data is isolated from all other schools by design. No school can access another school's data.
4. Who can access your data
Who
What access
Why
Your school's licensed users
Full access to your school's data only
Operating the product
Edsthetic
Access to support and diagnose issues
Technical support
Supabase (infrastructure)
Encrypted storage only
Data hosting
No one else
No access
Not shared
We do not share your data with any government agency, education authority, parent body, or third-party service unless required by law.
5. Data retention
Data is retained for the duration of your active licence.
After a licence expires, data is retained for 90 days before permanent deletion.
You can request deletion at any time by emailing privacy@edsthetic.com.au. On-demand deletion requests are completed within 14 calendar days (contract-termination deletion is within 30 days unless a shorter period is agreed in writing).
6. Student data
Many of our users are minors. We apply additional care to student data:
Students interact with Writeiq through Class Links, a Student Access Code/PIN, or optional Student SSO, not a personal account.
Student submissions are linked to first name and year level only, unless the school provides more identifying information.
Student data is never used for advertising, profiling, or any commercial purpose.
Parents or guardians of students under 18 may request to view or delete their child's data by contacting the school, which will then contact us.
7. Cookies and tracking
Our websites (edsthetic.com.au and writeiq.com.au) use two operational services: PostHog (product analytics, anonymised page views and clicks) and Sentry (error reporting). Neither service is used to build advertising profiles, and no data is sold or shared with advertisers. Both are retained only for the purpose of improving the product.
No third-party advertising or marketing trackers are used anywhere on this site or inside the web applications.
Our web applications (Writeiq, Allocateiq) use browser sessionStorage and localStorage to maintain your login session. This data stays on your device and is never transmitted to third parties.
8. Security
We implement the following security controls:
Row-level security enforced at the database layer on every table
HTTPS enforced on all pages and API calls; HSTS preloaded
Staff email/password authentication is handled by Supabase Auth (Edsthetic never stores or sees a staff password). TOTP recovery codes are hashed with PBKDF2-SHA-256 (600,000 iterations, per-code salt); TOTP secrets are encrypted with AES-GCM
Server-side PIN verification in dedicated edge functions - stored hashes are never returned to the browser
Brute-force protection on login (5 failed attempts, 5-minute lockout per account)
Data stored only in AWS Sydney (ap-southeast-2)
9. Your rights under the Privacy Act 1988
You have the right to:
Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your information
Complain if you believe we have breached the Australian Privacy Principles
If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
10. Changes to this policy
We will notify active licence holders by email if we make material changes to this policy. The effective date at the top of this page will be updated with each revision.