Duxie Privacy Policy

1. Who this policy covers

• Parents and guardians who create and manage an account and the subscription.
• Students (the children) whose study activity is the core of the service.
• Teachers who use Duxie in connection with a school.

A parent or guardian sets up and approves a student’s account. Students under 18 cannot activate an account without a parent or guardian.

2. What personal information we collect

We collect only what we need to run the service.

From parents/guardians:

• Name and email address.
• Subscription and billing status. (Card details are entered directly with our payment processor, Stripe — Duxie never sees or stores your full card number.)

From students (entered or approved by the parent, or by the student once their account is claimed):

• First name and a display alias, year level, and the school name.
• Study content the student creates or uploads: uploaded notes and past exam papers, flashcards, essays and drafts, practice answers and working, and messages to the in-app AI tutor (“Dux”).
• Learning analytics generated by using the service: topic mastery, study session history, progress, and detected misconceptions.

From teachers:

• Name, a school email address, and the classes they manage.

Automatically:

• Basic technical and security logs (for example, sign-in events and security events) needed to keep accounts safe and the service working.

Sensitive information. We do not deliberately collect sensitive information (such as health, racial, religious, or similar information). However, free-text fields — essays, uploads, and chat with the AI tutor — could contain such information if a student chooses to write it. We treat free-text content as potentially sensitive and protect it accordingly. We do not collect or track student location.

3. Why we collect it, and how we use it (APP 6)

We use personal information only to:

• create and run student, parent, and teacher accounts;
• provide the study features (tutoring, flashcards, practice exams, study plans, progress and mastery tracking);
• generate AI-assisted explanations and feedback for the student’s own learning;
• manage the subscription and billing;
• keep accounts and data secure, and detect and prevent abuse;
• communicate with parents about the account (for example, exam-prep reminders and trial/billing notices); and
• where you have switched it on, use anonymised learning patterns to improve Duxie for all students (see section 7).

We do not sell personal information. We do not use personal information for third-party advertising. We do not show ads.

4. The AI tutor and what is shared with OpenAI (APP 6, APP 8)

Duxie’s AI features (the tutor “Dux”, explanations, flashcard help, practice-exam feedback) are powered by OpenAI’s API.

• What is sent:the student’s study content for the task at hand (for example, a flashcard, an essay draft, or an exam answer and working) and the fact that the user is “a student in Australia.”
• What is not sent:we do not include the student’s name, email, school, or account identifiers in what we send to OpenAI. The content is pseudonymised at the point it is sent.
• Training: data sent through the OpenAI API is not used to train or improve AI models. We have not opted into any training arrangement.
• Retention by OpenAI: OpenAI may retain API content for up to 30 days for abuse-monitoring, after which it is deleted (unless OpenAI is legally required to keep it). OpenAI processes this data on infrastructure located in the United States.

Because some AI processing happens overseas, your information is stored in Australia (see section 6) but a limited, pseudonymised slice is processed in the United States by OpenAI under the terms above. We are pursuing a formal data-processing agreement and zero-retention arrangement with OpenAI to strengthen this further.

5. Who else we share information with (sub-processors)

We share personal information only with the service providers we need to operate Duxie, and only for that purpose. They are bound by their own privacy and security obligations. Our current providers are:

We keep a current sub-processor register internally and will update this list if it changes. We do not sell or trade personal information to anyone.

6. Where your information is stored, and overseas disclosure (APP 8)

Your account and study data are stored in Australia(our database and file storage are hosted in Sydney). Some processing happens overseas: AI tutoring by OpenAI (United States), email delivery by Resend (United States), and web delivery via Vercel’s global network. Where we disclose information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

7. Anonymised learning data — your choice

Separately from running the service, we can use anonymised learning patterns (with no name, school, or identifying information) to improve Duxie for all students. This is optional and off by default. You can turn it on or off at any time in your account settings. Turning it off does not change your child’s experience in any way. Anything retained this way is genuinely de-identified — it cannot be linked back to your child.

8. How long we keep information (APP 11.2)

We keep personal information only as long as we need it to provide the service, then delete or de-identify it. In summary:

• Active accounts: kept while the account and subscription/trial are active.
• Cancelled or lapsed accounts: kept for a 90-day grace period (so you can return without losing progress), then deleted or de-identified.
• Deletion on request:if you ask us to delete your child’s data, we complete it within 30 days of verifying your request.
• Inactive accounts: accounts inactive for 12 months are flagged, the parent is notified, and the data is then deleted or de-identified.
• Billing records: kept as required by Australian tax and financial law (up to 7 years), held largely by Stripe.
• Backups: deletions flow through to backups within the backup rotation cycle.

Full detail is in our internal Data Retention & Deletion Policy.

9. Your rights — access, correction, and deletion (APP 12, APP 13)

You can, at any time:

• Access the personal information we hold about you or your child;
• Correct anything inaccurate;
• Withdraw consent to anonymised data use (section 7); and
• Request deletion of your child’s account and data.

To make a request, email support@duxie.au. We will verify you are the account holder (to protect children from malicious requests) and respond within a reasonable time — and within 30 days for deletion requests. There is no charge to access your information.

10. Parental consent and your child (Children's Online Privacy Code)

• A parent or guardian sets up and approves the student’s account; under-18 accounts are not activated until a parent approves them.
• We act in the best interests of the child when deciding what to collect, use, or disclose.
• Privacy-protective settings are the default. There are no public profiles, no student-to-student messaging of personal information, and no advertising.
• Students are told, in language they can understand, that their parent set up the account and what Duxie does with their study data (see the student version below).

11. How we keep information secure (APP 11)

• All data is encrypted in transit (TLS) and at rest (AES-256).
• Each family’s data is walled off from every other at the database level (Row Level Security) — a student can only see their own data, and a parent only their own child’s.
• Access keys are kept in secured configuration, never in our public code.
• We have a written Data Breach Response Plan. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme.

12. Complaints

If you have a privacy concern, email support@duxie.au and we will work to resolve it. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

13. Changes to this policy

We may update this policy as Duxie evolves and as the law changes (including when the Children’s Online Privacy Code is finalised). We will post the updated version here with a new “last updated” date, and tell parents about significant changes.

A version for students

A child-friendly privacy notice — the plain-words version of this policy written for students — is available inside the student app.

Contact

ALN Capital Pty Ltd (Duxie) · Privacy Officer: Andrew · support@duxie.au· Victoria, Australia.