XReady privacy policy

1. Who we are

XReady is run by The Trustee for TDBM, ABN 60 368 962 309. In this policy "we" means that company. XReady is part of the XTutio family of products.

Privacy questions and requests go to hello@xtutio.com.

2. What we collect

• From the parent or account holder: name, email address and a password (stored only in a scrambled form).
• From the child: first name, year level, a login name, the answers they give, their marks and how long a paper took. We do not ask for a child's surname, address, school or date of birth.
• Payment: our payment provider takes your card details. We keep your customer number with them and the status of your subscription, not your card number.
• Support: what you tell us when you ask for help.
• Technical: your device and browser type, and which pages and buttons are used, counted by an analytics service after you accept analytics cookies.

3. Children's and students' information

XReady is used by children in Years 3 to 9. We build to the principles of the Privacy Commissioner's draft Children's Online Privacy Code, which is still being developed.

• A parent or guardian creates and controls every child's account.
• We collect only what we need to run the practice.
• A child or student's use is never sent to our analytics service, and they are never identified in it.
• We do not advertise to children or send them marketing, and we do not sell personal information.
• A child's information is private to the family. We never show a child's name to other families.
• You can ask us to delete a child's information at any time.

4. How we use it

• To run your account and the practice, mark answers and show results.
• To take payment and manage your subscription.
• To keep the service safe and fix faults.
• To improve the product, using counts that do not identify a child.
• To send you emails about your account and subscription. If we email you about another of our products, such as the code for 20% off, that is marketing: you can say no or unsubscribe in one click, and we never send marketing to a child.

5. AI

XReady marks written answers by AI straight after a paper is handed in. It marks against the paper's own marking guide or, for a short answer, against the paper's model answer or an example answer. A written question with no marking guide or example answer is not marked by AI, and the review says so. Multiple-choice and number answers are marked by rules, not AI.

AI requests are processed by Anthropic in the United States. Only the child's answer, the question and the paper's marking guide or example answer are sent. The child's name is replaced first, and we send no email address, school or other personal details. The child's answer is checked for anything worrying before it goes, and a worrying answer is held for a person to look at instead of being marked.

A parent controls AI for their child. AI marking runs only while the parent's AI setting for the child allows it and our age limits for AI allow it. If AI is switched off, nothing is marked by AI and the review says so plainly.

An AI mark is a guide. It is not a mark from the test makers, and it is not a NAPLAN, OC or Selective mark. A teacher may mark differently, and the AI can be wrong. The review labels every AI mark as a guide, and AI marks are shown in their own panel and are never added to the marks the rules gave.

The AI's marks, its reasons and the words it quoted from the answer are kept with the child's results, like any other mark. We do not write the child's answer to our logs. How long we keep it is covered under "How long we keep it".

6. Who we share it with

We use these services to run XReady. They handle information for us and only as we direct. We do not sell personal information.

7. Where it is stored

Your account and your children's results are stored in Sydney, Australia (AWS ap-southeast-2). Some of the services above process information elsewhere, as their region says.

8. How long we keep it

We keep information while your account is open. If you ask us to delete your account or a child's information we will delete or de-identify it within 30 days, except what the law requires us to keep, such as billing records for seven years.

9. Your rights

You can ask to see, correct or delete the information we hold about you and your children. Write to us at the privacy address above.

If you have a complaint, contact us first at the address above and we will reply in writing. If you are not happy with the answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Security

Information is encrypted on its way to and from the service. Passwords are stored in a scrambled form. Access to the database is limited to the people who need it.

11. Cookie notice

We use the cookies and similar storage that sign-in, security and your cookie choice need. These are essential and are always on.

If you accept analytics cookies, we use PostHog to count visits and the steps from our site to a purchase. If you are signed in, we count you by an account number only, never your name or email. We never identify or track children: a child's pages do not start analytics at all. If you accepted analytics and your payment provider tells us you have started a 7-day free trial, subscribed, paused or cancelled, we record that event against your account number, with no amounts.

If you accept analytics cookies, we also note which page or link first brought you to the site, so we can see which of our pages and guides help parents. We record it against your account number once you sign up, never your name or email, and we do not record it if you have not accepted analytics cookies.

We do not use advertising cookies and we do not share your information with advertisers. You can change your cookie choice at any time from the link at the foot of the page, or by clearing this site's data in your browser.

12. Changes

If we change this policy in a way that matters, we will tell you before it applies.