Privacy Policy

1. Introduction

TutorGPT is a brand owned and operated by Pivot Time Pty Ltd (ABN 33 600 371 908) ("we", "us", or "our"). We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, disclose, and protect personal information through our AI-powered VCE tutoring platform at www.tutorgpt.com.au (the "Service").

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Policy also addresses specific privacy considerations arising from the use of artificial intelligence in education.

This Privacy Policy should be read in conjunction with our Terms of Service.

2. Information We Collect

2.1 Information You Provide Directly

1. Account registration information: name, email address, date of birth, school name (optional), year level
2. Parent or guardian contact details (for users under 18)
3. Subscription and billing information (processed by our third-party payment provider)
4. Support requests and correspondence
5. Profile preferences (e.g., VCE subjects, study goals)

2.2 Information Generated Through Use

1. Chat transcripts and queries submitted to the AI tutor
2. AI-generated responses provided to you
3. Practice exam responses and results
4. Study session data (duration, frequency, subjects studied)
5. Performance analytics and progress tracking data
6. Feature usage patterns and preferences

2.3 Automatically Collected Technical Information

1. Device type, operating system, and browser information
2. IP address and approximate geolocation (city/state level)
3. Cookies and similar tracking technologies (see Section 9)
4. Log data (access times, pages viewed, error logs)
5. Referral URLs

2.4 Information We Do NOT Collect

We do not intentionally collect:

1. Government identifiers (Tax File Numbers, Medicare numbers, etc.)
2. Financial information beyond what is processed by our payment provider
3. Health or medical information
4. Biometric data
5. Sensitive information as defined under the Privacy Act 1988 (unless you voluntarily include it in chat conversations)

3. How We Use Your Information

We use the personal information we collect for the following purposes:

4. AI-Specific Data Practices

4.1 How the AI Processes Your Data

When you interact with TutorGPT's AI tutor, your messages are processed by large language model (LLM) technology. This means:

1. Your chat messages are sent to our AI processing systems to generate responses
2. The AI uses the context of your current conversation to provide relevant answers
3. Your conversation history may be used to maintain context across a study session

4.2 AI Model Training

We may use de-identified and aggregated data from user interactions to improve our AI models. Specifically:

1. Individual conversations are not used directly to train AI models without de-identification
2. We aggregate patterns across many users to identify areas where AI accuracy can be improved
3. You may opt out of having your de-identified data used for AI improvement by contacting us at privacy@pivottime.com.au

4.3 Third-Party AI Services

Our Service may utilise third-party AI infrastructure providers (e.g., API services from AI model providers) to process queries. Where we use third-party AI services:

1. Data is transmitted securely using industry-standard encryption
2. We have data processing agreements in place with all third-party providers
3. All locally stored data (including user accounts, chat history, and performance data) is held in secure Australian data centres
4. AI query processing may involve transmission to third-party AI model providers located overseas (e.g., the United States) via API calls; however, we do not store your personal data on overseas servers

4.4 Automated Decision-Making

The Service uses automated systems to:

1. Generate educational content and responses to your queries
2. Assess your performance on practice questions
3. Recommend study topics and learning pathways
4. Moderate content for safety and appropriateness

These automated decisions are used for educational support purposes only and are not used to make decisions that have legal or similarly significant effects on you. You can request human review of any AI-generated assessment by contacting us.

5. Children's Privacy

We take the privacy of children seriously. Given that our Service is designed for VCE students, many of our users may be under 18.

5.1 Users Aged 13–17

1. Parental or guardian consent is required for users under 18
2. Parents/guardians may request access to their child's account data
3. Parents/guardians may request deletion of their child's data at any time
4. We implement age-appropriate content filters and safety measures
5. We do not knowingly serve targeted advertising to users under 18

5.2 Users Under 13

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

6. Disclosure of Information

We may disclose your personal information to:

6.1 Service Providers

1. Cloud hosting and infrastructure providers
2. AI processing service providers
3. Payment processors
4. Email and communication service providers
5. Analytics providers (using de-identified data only)

6.2 Legal and Safety Disclosures

We may disclose personal information where required or permitted by law, including:

1. To comply with a legal obligation, court order, or regulatory requirement
2. To protect the safety, rights, or property of TutorGPT, our users, or the public
3. To enforce our Terms of Service
4. With your consent

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

6.4 No Sale of Personal Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

7. Data Storage and Overseas Disclosure

7.1 Australian Data Storage

All locally stored data, including your account information, chat history, performance analytics, and any other personal information we retain, is stored in secure Australian data centres. We are committed to keeping your data onshore wherever practicable.

7.2 Overseas Processing

While your data is stored in Australia, certain processing activities may involve the transmission of data to overseas service providers, specifically:

1. AI model providers: When you submit a query to the AI tutor, your message may be transmitted via API to large language model providers whose processing infrastructure is located overseas (e.g., the United States). These transmissions are transient and we do not store your personal data on overseas servers.
2. Other service providers: Email delivery, analytics, or other ancillary services may involve overseas processing.

In accordance with APP 8, before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the overseas recipient handles your information in a manner consistent with the APPs. This includes entering into contractual arrangements that require compliance with Australian privacy standards. Third-party providers are contractually prohibited from using your data for their own purposes.

8. Data Security

We implement reasonable technical and organisational measures to protect your personal information, including:

1. Storage of all locally held data in secure, certified Australian data centres
2. Encryption of data in transit (TLS/SSL) and at rest
3. Access controls and authentication mechanisms
4. Regular security assessments and monitoring
5. Staff training on data protection and privacy
6. Incident response procedures for data breaches
7. Secure development practices for our platform

In the event of an eligible data breach (as defined under the Notifiable Data Breaches scheme), we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with Part IIIC of the Privacy Act 1988.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

1. Maintain your session and authentication
2. Remember your preferences and settings
3. Analyse usage patterns and improve the Service
4. Ensure the security and functionality of the platform

Types of cookies we use:

Essential cookies: Required for the Service to function. These cannot be disabled.

Functional cookies: Remember your preferences and personalise your experience.

Analytics cookies: Help us understand how the Service is used (using de-identified data).

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

10. Your Rights

Under the Privacy Act 1988 and the APPs, you have the following rights:

10.1 Access

You may request access to the personal information we hold about you. We will respond to access requests within 30 days.

10.2 Correction

You may request correction of personal information that is inaccurate, incomplete, out-of-date, or misleading.

10.3 Deletion

You may request deletion of your personal information, subject to our legal obligations to retain certain records. Upon account deletion:

1. Your profile and account information will be deleted
2. Chat history and conversation data will be deleted or de-identified
3. Aggregated, de-identified data that has already been incorporated into analytics or AI improvements cannot be individually extracted and deleted
4. Billing records may be retained as required by tax and financial reporting laws

10.4 Data Portability

You may request a copy of your personal data in a commonly used, machine-readable format. This includes your chat history, performance data, and account information.

10.5 Opt-Out of AI Training

You may opt out of having your de-identified data used for AI model improvement by emailing privacy@pivottime.com.au.

10.6 How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@pivottime.com.au. We may need to verify your identity before processing your request. If you are a parent or guardian exercising rights on behalf of a minor, we may request proof of your relationship.

11. Data Retention

We retain personal information for as long as necessary to provide the Service and fulfil the purposes described in this Policy. Specific retention periods include:

1. Account information: Retained while your account is active, deleted within 90 days of account closure
2. Chat history: Retained for up to 24 months, then deleted or de-identified
3. Performance and progress data: Retained while your account is active
4. Billing records: Retained for 7 years as required by Australian tax law
5. Technical logs: Retained for up to 12 months
6. De-identified aggregated data: May be retained indefinitely for research and improvement purposes

12. Third-Party Links and Services

The Service may contain links to third-party websites or services, including VCAA resources, educational publishers, and other reference materials. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party service you access through our platform.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

1. Posting the updated Policy on our website with a revised "Last Updated" date
2. Sending an email notification to your registered email address
3. Displaying a notice within the Service

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Policy.

14. Complaints

If you believe we have breached the APPs or handled your personal information inappropriately, you may lodge a complaint with us by contacting privacy@pivottime.com.au. We will investigate and respond to your complaint within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Post: GPO Box 5218, Sydney NSW 2001

15. Contact Us

If you have questions about this Privacy Policy or how we handle your personal information, please contact our Privacy Officer:

Entity: Pivot Time Pty Ltd (trading as TutorGPT)
ABN: 33 600 371 908
Privacy Enquiries: privacy@pivottime.com.au
General Support: support@pivottime.com.au
Website: www.tutorgpt.com.au
Postal Address: Level 7, 333 Collins Street, Melbourne VIC 3000