Privacy policy

About the parent or guardian

• Your name, email address and family name.
• Your password, stored only in a scrambled form (a “hash”) that we cannot read.
• An optional parent PIN, also stored only as a hash.

About each child, entered by you or by your child

• First name or display name, and school year level.
• An optional username and password, if you give your child their own sign-in.
• Daily reflection conversations: what your child says they learnt, in their own words, and the questions they were asked.
• Learning records, topics, understanding levels and next steps made from those reflections.
• Quiz questions, your child’s answers and their scores.
• Activities outside lessons (for example sport or outings) and any photos or files uploaded as evidence.
• Reports you create, edit and approve.

Collected automatically

• A sign-in cookie that keeps you signed in. It is needed for the service to work and is not used for tracking or advertising.
• A record of important account actions (such as signing in, approving a report or exporting data), with the time they happened, to keep accounts secure.
• Basic technical information our hosting providers log to keep the service running, such as IP addresses.
• An anonymous count of visits to our homepage and sign-up page. We don’t use cookies for this: each visit is turned into a scrambled code that changes every day and can’t be traced back to a person or followed over time.

We ask families not to include sensitive information (such as health details) in reflections, activities or photos. Our AI is instructed not to ask children for personal details such as their address or school.

Learnloop is designed for children to use under the supervision of a parent or guardian. Only an adult can create a family account. When signing up, the parent confirms they are the child’s parent or guardian and consents to their child’s learning information being stored and processed as described in this policy.

Parents control their children’s profiles: they can view everything their child records, correct it, download it, or ask us to delete it. Parents can set a parent PIN so that children using the family account cannot open the parent area.

• To run the service: sign-in, daily reflections, learning records, quizzes, calendars and reports.
• To create summaries, quiz questions and draft reports using AI (see section 4).
• To keep accounts and data secure, and to investigate misuse.
• To contact the parent about their account, such as password resets or important changes to the service.
• To meet our legal obligations.

We do not use your information for advertising, we do not sell it, and we do not build marketing profiles of children.

When your child completes a reflection, their answers are sent to an AI service, which asks follow-up questions and then writes a learning record. The AI also writes quiz questions from your child’s records, marks short written answers, and drafts reports for you to review.

We currently use Kimi, provided by Moonshot AI, a company based in China. Only the information needed for each task is sent: for example the child’s first name, year level, subject and their reflection answers. Email addresses, passwords and photos are not sent to the AI service.

[Confirm with Moonshot AI: where its servers that process our requests are located, how long it keeps the information, and whether it uses it to train its models. Update this paragraph to match.]

AI can make mistakes. Learning records and reports are written to separate what a child says they learnt from what their answers actually show, and parents review and approve reports before they are used.

• Account and learning information is stored in a database hosted by Neon in Sydney, Australia.
• Photos and uploaded files are stored in private storage hosted by Neon in Singapore. They are not publicly accessible and can only be viewed by someone signed in to your family account.
• The website will be hosted by [hosting provider and server location, e.g. Vercel, Sydney].
• AI processing is carried out by Moonshot AI [country where processing happens].
• Account emails (such as password resets) will be sent through [email provider and country, e.g. Resend, United States].

This means some personal information is disclosed overseas, including to Singapore, [China / other countries] and [the United States]. Before disclosing information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles. [Lawyer to confirm the APP 8 approach and whether separate consent is needed for overseas AI processing.]

We share information only with:

• the service providers listed in section 5, so they can run parts of Learnloop for us;
• people you choose to share it with yourself, for example when you download a report and send it to an education authority;
• authorities, where we are required or authorised by law.

If you or your child tell us something that suggests a child may be at risk of harm, we may need to act on it as required by law.

• Passwords and PINs are stored only as secure hashes.
• Information is sent over encrypted connections.
• Each family’s data is kept separate, and every request checks that the person signed in belongs to that family.
• Photos are kept in private storage and served only to signed-in family members.
• Repeated failed sign-in attempts are slowed down to block password guessing.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected families and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

We keep your family’s information while your account is open, because the point of Learnloop is to build a learning history over time. If you ask us to delete your account, we will delete your family’s information within [30] days, except where we must keep something by law. Backups are overwritten within [X] days.

• Access and download: parents can download all of their family’s data at any time from Settings → Download all family data, and download any report as a PDF.
• Correction: parents can edit learning records and reports in the app, or ask us to correct anything else.
• Deletion: parents can delete photos and activities in the app, and can permanently delete the whole family account from Settings → Delete account. You can also ask us to delete a child’s profile by emailing us.
• Withdrawing consent: you can stop using Learnloop at any time and ask us to delete your data.

We will respond to privacy requests within 30 days.

Contact our privacy officer at [privacy email address]. If you have a complaint, please tell us first and we will try to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

If we make important changes, such as using a new AI provider or storing information in a new country, we will update this page and tell parents by email or in the app before the change takes effect.