Privacy Policy

1. Who we are and what this policy covers

Curricly AI operates the Curricly website and teaching service. In this policy, “we”, “us” and “our” refer to the operator of that service. Privacy enquiries may be sent to hello@curriclyai.com.

This policy explains how we collect, hold, use and disclose personal information through our website, accounts, teaching tools, school workspaces and live classroom sessions. “Personal information” means information or an opinion about an identified or reasonably identifiable person. This policy should be read with our Terms and Conditions.

Schools may also have their own privacy notices and rules for information they choose to enter into Curricly. A school agreement may set additional requirements for its workspace.

2. Information we collect and where it comes from

We collect information directly from users, from a school or colleague who invites them, from classroom participants, and automatically when the service is used. The categories depend on the features used.

• Account and profile: name, email address, sign-in identifiers, verification and security records, teaching preferences and settings. If you choose Google sign-in, we receive the account information needed to authenticate you.
• Teaching content: prompts, uploaded references, saved resources, classes, curriculum settings, workspace records, shared materials and edits.
• Classroom activity: a participant name entered to join a live session, answers, scores and session reports. A learner can join a teacher's session without creating a teacher account.
• Communications and administration: support enquiries and replies, invitations, service emails, plan status, usage and any school purchasing correspondence.
• Technical data: IP address, browser and device information, timestamps, authentication events, feature use, errors and diagnostic records. We may infer an approximate region from an IP address; we do not request precise device location through the service.

Some resources or prompts may contain personal or sensitive information if a user puts it there. Please avoid submitting identifiable student details or sensitive information unless it is necessary, authorised by your school and suitable for the feature.

3. Why we use information

We use personal information to:

• register and authenticate users, manage accounts, permissions and workspaces, and protect them from unauthorised access;
• create, process, save, share and export resources and operate live classroom sessions at users' direction;
• send service, security and support messages and respond to requests;
• administer plans, school enquiries and usage limits, and investigate abuse, faults and security incidents;
• measure reliability and improve the service; and
• meet legal obligations and establish, exercise or defend legal rights.

We do not sell personal information or use private teaching content to target advertising. We do not use classroom responses to make automated high-stakes decisions about students.

4. AI processing and uploaded material

When a user requests an AI feature, the relevant prompt, selected reference material and other context needed for that request may be sent to an AI or document-processing provider. The service can route requests among configured providers. The provider and processing location may therefore vary by feature and deployment.

Do not assume a prompt or upload is anonymous because it is used to generate a resource. Remove unnecessary names, health details, behaviour records and other sensitive information before submitting it. We use providers to deliver the requested feature and apply access controls to content held within Curricly. Provider-specific handling may also be governed by the agreements we have with them.

5. Schools, teachers and learners

A teacher or school decides what class or learner information to enter, which colleagues may access a workspace, and whether to start a live session. Teachers and schools should provide any notices and obtain any permissions required by their policies and applicable law. They should use the least identifiable information that works for the teaching task.

In a school or shared workspace, authorised owners, administrators or members may see information made available under that workspace's permissions. A live session can display participant names, responses, scores or leaderboards to the teacher and, depending on session settings, other participants. Teachers should explain this to learners before a session.

If you are a learner or parent seeking access to or correction of information entered by a school, contact the school first. You can also contact us and we will help identify the appropriate route. Curricly is designed primarily for educators; a learner's live-session access is limited to the session supplied by a teacher.

6. Who receives information

We disclose information only where needed for the purposes above or where law permits or requires it. Recipients may include:

• infrastructure, database, authentication, email delivery, AI, document-processing and security providers acting for the service. The application integrates Supabase for data and storage, Resend for service email and Vercel Speed Insights for performance measurement; configured AI providers may vary;
• other users or school administrators to whom a user or school grants access, and recipients of content a user chooses to share;
• professional advisers, regulators, courts or law enforcement where a lawful request or legitimate protection of rights requires disclosure; and
• a successor to the service in a genuine business transfer, subject to applicable privacy obligations.

Some links or exported resources may lead to third-party services. Their privacy practices are governed by their own notices.

7. Processing outside Australia

Our primary Supabase project is hosted in Supabase's Oceania (Sydney, Australia) region. This is the location of its primary project data; it does not mean that every part of the Service is processed in Australia.

Website infrastructure, email delivery, AI and document-processing providers may process information in other countries. The locations depend on the feature and the providers configured at the time. We take reasonable steps appropriate to the information and provider, including contractual and access controls where available. If your school needs the current provider and processing-location details before using a feature, contact hello@curriclyai.com.

8. Security and retention

We use access restrictions, authentication controls and other technical and organisational measures designed to protect information. No online service can guarantee absolute security. If you believe an account or classroom session has been compromised, contact us promptly.

Account and saved content are generally kept while the account remains active, subject to school arrangements and legal or operational needs. An account deletion request disables access and starts a 30-day recovery period. After that period, the account becomes eligible for removal by our cleanup process. Some records may remain where required for security, legal compliance, dispute resolution or backups.

For completed live quizzes stored in our database, learner-level names and responses have a 90-day expiry after the later of session creation or expiry; they then become eligible for removal by our cleanup process. Aggregate report information may remain for its separate expiry period. Temporary or browser-stored session data may follow a different, shorter lifecycle.

9. Cookies, local storage and messages

We use cookies and similar browser storage for sign-in, account and live-session security, preferences and local drafts or histories. Some material saved in your browser stays on that device until you clear it. We also record limited operational and diagnostic events to run and improve the service.

We send essential messages such as verification, sign-in, security, support and account notices. Optional messages, where offered, can be managed through the account preferences or the message's unsubscribe instructions.

10. Access, correction and complaints

You may request access to or correction of personal information we hold about you by emailing hello@curriclyai.com. Account holders can download a JSON export from Data & Privacy settings and request account deletion there. The export covers listed account records; it does not include passwords, security secrets or another person's private information.

For a privacy complaint, email us with the issue, relevant account or workspace, and your preferred contact details. Do not email passwords or unnecessary student data. We will acknowledge and investigate the complaint, and aim to respond within 30 days. If more time is needed, we will explain why. We may first verify your identity or consult the school that controls the information. If you are dissatisfied with our response, you may contact the Office of the Australian Information Commissioner or another regulator with jurisdiction.

11. Changes to this policy

We may change this policy as the service, providers or legal requirements change. We will publish the revised policy with a new “Last updated” date and take reasonable steps to notify account holders of material changes. Contact hello@curriclyai.com for a question about this policy.