Privacy Policy

1. Introduction

Surge ("we," "our," or "us") is committed to protecting the privacy of children and families using our adaptive AI maths tutoring platform. This Privacy Policy explains how we collect, use, disclose, and safeguard information when your child uses our service.

We comply with the Australian Privacy Act 1988, the Privacy Amendment (Notifiable Data Breaches) Act 2017, and the Children's Online Privacy Protection Act (COPPA) for users in the United States.

2. Information We Collect

2.1 Personal Information

• Account Information: Parent/guardian email, name, and account credentials
• Child Profile: Child's name, year level, avatar selection, and learning preferences
• Learning Data: Maths concept progress, assessment results, session history, and performance metrics
• Communication Data: Support inquiries, feedback, and chatbot interactions

2.2 Automatically Collected Information

• Device information (browser type, operating system, device identifiers)
• Usage data (pages visited, time spent, features used)
• Session data (questions attempted, hints requested, answers given)

3. How We Use Information

We use collected information for the following purposes:

• Providing adaptive AI tutoring personalised to your child's learning level
• Tracking progress through the Australian Curriculum maths standards
• Recommending appropriate concepts and practice activities
• Improving our AI algorithms and learning pathways
• Communicating with parents about child's progress
• Providing customer support and responding to inquiries
• Ensuring platform security and preventing abuse

4. Data Storage and Security

• Storage Location: Data is stored on secure servers in Australia (AWS Sydney region)
• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access limits data to authorised personnel only
• Retention: Learning data is retained while the account is active; parents can request deletion
• Breach Response: We have procedures for notifying authorities and affected users within 72 hours

5. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

• Essential Cookies: Required for authentication and session management
• Functional Cookies: Remember preferences and settings
• Analytics Cookies: Help us understand how families use the platform
• AI Training Cookies: Improve our tutoring algorithms (no personal identification)

Parents can manage cookie preferences through browser settings. Note that disabling essential cookies may affect service functionality.

6. COPPA Compliance (United States)

For users in the United States, we comply with COPPA:

• We collect minimal personal information from children under 13 (name, year level, learning data)
• We obtain verifiable parental consent before collecting personal information
• Parents can review, update, or delete their child's information
• We do not use children's personal information for behavioural advertising
• We do not share personal information with third parties for marketing purposes

7. Australian Privacy Act Compliance

We comply with Australian privacy laws including:

• Australian Privacy Principles (APPs): We adhere to all 13 APPs
• Notifiable Data Breaches: We will notify you and the OAIC if a data breach occurs
• Cross-Border Disclosure: Data stays in Australia unless explicit consent is given
• Openness: This policy documents our information practices
• Anonymity: You can use a pseudonym where practicable

8. Third-Party Services

We may share data with trusted third parties:

• Cloud Hosting: AWS Australia (hosting and infrastructure)
• AI Services: Anthropic Claude API (tutoring responses - data not retained by AI provider)
• Analytics: Anonymous usage analytics (no personal identification)
• Payment Processing: Stripe (payment data - we do not store card details)

All third parties are bound by data processing agreements.

9. Parental Rights

Parents have the following rights:

• Access: Request a copy of your child's personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your child's information
• Portability: Request data in a machine-readable format
• Withdrawal: Withdraw consent for data collection
• Complaints: Lodge a complaint with the OAIC

10. Contact Information

For privacy inquiries or to exercise your rights: