Privacy Policy & Data Security

1. Our Privacy Commitment

Inkcraft Education Pty Ltd ("Inkcraft", "we", "our", or "us") is committed to protecting the privacy of educators, schools, and students. We operate in strict accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth), as well as the Victorian Privacy and Data Protection Act 2014 and the Health Records Act 2001 (Vic).

Our flagship software, Inkcraft Studio, is designed with a secure, Australian-hosted cloud architecture with strict tenant isolation. Student assessment data processed during diagnostic sessions resides in separate, dedicated databases for each school, preventing cross-institutional data mixing and unauthorised leakage.

Our complementary product, Inkcraft Report, provides AI-powered report comment proofreading for educators. Inkcraft Report is hosted on Australian cloud infrastructure (Sydney) and employs a client-side PII stripping architecture — all student names and personally identifiable information are automatically removed in the user's browser before any text is transmitted for AI-assisted proofreading, and reinserted locally upon return. No student PII ever reaches external AI providers.

2. Information We Collect

We collect minimal information necessary to deliver educational functionality:

• School & Account Contact Information: Name, school email address, institutional role, and school contact details provided when requesting demos or establishing school accounts.
• Cloud Assessment State (Inkcraft Studio): Student responses and benchmark scores are processed and stored in our secure, Australian-based cloud environment. Each school is provisioned a separate, isolated database to ensure strict separation of student records.
• Report Comment Data (Inkcraft Report): Teacher-written report comments submitted for AI-powered proofreading. All student PII is stripped client-side before transmission. Only anonymised, de-identified text is processed by our AI sub-processor. Comments are processed transiently and are not retained beyond the active session.
• Payment Information (Inkcraft Report): Individual teacher subscriptions are processed securely via Stripe. Inkcraft Education does not store credit card numbers or payment credentials on our servers. All payment data is handled directly by Stripe in accordance with PCI DSS Level 1 compliance.
• Technical Diagnostics: Anonymised performance logs (browser type, load times, error state triggers) used exclusively to maintain system reliability.

3. Data Security & Architecture

• No selling or commercial exploitation of student data under any circumstances.
• AES-256 encryption applied to all exported institutional backups.
• No third-party advertising tracking scripts or marketing pixels embedded within student workflows.
• All cloud infrastructure for both Inkcraft Studio and Inkcraft Report is hosted within Australia (Sydney region).

4. Cross-Border Data & AI Processing

Our AI sub-processor, Google LLC (Google Gemini), may process de-identified text through globally distributed API endpoints. No student PII is ever included in these API requests — all personally identifiable information is stripped client-side before transmission. Only anonymised curriculum standards, generic prompts, and de-identified report comment text are sent for processing.

All primary application data, user accounts, and infrastructure are hosted within Australia via Fly.io (Sydney region). For full details on our third-party processors, see our Sub-processors Policy.

5. Notifiable Data Breaches

In the event of a data breach that is likely to result in serious harm to any individual, Inkcraft Education will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). We will notify the Office of the Australian Information Commissioner (OAIC) and all affected individuals and institutions as required by law. For full details on our breach response procedures, see our Data Breach Response Plan.

6. Cookies & Analytics

Inkcraft Education does not use third-party analytics services, advertising trackers, or marketing pixels on our website or within our software platforms. We do not deploy Google Analytics, Facebook Pixel, or similar tracking technologies.

Our platforms may use essential session cookies strictly required for authentication and application functionality. These cookies do not track users across third-party websites and contain no student data.

7. Victorian Curriculum 2.0 Compliance

Assessment materials hosted within Inkcraft Studio align with the Victorian Curriculum 2.0 guidelines issued by VCAA. All school content remains the intellectual property of the subscribing school or educator.

8. Contact Our Privacy Officer

If you have questions regarding our data governance, wish to exercise access rights, or require an institutional security audit overview, please contact: