Privacy Policy

1 Information We Collect

Our platform is intended for users aged 10 and over. Students under the age of 18 may only use the platform through a school that has obtained verifiable parental or guardian consent on their behalf.

We collect the following categories of personal information when you use our platform:

• Students: First name, email address, account password, classes, school key, role, uploaded work tasks, AI interactions, and related learning reports.
• Teachers: First name, email address, account password, classes, school key, role, assignments.
• Technical data: Device type, browser, IP address, and anonymised usage analytics.
• Support data: Messages or feedback submitted to our support team.

We collect only the minimum personal information necessary to deliver our services (information privacy principle 1 of the Privacy Act 2020).

Personal information is collected directly from the individual concerned (the student or teacher) wherever practicable. Where a school provides initial account details on behalf of a student, this is done with the school's authority as the consenting intermediary.

We do not collect personal information through deception, coercion, or in an unreasonably intrusive way. Collection occurs only through our registration process and your direct use of the platform.

2 How We Use Information

• Provide access to the platform and its learning tools.
• Track and report on student learning progress.
• Associate students with schools, classes, and teacher accounts.
• Improve and develop our services using anonymised analytics.
• Ensure the safety, security, and legal compliance of our platform.
• Respond to support requests and feedback.

Personal information will not be used for any purpose other than that for which it was originally collected. If we decide to use personal information for a new purpose, we will seek new consent.

It is the responsibility of the User to ensure accuracy and correctness of their personal information on Prolerus for proper platform functionality, like report generation.

3 Sharing and Disclosure

We may share personal information only in the following circumstances:

• With the school or teacher responsible for managing the student's account.
• With third-party service providers who assist us in operating the platform, under strict confidentiality and data processing agreements.
• When required or authorised by New Zealand law.

We never share personal information with advertisers or sell data to any third party.

4 Storage and Security

All data is stored with encryption in transit and at rest, with strict access controls:

• Registration and account data: AWS servers located in Sydney, Australia.
• Uploaded student content Cloudflare Global Network and servers located in the United States.
• AI interactions: Servers located in the United States.

All systems we rely on comply with SOC 2 Type II standards. We regularly review our security practices to protect personal information from unauthorised access, loss, or disclosure.

In the event of a privacy breach that poses a risk of serious harm to students, we will notify the affected school as soon as possible. Schools are responsible for notifying affected parents, guardians, and students in accordance with their own obligations. Where required by law, we will also notify the Office of the Privacy Commissioner.

5 Cross-Border Data Transfers

All personal information is stored or processed outside of New Zealand (including in Australia, Singapore, and the United States). Before transferring personal information overseas, we take reasonable steps to ensure the recipient is subject to privacy safeguards comparable to the Privacy Act 2020, including through contractual obligations and reliance on service providers that hold internationally recognised security certifications (e.g., SOC 2 Type II).

Where personal information relating to students under 13 is transferred overseas, schools are responsible for ensuring parents and guardians have been informed of such transfers as part of their enrolment process. All overseas processors are contractually prohibited from using personal information for any purpose beyond providing the agreed services to Prolerus.

By using our platform, you acknowledge that personal information may be transferred internationally as described in this policy.

6 Children's Privacy

Our platform is designed for students aged 10–18. Students under the age of 18 may only access the platform through a school that has obtained verifiable parental or guardian consent prior to enrolment.

School responsibility: By enrolling students on the Prolerus platform, schools confirm that they have obtained the necessary consents from parents or guardians in accordance with applicable law and their own privacy obligations. Prolerus relies on this confirmation but retains its own independent obligations under the Privacy Act 2020.

Parental and guardian rights: Parents and guardians of students under 18 may at any time:

• Request access to their child's personal information held by us;
• Request correction of any inaccurate information; or
• Request deletion of their child's personal data.

To exercise any of these rights, contact our Privacy Officer at edy.belingher@prolerus.com. Where a request relates to a student's data, we may coordinate with the relevant school before responding. We will respond within 20 working days.

7 Access and Correction

Under the Privacy Act 2020, individuals have the right to request access to, and correction of, personal information we hold about them. To make a request, please contact our Privacy Officer:

We will respond to access and correction requests within 20 working days, as required by the Privacy Act 2020.

Parents and guardians may also exercise these rights on behalf of their child. Where a request relates to a student's data, we may coordinate with the relevant school before responding.

8 Data Retention and Deletion

Student data is retained only while a school is actively using our platform. When a school's subscription ends or a deletion request is received, personal data is securely and permanently deleted within 60 days, unless retention is required by New Zealand law.

Users or schools may request early deletion of personal information by contacting us at support@prolerus.com.

9 Cookies and Tracking

We may use cookies and similar technologies to keep users logged in, improve platform performance, and analyse anonymised usage patterns. We do not use cookies for advertising or cross-site tracking.

You may disable cookies in your browser settings; however, some platform features may not function correctly without them.

10 Artificial Intelligence

Prolerus uses third-party AI models to provide learning tools on our platform. With respect to AI and personal data:

• Personal information is never used to train AI models.
• AI interactions are processed by third-party providers under data processing agreements that prohibit use of your data for model training.
• Upon request, we can disclose the names of the AI providers we use so you may review their respective terms and privacy policies.

For more details on how AI outputs are handled, please also refer to our Terms of Service.

11 Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected with a new "Last Updated" date at the top of this page. Where changes are significant, we will provide advance notice to schools via email.

Continued use of the platform after notice of changes constitutes acceptance of the updated policy.

12 Contact Us

If you have questions, concerns, or a complaint about this Privacy Policy or our handling of personal information, please contact our Privacy Officer:

If you are not satisfied with our response, you may also contact the Office of the Privacy Commissioner (New Zealand).