Privacy Policy

1. About This Policy

This Privacy Policy explains how TeaCheese ("we", "us", "our") collects, uses, stores, and discloses personal information through our website at teacheese.com.au and the TeaCheese web application at app.teacheese.com.au (together, the "Platform").

TeaCheese is operated under ABN 90 303 554 759, based in Queensland, Australia. We are committed to handling your personal information responsibly, transparently, and in accordance with applicable Australian law, including the Australian Consumer Law, the Spam Act 2003 (Cth), and the Privacy Act 1988 (Cth) to the extent it applies.

This policy explains our information handling. Reading it or using the Platform does not replace a separate consent or notice required by law for a particular collection, use or disclosure. The website and application may use different services, as described below.

2. Information We Collect

2.1 Account, Contact and Payment Information

Information may include your email address, name, school or organisation, account and subscription details, support correspondence and the fields you complete in a website enquiry or registration form. Passwords and authentication information are used where an account feature requires them. Payments are handled by Stripe; account and billing records may include Stripe references, subscription status and transaction information. We do not store full payment card numbers or card security codes on our servers.

2.2 Teaching Material and Uploaded Files

We process the prompts, classroom information, curriculum selections, files and materials you supply, together with generated resources, saved drafts and exports. This can include syllabuses, lesson and unit plans, assessments, marking guides, worksheets, quizzes and slides. Uploads and free text may contain personal information even where the feature does not require it.

2.3 Website Assistant and Form Information

The public website assistant receives your messages and the relevant page context. A submitted question, its answer, the page reference and a random conversation identifier may be stored. Website forms collect the fields you submit, such as contact details and teaching interests. These website functions are separate from resources saved in the application.

2.4 Technical and Usage Information

Technical information may include IP addresses, browser and device information, page addresses, referral information, cookie or browser identifiers, interactions and event times. Such information is not necessarily anonymous. It may identify a person when combined with other information.

2.5 Shared Activity Responses

Where a teacher shares an online worksheet or quiz, shared worksheets collect answers and an optional class code, not student names or email addresses, and shared quiz responses are stored without names. Only the teacher who shared the resource can view the responses.

Identifiable student information is not needed for ordinary resource planning. Do not include unnecessary student names, contact details, health information or other sensitive information in prompts, files or assistant questions. A teacher must establish school authority and any required consent before using a feature with student information.

3. How We Collect Information

Information is collected when you complete a form, contact us, use the website assistant, create an account, provide teaching material, purchase a service or submit an activity response. Information is also collected through cookies, browser storage, service logs and the analytics described in Section 7.

If a supported external sign in option is used, the provider supplies the information needed for that option, such as an email address and account identifier. Available options are those actually offered by the application; this policy does not promise a school single sign on integration.

4. How We Use Information

We use personal information for the following purposes:

• Providing the Platform: Operating the service, generating AI-powered planning content, managing your account and subscriptions, processing payments, and delivering exports
• Communication: Sending account verification emails, password reset emails, subscription notifications, and responding to your support enquiries
• Improvement: Analysing how the Platform is used to identify issues, improve features, and develop new functionality
• Security: Detecting and preventing fraud, unauthorised access, and other security threats
• Legal compliance: Meeting our obligations under applicable Australian law

We will never sell, rent, or trade your personal information to third parties for their own marketing purposes.

5. AI Processing

AI services process relevant material to respond to questions and create or check teaching resources. Depending on the feature, this may include your request, selected curriculum, classroom context, linked teaching material, uploaded file content, an existing draft and the instructions needed to produce the result.

If you include personal information in that material, it may be processed by the AI service. A statement that a feature does not require account details is not a guarantee that personal information in an upload or message will be removed. Do not submit passwords, payment details, confidential student records or other unnecessary personal information to an AI request.

When the public website assistant is enabled, submitted conversation content and the relevant page context are sent to OpenAI. The application uses OpenAI, Anthropic (Claude), Google Gemini and Perplexity for AI features, under paid API accounts and their respective business terms. The application may also use search and image services for particular features, as described in Section 6.

Under those API terms, material submitted through the Platform is not used to train these providers' models. A provider may retain submitted content for a limited period, typically up to 30 days, to monitor for misuse and meet legal obligations, under its applicable service terms.

Generated responses can be inaccurate. Teachers should check the result and the suitability of any material before using it with students. Automated resource checks support that review; they do not replace a teacher decision about student learning or assessment.

6. Service Providers

Service providers process information for the functions below. The first table covers this website; the second covers the TeaCheese application.

The application uses these services:

Providers handle information under their service terms and our arrangements with them. We do not describe hashed contact information as anonymous.

Information may also be disclosed where required or permitted by law, or as reasonably necessary to investigate fraud, secure the service or respond to a legal claim, subject to applicable legal protections.

7. Cookies, Analytics and Advertising

Browser cookies and local storage can support account functions, preferences, website assistant state and usage measurement. The website includes Google Analytics and Meta tracking code. Advertising events may be sent through the Meta Pixel or a server connection when those services are configured.

Event information can include the page viewed, an interaction, browser identifiers and technical information. Where a contact detail is hashed before transmission, the result may still be matched to a person or provider account. Hashing does not guarantee anonymity.

The application uses PostHog for product analytics and Google Analytics for usage measurement. Analytics events cover pages, interactions and technical information. PostHog also records application sessions to help us improve the product. A session recording shows the screens used during a session and may capture free text or uploaded content visible on screen. When a subscription is purchased, Meta receives a purchase event with a hashed email address.

You may manage cookies and tracking through browser settings and provider controls. Available options include the Google Analytics browser add on and Meta advertising preferences. Disabling browser cookies may affect account functions. Browser controls do not necessarily prevent server based events. Contact us about your preferences and any information handling concern.

8. Overseas Processing

Some providers may receive, store or process information outside Australia. Australian hosting of one component does not mean that AI processing, analytics, email, support access or all backups remain in Australia.

The application, its database and uploaded files are hosted with Google Cloud in Australia. The AI providers in Section 5, PostHog, Resend, Stripe and Meta process information mainly in the United States, and image and video services may process search terms in the United States or the European Union. Core account and planning data stays in Australia, while AI processing, analytics, email delivery and payments involve overseas recipients. The likely recipient countries are therefore Australia and the United States.

Where applicable law requires it, we take reasonable steps concerning overseas recipients and their handling of personal information. Provider arrangements and any relevant legal exception must be assessed for the particular disclosure; this policy is not a blanket consent to overseas disclosure.

9. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Safeguards should reflect the information and services concerned, including access restrictions, secure communications and protection of account credentials.

Passwords are hashed with bcrypt and never stored as plain text. Session tokens are hashed before storage, kept in secure browser cookies and expire after 30 days. Password reset links expire after 1 hour and emailed sign-in links after 15 minutes. Sign-in attempts are rate limited. No online service can guarantee absolute security.

10. Retention and Deletion

Information is retained for the purposes for which it is held, including providing the service, responding to requests, protecting accounts and meeting legal record keeping obligations. Different periods can apply to account records, teaching material, assistant conversations, exports, payment records, service logs, analytics and backups.

As a guide: account records are kept while your account is open and for a reasonable period after closure; planning content is kept while your account is open; payment records are kept for 5 years as required by Australian tax law; login sessions expire after 30 days of inactivity, and expired sessions and sign-in tokens are deleted automatically.

You may request account closure or deletion at hello@teacheese.com.au. We may need to verify your identity and authority before acting. A request must account for information we are required or permitted to retain, and the treatment of shared resources, downloaded copies, backups and provider records. Copies held by recipients are not automatically removed by deleting your TeaCheese account.

We action verified deletion requests within 30 days. Your account is closed and de-identified, and your planning content, uploaded files, payment customer record and mailing list contact are deleted, except records we must keep by law (such as tax records). Copies you or others have already downloaded, and short-lived backups, can persist for a limited period.

11. Marketing Communications

Marketing messages must be sent with consent as required by the Spam Act 2003 (Cth). When you create an account, we add your email address to our mailing list for product updates. Every marketing message includes an unsubscribe link, and you can opt out at any time without affecting your account.

Marketing messages identify TeaCheese and provide contact details and a means to unsubscribe. You may also contact hello@teacheese.com.au. We action marketing unsubscribe requests within 5 business days, without a fee or a requirement to create an account. Essential account and service messages may continue where appropriate; promotional content remains subject to the applicable marketing rules.

12. Students and Children

Teacher accounts are intended for adults. A teacher shared activity may nevertheless be completed by a student. A shared worksheet collects answers and an optional class code, a shared quiz stores responses without names, and only the sharing teacher can view them.

Before using a shared activity with students, the teacher and school must establish the permitted purpose, collection notice, required authority or consent, access arrangements and appropriate retention. Avoid unnecessary identifying or sensitive information. This responsibility does not exclude TeaCheese's own legal obligations.

Contact us if information about a child has been collected without appropriate authority. We will review the request and take the steps required by applicable law.

13. Access, Correction and Other Requests

Subject to applicable law, you may:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct any inaccurate or incomplete personal information
• Deletion: Request that we delete your personal information (subject to any legal obligations to retain certain records)
• Opt out of marketing: Unsubscribe from marketing communications at any time
• Complain: Lodge a complaint if you believe we have not handled your personal information appropriately (see Section 15)

To exercise any of these rights, please contact us at hello@teacheese.com.au. We will respond to your request within 30 days.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Material changes will be communicated to registered users via email or a prominent notice on the Platform
• The "Last updated" date at the top of this policy will be revised with each update
• Any separate consent or notice required for a changed information handling practice must still be provided

We encourage you to review this policy periodically.

15. Complaints

If you believe we have not handled your personal information appropriately, we encourage you to contact us first so that we can try to resolve your concern:

16. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: