Australian Privacy ActIntroduction
SmartNAPLAN Pty Ltd ("SmartNAPLAN", "we", "us", or "our") is committed to protecting the privacy of all users — including students, parents, and visitors to our platform. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the SmartNAPLAN website and services (the "Platform").
This policy applies to all users of the SmartNAPLAN Platform, including:
- •Students using the platform for NAPLAN practice
- •Parents or guardians who create and manage student accounts
- •Visitors browsing the SmartNAPLAN website
- •Schools and teachers accessing school accounts
By using the Platform, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of the Platform.
SmartNAPLAN operates under Australian law and complies with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and applicable state legislation. For users in the European Economic Area, we also comply with the General Data Protection Regulation (GDPR).
Information We Collect
We collect different categories of information depending on how you use the Platform. We only collect information that is necessary for the purposes described in this policy.
Personal Information
- •Full name (student and parent/guardian)
- •Email address (parent or guardian email required for student accounts)
- •Year level and school details (optional)
- •Account username and password (stored as a hashed value — never in plain text)
Student Learning Data
- •Quiz answers and scores
- •Topic and subject performance metrics
- •Time spent on practice sessions
- •Practice exam results and band estimates
- •Study plan activity and completion status
- •Badge and achievement history
Payment Information
- •Subscription plan selection
- •Billing name and email address
- •Payment card details — processed exclusively by Stripe (PCI-DSS Level 1 certified)
- •SmartNAPLAN never stores raw card numbers, expiry dates, or CVV codes
Usage & Technical Data
- •Pages visited and features used
- •Browser type, device type, and operating system
- •IP address (used for security and rate-limiting only; not stored in our database beyond active request logs)
- •Session duration and click patterns
- •Error logs and performance data
We do not collect sensitive information such as racial or ethnic origin, health information, religious beliefs, or biometric data. We do not collect government identifiers such as Tax File Numbers, Medicare numbers, or passport numbers.
How We Use Your Information
We use collected information solely for the purposes described below. We do not use student learning data for advertising or marketing purposes — ever.
Providing personalised quizzes, study plans, progress tracking, and practice tests aligned to the student's year level and performance profile.
Analysing aggregated, anonymised usage data to identify how to improve questions, features, and the user experience.
Sending account-related notices (password resets, subscription confirmations), and optional learning tips newsletters (opt-in only).
Verifying payment details and managing subscription billing through our secure third-party payment processor (Stripe).
Detecting and preventing fraud, abuse, or unauthorised access. Meeting legal obligations under Australian privacy law.
Generating progress reports and performance insights for students and parents. Aggregated class-level analytics for school accounts.
Direct Marketing (APP 7): We only send promotional or marketing emails to parents who have explicitly opted in at registration or in their Account Settings. Transactional emails — subscription confirmations, password resets, billing receipts, and weekly progress reports — are always sent as part of the service. You may opt out of marketing emails at any time via the unsubscribe link in any marketing email or from Account Settings → Communication Preferences.
Data Sharing
SmartNAPLAN does NOT sell, rent, or trade your personal information — or your child's learning data — to any third party. This is not qualified by any exceptions. It is an absolute commitment.
We may share information only in the limited circumstances listed below, and only with service providers who are contractually bound to protect it:
- •Stripe (payment processing) — receives billing information necessary to process subscription payments. Stripe is PCI-DSS Level 1 compliant.
- •Uptime Web Hosting (cloud hosting) — hosts the Platform infrastructure in a Sydney, Australia data centre. 100% Australian-owned and operated. Subject to strict data processing agreements.
- •Sentry (error monitoring) — receives anonymised error logs and crash reports to help us fix bugs. No personally identifiable information is included.
- •Amazon Web Services SES (transactional email) — AWS Simple Email Service delivers account notifications including password resets, subscription confirmations, and progress reports. Not used for marketing without opt-in consent. Data is processed in the AWS region configured for the Platform.
- •Legal disclosure — we may disclose information if required by a court order, subpoena, or applicable Australian law, after seeking legal advice.
All third-party service providers are required to maintain strict confidentiality and use your information only as instructed by SmartNAPLAN.
Data Security
We take data security seriously and implement industry-standard technical and organisational measures to protect your information.
All data transmitted between your browser and our servers is encrypted using TLS 1.2+.
All personal data stored in our databases is encrypted at rest using AES-256 encryption.
Staff access to personal data is restricted on a need-to-know basis and logged for audit.
Passwords are stored as bcrypt hashes — never in plain text or reversibly encrypted form.
We monitor systems for unusual access patterns and potential security threats continuously.
We collect only what is necessary and retain it only as long as needed for the stated purpose.
While we take every reasonable precaution, no method of transmission over the internet is 100% secure. In the event of a data breach that is likely to cause serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) within 30 days of becoming aware of the breach, as required by the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).
Cookies & Tracking
SmartNAPLAN uses a small number of cookies and similar technologies to ensure the Platform functions correctly and to understand how it is used.
We do not use cookies for advertising purposes or to track you across third-party websites. You can manage cookie preferences in your browser settings. Disabling essential cookies will prevent you from logging in to the Platform.
Your Rights
Under the Australian Privacy Act and GDPR (where applicable), you have the following rights with respect to your personal information:
Request a copy of all personal information we hold about you or your child. We will respond within 30 days.
Request correction of any inaccurate or incomplete personal information. Corrections are processed within 14 days.
Request deletion of your account and all associated personal data. Deletion is completed within 30 days, except where legally required to retain records.
Request a portable copy of your personal data by emailing support@smartnaplan.com.au. We will compile and deliver your data within 30 days at no charge.
Opt out of non-essential email communications at any time via the unsubscribe link in any email, or from Account Settings.
Object to certain uses of your data (such as analytics) where we rely on legitimate interest as the legal basis for processing.
To exercise any of these rights, email us at support@smartnaplan.com.au with your request. We may need to verify your identity before processing the request. There is no charge for making a request.
Children's Privacy
SmartNAPLAN is designed for students in Years 1–7. We take the privacy of children very seriously and apply additional protections to all accounts associated with students, particularly those under 13 years of age.
Under-13 Parental Consent Requirement
Students under 13 must not create their own SmartNAPLAN account. A parent or guardian must create a Parent account and add the child using the "Add Child" flow, which requires explicit parental consent before any of the child's data is collected. Direct student registration (without a parent account) is only for students aged 13 and over. If we become aware that a child under 13 has registered without parental consent, we will delete that account promptly. To report such an account, contact support@smartnaplan.com.au.
SmartNAPLAN collects personal information about children. A parent or guardian must create the account on behalf of children under 13 and provides explicit consent to the collection of the child's name, year level, quiz performance data, and usage activity. The types of children's data we collect include: name, school year, quiz scores, study time, and earned certificates — collected solely to provide the educational service and personalise learning. This data is never sold or used for advertising. (Australian Privacy Principles 3, 5 — collection of children's personal information.)
- •Students under 13 must have their account created by a parent or guardian. The parent/guardian provides explicit consent before any child data is collected.
- •Students aged 13–17 may register directly but are strongly encouraged to use a parent-managed account for full parental oversight.
- •We do not direct advertising of any kind to students or minors.
- •Student learning data (quiz results, progress, performance) is accessible only by the student and their linked parent/guardian account.
- •We do not collect more information from students than is necessary for the educational purpose of the Platform.
- •Parents can view, correct, or delete their child's data at any time through the parent dashboard or by contacting us directly.
- •Student data is never used for purposes outside of providing and improving the educational service.
- •We do not share student data with schools or teachers without express parental consent, except where required by a school account arrangement with a signed Data Processing Agreement.
Artificial Intelligence Use
SmartNAPLAN uses artificial intelligence (AI) technology to enhance certain features on the Platform. This section explains exactly which features use AI, what data is involved, and how that data is handled.
When a student completes a writing task on the SmartNAPLAN Platform, AI is used to automatically review and provide feedback on that writing response. This includes checking for grammar, spelling, punctuation, sentence structure, and writing quality — similar to an automated proofreading and assessment tool.
- •The text of the student's writing response is submitted to an AI model (powered by Anthropic's Claude API) for analysis and feedback
- •Only the writing text itself is transmitted to the AI — no student name, email address, date of birth, or other identifying information is included in the AI request
- •The AI analyses the writing and returns structured feedback covering grammar, vocabulary, structure, and overall quality
- •This AI-generated feedback is stored on SmartNAPLAN's servers and is visible only to the student and their linked parent or guardian
- •The AI model provider (Anthropic) does not retain submitted writing text for model training — each request is processed and discarded
- •AI feedback is for educational guidance purposes only — it does not constitute a formal NAPLAN assessment and results may not be perfectly accurate
Parent consent: By allowing your child to complete a writing assessment on the Platform, you acknowledge and consent to the child's writing text being processed by our AI writing feedback system as described above. No personally identifying information is shared with the AI provider during this process.
- •AI-assisted question generation: Some practice questions and explanations on the Platform may be wholly or partially generated by AI. All AI-generated content is reviewed for quality before being published.
- •Personalised study plan recommendations: AI may be used to analyse a student's performance data and suggest which topics to focus on next. This processing uses only data already stored on the Platform.
- •No AI is used to make automated decisions about a student's educational attainment, school progression, or any matter with legal or significant real-world effect.
If you have any questions or concerns about how AI is used on the SmartNAPLAN Platform, or if you wish to opt your child out of AI writing feedback, please contact us at support@smartnaplan.com.au.
Third-Party Services
SmartNAPLAN uses a small number of third-party services to operate the Platform. Each provider is carefully selected and is subject to a Data Processing Agreement that restricts how they may use your data.
Handles all payment card processing. SmartNAPLAN never receives or stores raw card data. Stripe is PCI-DSS Level 1 certified — the highest payment security standard.
Privacy policy: stripe.com/privacy
Hosts the SmartNAPLAN application and database infrastructure in a Sydney, Australia data centre. 100% Australian-owned hosting, ensuring all data remains in Australia.
Privacy policy: uptimewebhosting.com.au/privacy
AWS Simple Email Service (SES) delivers transactional emails such as password resets, subscription confirmations, and progress reports. Not used for marketing without explicit opt-in consent.
Privacy policy: aws.amazon.com/privacy
Captures anonymised error reports to help us identify and fix bugs. Personal information is stripped before error reports are sent.
Privacy policy: sentry.io/privacy
When a parent purchases AI Writing Feedback credits, the text of the child's writing response is sent to Anthropic's Claude API for analysis. Only the writing text is transmitted — no name, email, or identifying information is included. Anthropic's API does not retain submitted text for model training. Feedback results are stored on SmartNAPLAN's servers and visible only to the parent and student.
Privacy policy: anthropic.com/privacy
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
- •The "Last updated" date at the top of this page will always show the most recent revision date.
- •For material changes — those that significantly affect how we use your data — we will notify users via email and/or an in-platform notification at least 14 days before the changes take effect.
- •Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the updated terms.
- •For changes that require fresh consent under applicable law, we will request explicit consent before the change takes effect.
We recommend revisiting this page periodically. Archived versions of previous policies are available on request by emailing support@smartnaplan.com.au.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact our Privacy Officer:
This Privacy Policy is governed by the laws of New South Wales, Australia. Any disputes relating to privacy will be resolved in the courts of New South Wales. Australian residents may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or call 1300 363 992, at no charge.
If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. For users in the EEA, you may also contact your local data protection authority.
SmartNAPLAN Pty Ltd · ABN 18 158 633 508 · Registered in New South Wales, Australia
This Privacy Policy was last reviewed and updated in June 2026. SmartNAPLAN complies with the Australian Privacy Act 1988, the Australian Privacy Principles (APPs 1–13), the Notifiable Data Breaches (NDB) scheme, and applicable state privacy legislation.