Privacy Policy

Data We Collect

• Account information: Name, email address, school/organisation name
• Student data: Names, class rosters, and activity data provided by schools
• Student photographs and work samples: Where a school chooses to use them — a student photo in Classroom Pro™, or uploaded work samples in Formative Check™. Stored privately in Australia and never publicly accessible (see below)
• Usage data: Feature usage, timestamps, and session information
• Device information: Browser type, operating system (for PWA/mobile apps)
• Authentication data: OAuth tokens from Google sign-in (not stored long-term)

Where Data is Stored

• Application hosting: Vercel (Sydney region available for Australian schools)
• Database: Neon PostgreSQL (encrypted at rest, SOC 2 Type II compliant)
• Authentication: id.tebtally.com (self-hosted identity provider)
• File storage (photos, work samples): Cloudflare R2, Oceania region — private objects served only through an authenticated proxy, never by a public URL

Data is stored in secure, access-controlled databases. We use encryption in transit (TLS 1.3) and at rest for all sensitive information.

Security Measures

• Row-level security: Database isolation ensures schools only see their own data
• Role-based access: SUPERADMIN → ADMIN → TEACHER → STUDENT hierarchy
• Rate limiting: Protection against abuse on authentication and API endpoints
• Audit logging: All sensitive actions are logged for accountability
• Password security: bcrypt hashing with secure salt rounds
• Session management: JWT tokens with 24-hour expiry, httpOnly cookies

How We Use Data

• To provide and operate the TebTally™ services
• To authenticate users and manage access permissions
• To provide customer support and respond to enquiries
• To improve our services based on anonymised usage patterns
• To send service-related notifications (not marketing without consent)

Data Sharing and Sub-Processors

We do not sell personal information. We only share data with the following third-party sub-processors when necessary to provide the service. The lawful basis for all processing below is legitimate interest (providing the contracted educational service) and contractual necessity under the Australian Privacy Act and GDPR.

Student and school data — databases, authentication, and uploaded files — is stored in Australia (Sydney, ap-southeast-2), with file storage in the Oceania region (Australia or New Zealand). Student names, behaviour records, photographs and work samples do not leave that region.

The one exception is transactional email. Where a school enables behaviour notifications, the alert identifies the student by first name and last initial only (for example, "Jack T."), delivered via Resend in the United States. Full names are not used in email.

Overseas services otherwise receive no student information at all. Product analytics receives an opaque user identifier with no name or email address attached; error monitoring receives diagnostic data with personal information scrubbed and on-screen text masked; payment processing (Stripe) receives billing details for the school, not students.

Your Rights

Under GDPR and the Australian Privacy Act, you have the right to:

• Access: Request a copy of your personal data
• Export: Download your data in a portable format (JSON)
• Correction: Update inaccurate personal information
• Deletion: Request deletion of your account and data
• Objection: Object to certain processing of your data

To exercise these rights, contact privacy@tebtally.com. We will respond within 30 days.

Data Retention

• Account data is retained while the account remains active
• Student data is retained according to school policies and applicable law
• Deleted accounts are purged within 30 days of confirmed deletion request
• Anonymised analytics data is retained for up to 24 months
• Audit logs are retained for 2 years for security and compliance

Data Breach Notification

In the event of a data breach affecting personal information, we will:

• Notify affected schools within 72 hours of confirming the breach
• Provide details of what data was affected and remediation steps
• Report to relevant authorities as required by law (OAIC in Australia, supervisory authorities under GDPR)

Cookies and Analytics

We use essential cookies for authentication and session management. We use PostHog for anonymised product analytics to understand how features are used. We do not use cookies for advertising or tracking across websites.

Children's Privacy

TebTally™ services are designed for use in educational settings. Student accounts are created and managed by schools in compliance with COPPA (US), GDPR (EU), and Australian privacy requirements. We do not knowingly collect personal information directly from children under 13 without parental or school consent.

Privacy Complaints

If you believe your privacy has been breached or you have a concern about how we handle personal information, you may lodge a complaint by emailing privacy@tebtally.com.

• We will acknowledge your complaint within 5 business days
• We will investigate and respond with a resolution within 30 days
• If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC)

Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated to school administrators via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

Contact Us

For privacy questions, data requests, or concerns:

• Email: privacy@tebtally.com
• Support: support@tebtally.com

TebTally™ (operated by Jayden Tebble, sole trader)
ABN 96 110 054 130
Business name registered with ASIC
Victoria, Australia