Privacy Policy

Summary

School Operations (“we”, “us”, or “our”), provides an online platform for school operations teams at schooloperations.com.au. To deliver the service, we process:

• Account information about registered users — such as email address, authentication details, and role within a school.
• School operational information uploaded or imported by authorised school users — including staff and student names and contact details, timetables, enrolments, learning adjustments, exam provisions, casual relief teacher contacts, and related files.
• Access request information — when a school submits the public Request access form, such as contact name, email address, phone number, role title, optional message, and school selection from the Australian schools reference register (ACARA).
• Billing information for school subscriptions — invoice details, payment dates, and subscription status.
• Technical and analytics information — such as session cookies, consent preferences, server logs, reCAPTCHA signals (when you accept functional cookies), and aggregated usage data via Google Analytics (when you accept analytics cookies).
• Integration data — where your school configures features such as SAC Outlook sync or CRT SMS, information may be sent to services your school chooses (for example Microsoft Power Automate or Twilio).

We use this information to operate, secure, and improve the platform. We do not sell personal information. We share data with service providers that help us run the service, when required by law, or at your school's direction through configured integrations.

This Privacy Policy should be read together with our Terms of Service. Where this policy and the Terms differ on privacy matters, this policy prevails for how we handle personal information.

1. Who this policy applies to

This Privacy Policy applies to:

• Visitors to our public website (home, features, pricing, demo site, and legal pages).
• Prospective schools submitting access requests via the public Request access form.
• Users who register for, sign in to, or are invited to use the School Operations platform.
• School administrators who manage a provisioned school workspace.
• Individuals whose information is stored in a school workspace — including staff, students, and casual relief teachers whose details are uploaded by authorised school users.

The Service is designed for use by schools and their authorised staff. It is not intended for children to create their own accounts. Where student information appears in the platform, it is provided by the school for legitimate operational purposes.

2. Our role and your school's role

Privacy law distinguishes between organisations that decide why and how personal information is used (often called a “controller” or “APP entity”) and organisations that process information on someone else's instructions (often called a “processor” or “service provider”).

If you are a staff member, student, or casual relief teacher whose details appear in the platform, contact your school in the first instance for questions about why your information was collected or how your school uses it. We will assist schools in responding to valid requests where we hold the data on their behalf.

3. Information we collect

The information we process depends on how you interact with the Service.

3.1 Account and profile information

• Email address and, where provided, name associated with your account.
• Authentication credentials when you sign in with email and password.
• Two-factor authentication settings and recovery codes (stored securely; we do not store TOTP secrets in plain text).
• School membership, assigned roles, and function permissions.
• Records of school invites sent or accepted, and masquerade sessions initiated by administrators.
• School linkage for provisioned accounts, including association with Australian schools reference data (ACARA) where applicable.

3.2 School workspace information

Authorised users at your school may upload or import operational data, which can include:

• Staff information — first name, last name, email address, teacher codes or initials, timetable assignments, yard duties, meetings, distribution list outputs, and staff intentions (including employment status, FTE preferences, leave requests, and subject preferences).
• Student information — first name, last name, email address, student codes, class enrolments, year levels, subject choices, approval records, and scheduling or assessment-related data.
• Learning adjustment and exam provision data — SEA summary imports and related fields such as rest breaks, separate-room or small-group settings, medication or food/drink provisions, reader/clarifier arrangements, and other special examination or classroom adjustments.
• Casual relief teacher details — names, email addresses, and mobile phone numbers stored in your school's CRT pool.
• Timetable and operational files — TFX imports, calendars, SAC schedules, CSV and Excel uploads, generated PDFs, and other documents uploaded for school use.
• School settings — school name, slug, subscription status, integration URLs (such as Power Automate webhook endpoints), and configuration choices.

3.3 Billing information

• School name and contact details used for tax invoices.
• Payment received dates, subscription status, and licence expiry.
• We do not collect or store payment card numbers. Schools pay by bank transfer using details on our invoice.

3.4 Contact, access requests, and feedback information

• Messages submitted through our public contact form — such as name, email address, subject, and message content.
• Access requests submitted through the public Request access form — such as contact name, email address, phone number, role title, optional message, and school selected from the ACARA register.
• Suggestions submitted through the in-app “Suggest an improvement” widget — including title, suggestion text, your account email, school name, and the page URL you were viewing.
• reCAPTCHA response tokens and related signals when you use the Request access form, invite sign-up, or the contact form (only when you have accepted functional cookies).

3.5 Technical information

• Session and security cookies required to keep you signed in and protect against cross-site request forgery.
• A consent cookie (so_cookie_consent) that stores your essential, functional, and analytics cookie preferences for up to one year.
• Server and application logs — such as IP address, browser type, request timestamps, and error diagnostics.
• Background job metadata related to imports, scheduling tasks, webhook pushes, and SMS delivery status.
• Inbound SMS content and sender numbers when casual relief teachers reply to CRT offers via Twilio.

3.6 Analytics information

• Aggregated or pseudonymous usage data collected through Google Analytics when you accept analytics cookies — such as pages viewed, feature navigation, session duration, device type, and approximate location derived from IP address.

3.7 Sensitive information

We do not require schools to upload sensitive information to use the Service. However, modules such as Learning Diversity and Exams are designed to process health-related and disability adjustment information when your school chooses to import or enter it (for example medication provisions, medical flags, or special examination arrangements in SEA summary data).

Your school decides whether to upload sensitive information and must ensure it has a lawful basis to do so, that only necessary information is included, and that access is restricted to authorised staff. We process sensitive information uploaded by your school solely to provide the relevant modules and apply appropriate security controls, but we do not use it for advertising, resale, or unrelated commercial model training.

4. How we collect information

We collect information:

• Directly from you — when you register via a school invite, sign in, update your profile, enable 2FA, submit the contact or Request access form, send improvement suggestions, or interact with platform features.
• From access requests — when a school representative submits the public Request access form before a workspace is provisioned.
• From your school — when administrators invite you, assign roles, configure integrations, or upload/import operational data on behalf of the school.
• From casual relief teachers — when they respond to CRT offers by email link or SMS.
• From billing records — when we issue invoices and record bank transfer payments for school licences.
• Automatically — through cookies, server logs, analytics tools, and integration callbacks when you use the website or platform.

5. How we use information

We use personal information to:

• Provide, operate, maintain, and support the Service for your school.
• Create and manage user accounts, verify email addresses, and enforce access controls.
• Process timetable imports, generate operational views, PDFs, and exports, and deliver tools across Admin, Timetable, VCE Manager, Exams, Learning Diversity, Daily, General, and Support modules.
• Send transactional communications — including verification emails, school invites, CRT offers, security notices, and service announcements.
• Push confirmed SAC calendar changes to your school's Power Automate webhook when configured.
• Send and receive CRT SMS messages through Twilio when enabled.
• Process school subscriptions, renewals, and billing support for invoiced licences.
• Respond to contact form submissions and product feedback.
• Monitor performance, troubleshoot errors, detect abuse, and protect the security and integrity of the platform.
• Understand how the Service is used and improve features, navigation, and reliability.
• Comply with legal obligations and respond to lawful requests.

We do not use staff or student information from school workspaces to build advertising profiles, target individuals with third-party marketing, or train unrelated commercial artificial intelligence or machine-learning models.

6. Legal bases for processing

We process personal information where permitted under applicable privacy law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Depending on the context, our bases include:

• Performance of a contract — to provide the Service you or your school signed up for, including account access, school tools, and operational features.
• Legitimate interests — to secure the platform, prevent fraud and abuse, improve the Service, and understand aggregated usage, balanced against your privacy rights.
• Legal obligation — where we must retain or disclose information to comply with law, including notifiable data breach obligations where applicable.
• Consent — where required, such as where your school has obtained appropriate consent for student or sensitive information it uploads, or for optional communications to casual relief teachers.
• School instructions — for staff, student, and CRT data in a workspace, and for school-configured integrations, we process information as a service provider acting on the school's documented instructions.

7. When we share information

We do not disclose personal information except as described in this policy. We may share information with:

• Service providers who help us operate the Service under contractual confidentiality and security obligations, including:
  • Cloud hosting and database providers (for example infrastructure used to run the application in Australia or other regions)
  • Email delivery services (SMTP providers used to send transactional email)
  • Twilio — SMS delivery and inbound SMS webhooks for CRT booking when enabled
  • Google reCAPTCHA — spam protection on the Request access form, invite sign-up, and the contact form (when functional cookies are accepted)
  • Google Analytics — website and product analytics (when analytics cookies are accepted)
  • YouTube — embedded video players in Support guides (when functional cookies are accepted)
  • Background job infrastructure (for example Redis and Celery workers)
• School-configured recipients — when your school administrator configures integrations, such as posting confirmed SAC calendar payloads to a Microsoft Power Automate HTTP webhook operated by or for your school.
• Your school — user account details and activity within a school workspace are visible to authorised administrators at that school according to role permissions.
• Professional advisers — lawyers, accountants, or insurers where reasonably necessary.
• Law enforcement or regulators — when required by law, court order, or to protect rights, safety, or the integrity of the Service.
• Business transfers — if we are involved in a merger, acquisition, or asset sale, personal information may transfer subject to continued protections consistent with this policy. We would notify affected schools of any material change in ownership or control.

Service providers may only use personal information to deliver services to us and must not use it for their own unrelated marketing purposes, except where they are acting directly under your school's instructions through a configured integration.

8. We do not sell personal information

We do not sell personal information. We do not sell, rent, lease, license, or otherwise disclose personal information to third parties for monetary or other valuable consideration so they can market to your staff, students, or users.

This commitment applies to all personal information we process, including:

• Registered user account details
• Staff and student names, contact details, and operational records
• Learning adjustment, exam provision, and health-related fields uploaded by schools
• Casual relief teacher contact details
• Timetable, enrolment, and operational data uploaded by schools

We also do not share school roster or student list data with data brokers, advertising networks, or unrelated commercial partners. Analytics data collected via Google Analytics is used solely to understand and improve the Service, as described below.

9. Cookies and similar technologies

Cookies are small text files stored on your device. We group cookies into three categories: essential (always active), functional (optional), and analytics (optional). Non-essential scripts and cookies are blocked until you save a choice via the cookie banner or Cookie preferences link in the site footer.

Essential cookies

These cookies are required for core functionality and cannot be switched off:

• Session cookies — to keep you signed in as you navigate the platform.
• Security cookies — including CSRF protection tokens that help prevent unauthorised form submissions.
• Consent cookie (so_cookie_consent) — stores your cookie category choices for up to one year.

Functional cookies

If you accept functional cookies, we may load:

• Google reCAPTCHA — on the Request access form, invite sign-up, and the public contact form to distinguish legitimate users from automated abuse. Google may collect device and interaction signals under its own policies.
• YouTube embeds — in Support guide and video pages to play help videos. YouTube may set cookies or collect usage data under Google's policies.

Without functional consent, these features are withheld — for example, public forms that require reCAPTCHA cannot be submitted until you accept functional cookies.

Analytics cookies

If you accept analytics cookies, we load Google Analytics to understand how the site and product are used. See the Google Analytics section for details. Google Analytics is not loaded until you opt in.

Managing your choices

When you first visit the site, a cookie banner lets you accept all cookies, reject non-essential cookies, or manage preferences by category. You can reopen your choices at any time via Cookie preferences in the site footer. Changing your preferences takes effect on the next page load.

10. Google Analytics

We use Google Analytics to collect information about how visitors and users interact with our website and platform — but only when you accept analytics cookies. This helps us measure performance, understand which features are useful, and prioritise improvements.

Google Analytics may collect:

• Pages and screens viewed, links clicked, and navigation paths
• Approximate geographic location (derived from IP address, often at city level)
• Device type, operating system, and browser
• Session duration, bounce rate, and referral source

Google Analytics is configured for product and website analytics. It is not used to sell school data, build advertising profiles from staff or student records, or merge analytics identifiers with operational school workspace data for third-party marketing.

Google processes analytics data under its own terms and privacy policies. Data may be processed on servers outside Australia. Learn more at Google's Privacy Policy and How Google uses data from sites that use its services.

Your choices:

• Accept or reject analytics cookies via the cookie banner or Cookie preferences in the site footer.
• Use browser settings or extensions to block or delete cookies.
• Install Google's opt-out browser add-on where available.
• Adjust device or browser privacy settings to limit tracking.

Blocking analytics cookies does not prevent you from using core features of the Service, though it limits our ability to measure and improve the user experience.

11. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including:

• Active accounts — for the duration of your or your school's use of the Service.
• School workspace data — while the school maintains an active workspace, unless the school requests deletion or deletes specific imports or records through available tools.
• Import history — timetable and other imports may be retained to support activation, rollback, and audit needs; archived imports may be deleted by school administrators.
• Terminated schools — when a school stops subscribing, we will make reasonable export assistance available for a limited period where practicable, then delete or de-identify active workspace data except where retention is required by law. Residual copies may persist in encrypted backups for a limited time before being overwritten.
• Billing records — as required for tax, accounting, and dispute resolution, typically for up to seven years where applicable.
• Security and server logs — for a limited period appropriate for troubleshooting and incident response, then deleted or aggregated.
• Contact and feedback messages — for as long as needed to respond and maintain a reasonable support history.
• Analytics data — according to Google Analytics retention settings configured by us.

When information is no longer needed, we take reasonable steps to delete or de-identify it. Some data may persist in encrypted backups for a limited period before being overwritten.

12. Security and data breaches

We implement administrative, technical, and organisational measures designed to protect personal information, including:

• Tenant isolation between schools at the application and database level
• Role-based access controls within each school workspace
• Encrypted connections (HTTPS) in production environments
• Hashed password storage and support for two-factor authentication
• Content Security Policy and other web security headers
• Monitoring, logging, and access restrictions for production infrastructure
• Additional care for sensitive information uploaded by schools into Learning Diversity and Exams modules

No method of transmission or storage is completely secure. While we work hard to protect information, we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and notifying your school administrator if you suspect unauthorised access.

Data breach response

We maintain procedures to investigate suspected security incidents. If we become aware of unauthorised access to, or disclosure of, personal information that we hold and that is likely to result in serious harm, we will:

• Take reasonable steps to contain and remediate the incident
• Assess whether the incident is an eligible data breach under the Notifiable Data Breaches scheme
• Notify affected individuals and the Office of the Australian Information Commissioner (OAIC) where required
• Notify affected schools promptly where school workspace data is involved, so the school can meet its own legal obligations

To report a suspected security issue, contact privacy@schooloperations.com.au or use our contact form.

13. Your privacy rights

Depending on your location and relationship to the Service, you may have rights regarding your personal information. Under the Australian Privacy Principles, these may include the right to:

• Access — request confirmation of whether we hold personal information about you and obtain a copy where permitted by law.
• Correction — request correction of inaccurate, out-of-date, incomplete, or misleading information.
• Complaint — lodge a complaint about our handling of personal information.

If you are a registered user, you can update some account information directly through the platform or by contacting us. If your information appears in a school workspace because your school uploaded it, please contact your school administrator first; we will assist the school with valid requests.

To make a privacy request to School Operations, email privacy@schooloperations.com.au. We may need to verify your identity before responding. We aim to respond within a reasonable period, and in any event within 30 days where required by the Privacy Act.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Staff and student information

Schools may store staff and student personal information in the platform to support legitimate operational activities — such as timetabling, class lists, exam scheduling, learning adjustments, staff communications, and coordination workflows.

• Schools are responsible for ensuring they have a lawful basis to collect and upload this information, including compliance with applicable education, privacy, and child protection requirements.
• Schools should upload only information that is reasonably necessary for the operational purpose.
• Access within a school should be limited to staff who need the information for their role.
• Where sensitive or health-related adjustment information is uploaded, schools should apply heightened care consistent with their policies and applicable law.
• We process staff and student information solely to provide the Service to the school, not for unrelated marketing or resale.

15. International transfers

School Operations is based in Australia. Our service providers — including hosting, email, SMS, analytics, spam-protection, and video embed providers — may process personal information in Australia and other countries (including the United States, where Google, Twilio, and YouTube may process data).

Where personal information is disclosed to overseas recipients, we take reasonable steps to ensure those recipients handle the information in a manner consistent with the APPs, such as through contractual protections and provider security standards. By using the Service, you acknowledge that cross-border processing may occur.

When your school configures a Power Automate webhook or other integration, data may also be processed in the countries where your school's Microsoft 365 or other systems operate. Your school is responsible for those environments.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or legal requirements. When we make material changes, we will post the updated policy on this page and revise the “Last updated” date.

For significant changes affecting how we handle school data, we may also provide notice through the platform or by email to school administrators. Continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes, unless otherwise required by law.

17. Contact and complaints

School Operations is the APP entity responsible for personal information described in this policy. Contact us at:

• Website: schooloperations.com.au
• Privacy enquiries: Contact form or privacy@schooloperations.com.au
• General support: Contact form or support@schooloperations.com.au

Please include enough detail for us to identify you and understand your request. If your enquiry relates to information in a school workspace, contacting your school administrator first will usually be the fastest path to resolution.

Related document: Terms of Service