Privacy Policy

Last updated: 13 February 2026

1. Overview

SkillTiles Pty Ltd (ABN pending) ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We are committed to full compliance with the APPs regardless of whether the small business exemption (for organisations with an annual turnover under $3 million) applies to us, and we proactively adopt the highest standards of data protection for all users.

2. Information We Collect

We collect the following types of information:

• Account information: Email address and display name when you create an account
• Learning data: Topics accessed, tiles completed, XP earned, streaks, and milestones achieved
• Payment information: Billing details processed securely through Stripe — we do not store card numbers
• Usage data: Browser type, device information, IP address, and pages visited (collected automatically)
• User-generated content: Topic suggestions and any feedback submitted through the platform

3. How We Use Your Information

We use your personal information to:

• Provide, maintain, and improve the Service
• Track your learning progress and personalise your experience
• Process payments and manage subscriptions
• Display your username on the public leaderboard (if you opt in)
• Send important account notifications (e.g., billing, security)
• Analyse usage patterns to improve content and features
• Comply with legal obligations

We do not use your personal information for marketing without your explicit consent.

4. AI and Automated Decision-Making

SkillTiles uses artificial intelligence to generate learning content (Tiles), evaluate quiz responses, and personalise topic recommendations. In accordance with the new transparency requirements under APP 1.7 and APP 1.8 (effective 10 December 2026), we disclose the following about our use of automated decision-making (ADM):

Kinds of personal information used by our AI systems:

• Topics you have accessed and learning paths you follow
• Tile completion data, quiz responses, and XP earned
• Streak and milestone history
• Difficulty preferences inferred from your performance

Kinds of decisions made solely by automated systems:

• Generation of learning content (Tiles) for your selected topics
• Automatic difficulty adjustment based on your quiz performance
• XP calculation, streak tracking, and badge awarding

Kinds of decisions substantially assisted by automated systems:

• Personalised topic recommendations based on your learning history
• Content quality assessments that may influence what tiles are shown

No automated decisions are made that significantly affect your legal rights or interests. All subscription, account, and billing decisions are made by human processes. You may contact us to request a human review of any automated decision at any time.

5. How We Share Your Information

We may share your information with:

• Stripe — for secure payment processing (see Stripe's Privacy Policy)
• Supabase — our database and authentication provider, hosted on servers in Sydney, Australia
• OpenAI / AI providers — to generate learning content. We send topic and milestone identifiers only — no personal information is shared with AI providers
• Vercel — our hosting provider (servers in Sydney, Australia)

We do not sell your personal information to third parties.

6. Cross-Border Data Transfers

Some of our service providers (Stripe, AI providers) may process data outside Australia, including in the United States. Where this occurs, we take reasonable steps to ensure data protection standards consistent with the APPs are maintained, in accordance with APP 8.

7. Data Security

We implement reasonable technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication via magic link (passwordless)
• Row-level security policies on our database
• Regular security reviews and access controls
• Privacy-by-design principles integrated into platform architecture

No method of electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Notifiable Data Breaches

In the event of an eligible data breach that is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. This means we will promptly notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or compliance purposes.

10. Your Rights

Under the Australian Privacy Act, you have the right to:

• Access your personal information held by us
• Correct any inaccurate or out-of-date information
• Request deletion of your account and all associated personal data — we will action deletion requests within 30 days
• Request human review of any automated decision that affects you
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

To exercise any of these rights, contact us at privacy@skilltiles.com.

11. Statutory Tort for Serious Invasions of Privacy

Since 10 June 2025, Australian law provides individuals with a private right of action for serious invasions of privacy (Schedule 2 of the Privacy Act). This means individuals may bring a claim where there has been an intentional or reckless intrusion upon seclusion or misuse of personal information that is serious in nature.

We take our obligations seriously. We implement strict internal controls, access policies, and staff training to ensure that no intentional or reckless conduct leading to privacy invasions occurs within our organisation.

12. Children's Privacy

SkillTiles is designed for general audiences and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete it.

We are monitoring the development of the Children's Online Privacy Code (COPC), to be developed by December 2026, and will comply with its requirements once finalised.

13. Cookies & Analytics

We use essential cookies for authentication and session management. We may use anonymous analytics to understand usage patterns. We do not use tracking cookies for advertising purposes.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or by posting a notice on the Service. Your continued use after changes take effect constitutes acceptance of the updated policy.

15. Contact & Complaints

If you have questions, concerns, or a complaint about our handling of your personal information, contact us at:

Email: privacy@skilltiles.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

See also our Terms of Service.