Privacy policy

Ebiblo is operated by Ebiblo Pty Ltd (ABN 60 155 467 833), Sydney, New South Wales. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we apply them whether or not the Act requires it of us. Because many of the people who use Ebiblo are children, we take particular care with learners' information; see section 4.

1. What we collect

• Account details — your name, email address, sign-in method (email, Apple or Google) and the role you told us you have (tutor, teacher, trainer or parent). If you sign in with Apple or Google we receive only the details you allow them to share.
• Admin material — the files and prompts an Admin adds to input pages, and the question sets they approve.
• Learner details — the name, and email or username, an Admin uses to invite a learner to a private page.
• Answers and results — every attempt a learner makes, the answers given, the marks and the reasons, and progress over time.
• Notification tokens — a device token if you turn on push notifications in the iOS or Android app.
• Usage and technical information — pages visited, device and browser type, IP address and approximate location, so the Service works and we can see what is used.
• Correspondence — messages you send through the contact page.

We do not ask for sensitive information as the Act defines it. Admins should not include health, racial, religious or similar information in material or questions.

2. How we collect it

Directly from you when you create an account, set up a page or contact us; from an Admin when they invite a learner; from learners when they answer; from your device when you turn on notifications; and automatically through cookies and logs. You can use the public parts of the website without identifying yourself.

3. Why we use it

To run the Service: drafting question sets from an Admin's material, marking answers, showing results and progress to the learner and to the Admin who owns the page, and sending the notifications you have turned on. To bill you for a paid plan. To support you. To keep the Service secure and detect misuse. To understand how the Service is used and improve it. To meet our legal obligations. We do not use material or answers to train AI models, we do not sell personal information, and we show no advertising.

4. Learners and children

A learner under 18 can only join Ebiblo through an invitation from an Admin who has confirmed they are the child's parent or guardian, or a school or tutoring centre acting with parental consent. We collect the minimum a learner needs to answer and see their own results. A learner's answers and results are visible only to that learner and to the Admin of the page they answered on. Parents and guardians can ask to see or delete a child's information through the contact page; where the Admin is a school or centre we may also refer the request to them.

5. AI processing

Admin material and learners' written answers are processed by AI models — to draft questions and to mark written responses against an approved answer. This is done through Emidox, also operated by Ebiblo Pty Ltd, on an API key the Admin supplies to a third-party provider (for example OpenAI, Anthropic, Google or DeepSeek). The content of a draft or a marking run goes to that provider under their own terms and privacy policy. Learners' names are not sent to the model; answers are.

6. Who we share it with

• AI providers — as described in section 5.
• Service providers — hosting, storage, payment processing (Stripe), push-notification delivery (Apple and Google) and analytics providers who work for us under contract and may only use the information to provide their service.
• Emidox — the two products share your account details so you sign in once, and Emidox holds the agents and input pages behind your quiz pages.
• The Admin of a page — sees the learners on that page and their attempts. A Centre owner sees every page on the account.
• Where the law requires — to a court, regulator or law-enforcement body under a lawful request, or to protect our rights or someone's safety.

7. Overseas disclosure

Some of the providers above — AI model providers, hosting, payment and push-notification services — are located or store data outside Australia, including in the United States. By adding a provider's key in Emidox or turning on notifications you consent to the relevant information being sent to that provider in the country where it operates. We take reasonable steps to choose providers that handle information consistently with the APPs, but they are bound by their own laws and terms.

8. How we protect it

Data is encrypted in transit and at rest. Access to production data is limited to people who need it to run the Service. We use reputable hosting with access controls, logging and regular backups. No system is perfectly secure; if a data breach is likely to result in serious harm we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

9. How long we keep it

Account details are kept while your account is open. Attempts and results are kept while the page they belong to exists, so that progress can be seen over time; an Admin can delete a page, which deletes its sets and attempts. Closing your account deletes your material, answers and results, apart from records we must keep by law (for example billing records, kept for seven years) or need to resolve a dispute. Backups roll off within a short period after deletion.

10. Cookies and analytics

We use a sign-in cookie, a preference cookie for dark mode, and analytics that record page views and feature use in aggregate. We do not use advertising cookies. You can block cookies in your browser; the website will still work, but you will need to sign in each visit.

11. Access, correction and deletion

You can see and change your account details in the profile panel, and delete your account from there. For anything else — a copy of the personal information we hold about you or your child, a correction, or deletion — ask through the contact page. We will respond within 30 days, and will not charge for a reasonable request. If we refuse a request we will tell you why and how to complain.

12. Complaints

If you believe we have handled personal information in breach of the APPs, contact us through the contact page and we will investigate and respond within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes to this policy

We will post changes here and update the date above. Where a change materially affects how we handle your information we will tell you in the app before it takes effect.

14. Contact

Ebiblo Pty Ltd, Sydney, New South Wales, Australia — through the contact page.