Privacy Policy

Effective date: 15 August 2026

Who we are

findmeaschool.au is operated by Portable Labs, based in Melbourne, Victoria, Australia (“we”, “us”, “our”). findmeaschool.au helps parents and carers discover and compare Australian schools, and — if you choose to use it — build an AI-generated exam preparation plan for your child. This policy explains what personal information we collect, why, and how we handle it.

The short version

  • Browsing and comparing school data is free and needs no personal information beyond an account if you want to save things.
  • The Preparation Planner is separate and optional. It only reads documents you deliberately upload, and only after you give express consent for that.
  • Documents and plans are processed by Anthropic in the United States. They are not used to train anyone's AI models.
  • We do not sell personal information, we use no advertising cookies, and we run no third-party trackers.
  • You can delete any record, any child profile, or your whole account from inside the app at any time.

What we collect

  • Account information — your email address and password (stored as a hash), and profile details you choose to add.
  • Child profiles (optional) — a child's name, year level, state, interests and school preferences, entered voluntarily by you to support school planning features. You control this information and can edit or delete it at any time.
  • Child activities, achievements and results (optional) — extracurricular activities, awards and results you choose to record by hand.
  • Uploaded documents (optional) — school reports, NAPLAN reports and scholarship or selective-entry test results, as PDFs or photos. See the next section for what these really contain.
  • Preparation plans and progress — the plan the AI generates for your child, and which activities you mark complete.
  • Chat messages — messages you send to our AI assistant, and the responses generated.
  • Shortlists and preferences — schools you save and settings you choose.
  • Feedback — anything you submit through our feedback form.
  • Usage and log data — technical information such as IP address, browser type, pages viewed and timestamps, collected automatically to operate and secure the service. We also use Vercel Web Analytics, a privacy-friendly, cookieless service that records anonymous, aggregated page views — it does not identify you or track you across other sites.
  • Cookies — we use cookies for authentication (keeping you signed in) and to remember your theme preference. We do not use advertising cookies, and we do not run third-party tracking or profiling scripts.

We only collect what we reasonably need to run the features you use. You are not required to create a child profile or upload anything — the school directory, map, comparison and shortlist features all work without it. If you choose not to provide this information, the only consequence is that the Preparation Planner has less to work from, or cannot be used at all.

What uploaded school documents actually contain

We want to be blunt about this rather than let you discover it later. A real Australian school report or assessment document is rarely just marks. Depending on the school and the child, it may include:

  • your child's full name, date of birth, year level, class and student identifier;
  • the school's name and your child's attendance record;
  • subject results, NAPLAN bands, standardised test scores and teacher rating scales;
  • free-text teacher comments about behaviour, effort, wellbeing, friendships and classroom conduct;
  • health, disability and learning-support information — for example an adjustment recorded under the Nationally Consistent Collection of Data on School Students with Disability (NCCD), a reference to an Individual Education Plan, a speech/occupational therapy or literacy intervention, or a comment referring to a diagnosed or suspected condition.

That last category is sensitive information under the Privacy Act 1988 (Cth), which carries stronger protections than ordinary personal information. We therefore treat every uploaded document as if it contains sensitive information about a child, whether or not it actually does.

We collect it only with your express consent. Consent to this is not bundled into accepting our terms. Before your first upload is processed you are shown what will happen — including that the document is sent to Anthropic in the United States — and you must affirmatively agree. You can withdraw that consent at any time by turning off AI processing in your account and deleting the documents; withdrawing does not affect processing already carried out, and does not affect your use of the free parts of the service.

Please upload only what the planner actually needs. If a document contains information you would rather not share — a medical annexure or a support-plan attachment, for example — remove those pages or enter the results by hand instead. Every upload is optional.

Children's information

findmeaschool.au is a service for adults. Accounts are for parents, carers and guardians, who must be 18 or over. We do not knowingly collect information directly from children, and children do not have their own logins.

All information about a child reaches us through the parent or guardian who holds the account. By entering it, you confirm you have parental responsibility for that child (or the authority of someone who does) and that you consent, on the child's behalf, to us handling it as described in this policy.

Talking to your child about this

We consider a child's best interests when we design these features: uploads are off by default, nothing about a child is ever public, plan content is age-appropriate, and we collect the minimum the feature needs. Where a child is old enough to understand, we ask that you tell them what you are uploading and what the planner will do with it. Their school reports are, after all, about them.

Australia's Children's Online Privacy Code is being made by the Office of the Australian Information Commissioner and is expected to be registered by 10 December 2026. We are building to it now. When it commences we will apply its consent rules: broadly, a young person aged 15 or over can consent for themselves, and for a child under 15 a person with parental responsibility consents and the child is notified. We will update this policy and the in-app consent flow to match the Code as registered.

Why we collect it

  • To provide and personalise the service, including accounts, shortlists and planning features.
  • To operate the AI assistant and respond to your questions.
  • To generate, refresh and track a preparation plan for a child, where you have asked us to and consented to AI processing.
  • To respond to feedback and support requests.
  • To maintain security, prevent misuse and debug problems.
  • To manage subscriptions and payments, once paid plans are live.
  • To improve the product, including using aggregated, de-identified usage patterns.

We use information about a child only for the purpose you gave it to us for — building and running that child's plan — and for directly related purposes such as security and support. We do not use it for advertising or profiling, we do not sell it, and we never use it to train AI models.

AI processing and overseas disclosure

The Preparation Planner and the AI assistant are powered by Anthropic's Claude models, accessed through Anthropic's commercial API. To generate a plan we send Anthropic the material the plan is built from: the uploaded document (as a file or image), the results and notes recorded on the child profile, the child's year level and state, the target exam and date, and the plan being refined.

This is a disclosure to an overseas recipient, not just storage. Anthropic processes the data on servers in the United States. There is currently no Australian data-residency option for this API, and we will not pretend otherwise. United States privacy law differs from Australian law, and you may have fewer or different rights there.

What we can tell you about Anthropic's handling:

  • Commercial API inputs and outputs are not used to train Anthropic's models.
  • Anthropic's default arrangement is to delete API inputs and outputs within about 30 days. Exceptions are content flagged by their trust and safety processes, and material subject to a legal hold.
  • Anthropic offers a zero-data-retention arrangement on request. We have not obtained one, so the 30-day default applies. If that changes we will update this policy.

Under section 16C of the Privacy Act 1988 (Cth), Portable Labs remains accountable to you for how Anthropic handles this information as if we had handled it ourselves. If something goes wrong at Anthropic with data we sent, that is our responsibility to you, and you can raise it with us directly.

Supabase and Vercel also store and process data outside Australia, including in the United States. The same accountability applies to them.

Automated decision-making and the AI plan

The Preparation Planner is an automated process: software reads your child's information and produces an output without a human reviewing it first. Australian privacy law will require this to be explained from 10 December 2026, and we are explaining it now.

What information feeds the automated process

  • the child's year level, state, target exam and target exam date;
  • results and comments from school reports, NAPLAN reports and practice or entry tests you upload or enter;
  • anything else that happens to appear in an uploaded document, including teacher comments and any health, disability or learning-support notations it contains;
  • interests, activities and availability you record on the child profile;
  • your progress marks against the current plan.

What the automated process produces

  • an assessment of which subjects or skills the child appears strongest and weakest in;
  • a multi-week preparation schedule with weekly themes and daily study activities, mapped to a calendar;
  • suggested practice materials and resources, with sources cited;
  • a progress tracker built from that schedule.

What it is not

A plan is guidance for you, the parent. It is not a diagnosis, an assessment of your child's ability, a prediction of a result, or a decision that affects any right or entitlement your child has. It does not go to any school, exam body or third party. AI output can be wrong — you remain the decision-maker, and we ask you to read it with that in mind. If a plan says something about your child that you think is inaccurate, tell us at contact@portable-labs.com and you can also regenerate or delete the plan yourself.

Using findmeaschool.au without AI processing

AI processing of your child's documents is an affirmative, separate choice, not a condition of using the site. If you never turn it on:

  • the school directory, map, comparison, scholarship database and shortlist all keep working, free;
  • nothing about your child is sent to Anthropic for plan generation;
  • you can still keep a child profile and records for your own reference.

Turning it off later stops future processing and lets you delete what was uploaded. Note that the AI chat assistant, which you use by typing into it, sends your messages to Anthropic in the same way — so do not paste your child's report into the chat if you do not want it processed.

Who we share information with

We use a small number of service providers to run findmeaschool.au. We do not sell your personal information to anyone, and we do not share it with advertisers, data brokers, schools or tutoring businesses.

  • Supabase (United States) — database, authentication and file storage. Account data, child profiles, records, plans and uploaded documents are stored on Supabase infrastructure (Postgres and object storage).
  • Anthropic (United States) — AI processing of chat messages, uploaded documents and plan generation, as described above.
  • Vercel (United States) — application hosting, content delivery and server logs, plus Vercel Web Analytics (cookieless and anonymous).
  • Google — if you choose to sign in with Google (when available), Google provides us with your email address and basic profile information for authentication.
  • A payment processor (not yet live) — when paid plans launch we will use a third-party payment provider, expected to be Stripe, to take payments and manage subscriptions. Card details will be handled by that provider and will not be stored on our systems. We will name the provider here before any payment is taken.

These providers process data on our behalf under their own privacy and security commitments. We may also disclose information where the law requires it, or where it is reasonably necessary to protect someone's safety or to enforce our terms.

How long we keep things

We do not keep personal information longer than we need it. Concrete periods:

  • Uploaded documents — deleted immediately when you delete the record, the child profile or your account. Otherwise deleted 12 months after upload: one full exam cycle is as long as a report is useful for planning.
  • Results and notes you entered or that were read out of a document — kept while the child profile exists, because the plan is built from them, and deleted with the profile or the account.
  • Preparation plans and progress — the active plan is kept while the child profile exists. Superseded versions are kept for 12 months so you can look back over a preparation year, then deleted.
  • Chat transcripts — we do not store your AI chat transcripts on our servers. They are kept in your browser and you can clear them at any time. Anthropic holds the corresponding API inputs and outputs for up to about 30 days under the arrangement described above.
  • Account and profile data — kept while your account is active, deleted when you delete your account.
  • Server and security logs — retained for up to 30 days, then rotated out.
  • Feedback — kept for up to 24 months, and de-identified when you delete your account rather than deleted, so we do not lose the substance of what you told us.
  • Billing records (once payments are live) — kept for five years after the transaction, because Australian tax law requires it. These are payment records, not your child's data.

Deleting things yourself

  • One document or record — delete it on the child profile page. The stored file is deleted with it.
  • Everything about one child — delete the child profile. Its records, documents and plans go with it.
  • Everything — delete your account from your account settings. This removes your profile, children, records, documents, plans and shortlists. It cannot be undone.

Deleting removes data from our live systems immediately. Encrypted backups held by our infrastructure providers are overwritten on their own cycle, within 30 days. Copies already sent to Anthropic fall away under their 30-day retention default.

Your rights

You can access, correct or request deletion of your personal information at any time. Much of your data can be managed directly in the app; for anything else, contact us at contact@portable-labs.com and we will respond within 30 days. If you think something we hold — including something an AI plan says — is inaccurate, out of date or misleading, tell us and we will correct it or note your disagreement against it. If you have a privacy concern we cannot resolve, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Data breaches

If we suspect personal information we hold has been lost or accessed without authorisation, we will assess what happened within 30 days. If the breach is likely to cause you serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme, and tell you plainly what was affected and what to do about it. We will not sit on it.

Australian Privacy Act

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). A small business exemption may currently be available to us. We do not rely on it. Given that we handle children's information and are moving to a paid service, we commit to meeting the APPs in full, and to the Children's Online Privacy Code once it is registered.

Security

We take reasonable steps to protect your information:

  • encryption in transit (HTTPS/TLS) across the whole service;
  • passwords stored as hashes, never in readable form;
  • row-level security in the database, so a query can only ever return your own rows;
  • uploaded documents held in a private storage bucket that is never publicly readable, keyed by your account, with view links that expire after five minutes;
  • limits on who can access production data, and on what a single account can do.

No online service can guarantee absolute security, so please use a strong, unique password and tell us straight away if you think your account has been accessed by someone else.

Changes to this policy

We may update this policy as the product evolves. We will post the updated version on this page with a new effective date, and for material changes — including any change to how your child's information is processed — we will take reasonable steps to notify you before the change takes effect, and will ask for fresh consent where the law requires it.

Contact

Questions or requests about privacy: Portable Labs, Melbourne VIC, Australia — contact@portable-labs.com.