Privacy Policy

Effective date: 8 June 2026
Last updated: 12 August 2026

Preamble
I. Definitions
II. Who we are
III. Purposes, legal bases and retention periods
IV. Children and minors
V. Your rights
VI. Sharing, processors and international transfers
VII. How we use AI with your content
VIII. Cookies and similar technologies
IX. Data security and data breaches
X. Changes to this Policy
XI. Contact us

Preamble

In brief: This Policy explains what personal information we collect when you use gettopmarks, why we collect it, how long we keep it, who may access it, and the rights you have.

This Policy explains how we collect and handle your personal information when you use our Service. It sets out what data we process, why, how long we keep it, who may have access, and the rights you have and how to exercise them.

Our commitments: we collect only the data we genuinely need to run the Service, we never sell your personal information, and we never use it for advertising or behavioural targeting. The Service has no ads and no social features.

Privacy in practice

Your study content is processed to deliver AI Tutor, Study Sets and Solve — we do not use it to train AI models or sell it to third parties.

Raw uploaded files (photos, PDFs, etc.) are processed to generate responses and are not stored by us as permanent file archives; see Section VII for details.

Please avoid uploading images that show your full name, school ID or other details you do not need to share — the question alone is enough.

You can update your profile, delete content and close your account from Settings.

I. Definitions

"Service" — the website and application at gettopmarks.com and related features (AI Tutor, Study Sets, Solve).
"User" / "you" — any person who uses the Service, including students and the parents or guardians who create, manage or supervise their accounts.
"Personal information" — any information about an identified or identifiable individual.
"APPs" — the Australian Privacy Principles under the Privacy Act 1988 (Cth).
"PDPL" — the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

II. Who we are

In brief: An Australian business runs gettopmarks. Most users are in the UAE, so Australian and UAE privacy laws apply.

Your personal information is handled by Gettopmarks (ABN 37 188 224 297), an Australian business with its address at 32 Stonewood Circuit, Hadfield VIC 3046, Australia ("we", "us").

Privacy contact: hello@gettopmarks.com

This Privacy Policy applies to gettopmarks.com and any related subdomains, applications or online services we operate that link to this Policy.

We are the entity responsible for your personal information (an "APP entity" under the Privacy Act). Because our users are mainly in the UAE, the PDPL also applies to how we handle personal information relating to users in the United Arab Emirates.

Where we accept users in the European Union or United Kingdom, we also apply relevant EU/UK GDPR requirements to that processing.

III. Purposes, legal bases and retention periods

In brief: We only collect what we need to run your account, deliver AI study tools, process payments, and keep the Service secure. We do not use your data for ads.

We collect data directly from you when you create an account, upload materials, and use the Service. We follow the principle of data minimisation (APP 3) — collecting only what we reasonably need.

Purpose	Data used	Legal basis	Retention
Create and run your account	First name, last name, email address, password (stored as a secure hash), account identifiers	Necessary to provide the Service / consent	While your account is active, then 90 days after closure, except where we must keep records longer by law
Provide AI Tutor, Study Sets and Solve	Uploaded files and text (PDF, DOCX, PPTX, JPG, PNG, TXT), questions, chat messages, AI responses, session preferences (e.g. curriculum, subject, tutor style)	Necessary to provide the Service	Until you delete the relevant content or close your account; extracted text used for study generation may be cached for up to 90 days to improve performance
Process subscriptions and payments	Subscription status, billing period, Stripe customer and subscription identifiers (card details are held by Stripe, not us)	Necessary to provide the Service / legal obligation	7 years (Australian tax and record-keeping requirements)
Parental supervision (shared account)	Account credentials and activity accessible when a parent or guardian logs in to supervise the student	Necessary to provide the Service / consent	While the account is active
Keep the Service secure and prevent misuse	Usage metadata (e.g. AI token counts), device and log data (IP address, browser type, approximate region), error and performance data	Our legitimate business interests in security and reliability	12 months for logs; error monitoring data per our provider's settings
Understand how the Service is used (Web Analytics)	Aggregated or anonymised page-view and traffic data (e.g. pages visited, referrer, device/browser type, approximate region) via Vercel Web Analytics — no advertising identifiers and no behavioural ad profiles	Our legitimate business interests in operating and improving the Service	Per our analytics provider's retention settings
Measure page performance (Speed Insights)	Anonymous performance metrics (e.g. Core Web Vitals such as LCP, CLS and INP, route/URL, device type, browser, network speed class, country) via Vercel Speed Insights — not tied to an individual visitor or IP address, and not used to reconstruct browsing sessions	Our legitimate business interests in operating and improving the Service	Per our analytics provider's retention settings
Send transactional emails	Email address, name	Necessary to provide the Service / consent	While your account is active
Respond to support requests	Account data and relevant content you share with us	Necessary to provide the Service / consent	24 months after the request is resolved
Meet legal obligations	As required	Legal obligation	As required by law
Prevent repeat free-trial abuse	Normalised email address linked to prior trial or subscription use	Legitimate business interests	May be retained after account deletion to enforce one trial per person

Where the law requires consent (including parental consent for minors), we obtain it, and you may withdraw it at any time — though this may mean we cannot continue to provide some or all of the Service.

If you sign in with Google or Apple, we receive basic profile information from that provider (such as your name and email) through our authentication service (Supabase). We use it only to create and manage your account.

IV. Children and minors

In brief: Many users are under 18. A parent or guardian must agree to this Policy and supervise use. We do not use children's data for advertising.

Most of our users are students preparing for IGCSE, A-Level and IB exams, many of whom are under 18. Some may be under 13. Much of our user base is therefore treated as children under privacy law. This is the most important part of this Policy.

Parental consent and supervision

A parent or legal guardian must create or approve a minor's account, consent to this Policy and our Terms of Service, and supervise use of the Service. In practice, this usually means a shared account model: the parent or guardian creates or co-manages the account and may log in to the same account to oversee the student's activity. We do not currently offer a separate parent portal or standalone usage dashboard.

Content safety

The Service is designed for focused study. Our AI tutor is instructed to avoid content inappropriate for school-age students. We do not currently operate automated content moderation or parent alert systems. If we introduce moderation or safety notifications in future, we will update this Policy before doing so.

Australian Children's Online Privacy Code

A new Privacy (Children's Online Privacy) Code under the Privacy Act must be registered by 10 December 2026 and is expected to apply to online services likely to be accessed by children. As an education app for school students, we expect to be in scope. We are preparing to meet its "best interests of the child" requirement and age-assurance expectations (informed by approaches such as the UK Age Appropriate Design Code).

Consent and capacity

Australian law assesses a young person's capacity to consent individually. Where a young person lacks capacity to consent, a parent or guardian acts on their behalf. We require acceptance of this Policy and our Terms at account creation; for users under 18, that acceptance must be given or authorised by a parent or guardian.

Practical approach: If you are under 18, a parent or legal guardian must accept this Policy and our Terms on your behalf and supervise your use. A parent or guardian may create and manage an account for a student of any school age using the shared-account model described above.

Other regimes

COPPA (United States): If we knowingly collect personal information from children under 13 located in the US without appropriate parental consent, US Children's Online Privacy Protection Act requirements may apply. We rely on parent or guardian account creation and supervision for younger students.
GDPR-K (EU/UK): Where GDPR applies, a child may consent alone at 16 in most EU countries, or 13 in the UK and some EU states. Where a child cannot consent alone, we require a parent or guardian to provide consent and supervise use.

Age verification

We do not currently operate standalone age-verification technology (such as ID checks or third-party age-estimation). Account creation requires acceptance of our Terms and this Policy; for minors, a parent or guardian must provide that acceptance and supervise use.

Australian social-media minimum-age law (December 2025)

Australia has introduced a minimum-age requirement for certain social media platforms. gettopmarks is an AI study tool, not a social media service: it has no public profiles, social feeds, direct messaging between users, or friend networks. On that basis, we assess that this law is likely not applicable to the Service.

What we do not do

We do not profile children for advertising, sell children's personal information, or use children's data for behavioural advertising. The Service has no ads.

V. Your rights

In brief: You can ask to see, correct or delete your data, and complain to us or to a regulator.

Subject to applicable law, you (or a parent or guardian acting for a minor) can:

Access the personal information we hold about you (APP 12);
Correct inaccurate or incomplete data (APP 13);
Erase your data where we are able to (for example, by deleting content or closing your account);
Restrict or temporarily suspend certain processing (where applicable under GDPR/PDPL);
Object to processing based on our legitimate interests (where applicable);
Withdraw consent where processing relies on consent;
Portability — receive certain data in a structured, commonly used format (where applicable under GDPR/PDPL).

How to exercise them: email hello@gettopmarks.com. We may ask for reasonable identification (and evidence of a parent's authority) if we are unsure who is asking. We will respond within the time the law requires.

Managing your information yourself

Where the Service allows it, you can also:

update your name and profile details in Settings;
delete individual study content or solve history where deletion is offered in the app;
cancel your subscription via Settings → Manage billing (Stripe Customer Billing Portal);
close your account in Settings, which cancels any active subscription and deletes your personal information subject to the retention periods in Section III.

If you have trouble accessing or managing your information, contact us at hello@gettopmarks.com.

Complaints: please contact us first so we can try to resolve your concern. You may also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Users in the UAE may have rights to complain to the UAE Data Office under the PDPL. Users in the EU/UK may complain to their local supervisory authority where GDPR applies.

VI. Sharing, processors and international transfers

In brief: We use trusted service providers to run gettopmarks. We do not sell your data. Some providers process data outside Australia.

To run the Service, your personal information may be shared with the providers below. We assess each provider's security before using them and share only the data each needs to perform their function.

Recipient	Function	Data shared
Google (Gemini API)	AI Tutor, Study Sets, Solve — generating responses	Your questions, chat messages, uploaded content and extracted text
Stripe	Subscription billing and payment processing	Name, email, payment method details (held by Stripe), subscription status
Supabase	Authentication, database and storage of account and user content (primary database: South Asia / Mumbai, AWS `ap-south-1`)	Account data, chat messages, study sets, solve history and related metadata
Vercel	Application hosting, delivery, Web Analytics (cookieless page-view and traffic measurement) and Speed Insights (anonymous Core Web Vitals / performance measurement)	Data processed in transit when you use the Service; anonymised or aggregated analytics and performance events (pages visited, referrer, device/browser type, approximate region; route/URL, network speed class, Web Vital scores)
Resend	Transactional email (e.g. welcome emails)	Email address, name
Sentry	Error monitoring and limited session replay for debugging	Masked device, browser and error data; AI prompts and API bodies are not captured
Google / Apple	Optional sign-in (OAuth via Supabase)	Authentication tokens and basic profile information
Professional advisers / authorities	Legal advice or legal obligation	As required
A buyer in a merger or acquisition	Business transfer (under confidentiality)	As relevant to the transaction

We do not sell your personal information or share it with advertisers.

International transfers (APP 8)

Because we are based in Australia and our users are mainly in the UAE, your personal information may be stored and processed outside Australia and the UAE, including in:

India — South Asia (Mumbai):
- Vercel application hosting (region bom1);
- Supabase primary database (AWS region ap-south-1, South Asia / Mumbai);
United States and other countries where Google (Gemini), Stripe, Sentry and other providers operate infrastructure.

We take the reasonable steps required under APP 8 so overseas recipients handle personal information in a way that is consistent with the APPs. Where the PDPL or GDPR apply, we take additional steps required for international transfers, including using contractual and technical measures offered by our providers (such as data processing terms from Google, Stripe, Supabase, Vercel, Sentry and Resend) where available.

The Service may link to third-party websites (for example, exam-board or school sites). Their handling of your data is governed by their own policies, which we recommend you read.

VII. How we use AI with your content

In brief: Your study content is sent to Google Gemini to generate tutoring responses. We do not use your content to train AI models.

To generate tutoring responses, study sets and solutions, the content you submit is processed by our AI provider in real time over encrypted API connections.

AI provider. We use Google Gemini (models including gemini-2.5-flash and gemini-2.5-flash-lite) via the Vercel AI SDK.
What is sent. Your questions, chat history, uploaded files and extracted text are sent to Google to generate responses. We do not remove identifying details before sending content for processing unless we tell you otherwise in the Service.
No training on your content. We do NOT use your uploaded content or chats to train our own AI models. Under our use of the Gemini API and Google's Gemini API terms, customer content submitted through the API is not used to train Google's public foundation models.
Uploaded files, caching and storage. Raw uploaded files (photos, PDFs, etc.) are processed in memory to generate responses and are not stored by us as original files. Extracted text and generated study materials may be cached for up to 90 days to improve performance. Chat messages, study sets and solve history are stored in our database until you delete them or close your account.
Accuracy. AI outputs are educational support, may contain errors, and do not guarantee any grade. See our Terms of Service for the full disclaimer.

VIII. Cookies and similar technologies

In brief: We use essential cookies to keep you signed in. We do not use advertising or behavioural tracking cookies. We use cookieless Vercel Web Analytics for traffic stats and Vercel Speed Insights for anonymous performance metrics.

We use cookies and similar technologies that are strictly necessary to run the Service — for example, to keep you signed in and maintain your session. We do not use advertising or behavioural tracking cookies, and we do not use advertising-oriented analytics products such as Google Analytics or PostHog.

We use Vercel Web Analytics to measure how the Service is used (for example, which pages are visited). Vercel Web Analytics is designed to work without cookies and without building advertising or cross-site behavioural profiles. It may process anonymised or aggregated technical data such as page path, referrer, device or browser type, and approximate region.

We also use Vercel Speed Insights to measure real-user page performance (for example, Core Web Vitals). Speed Insights is designed so data points are anonymous and not associated with an individual visitor or IP address, and so they cannot be used to reconstruct a browsing session across pages. It may process technical data such as route or URL, Web Vital scores, device type, browser, network speed class, and country. See Section III (purposes) and Section VI (processors).

Our error-monitoring provider (Sentry) may use similar technologies subject to its own privacy settings; we configure it to mask personal content and block sensitive API traffic.

Because our cookies are limited to those strictly necessary for the Service to function, and our Vercel Web Analytics and Speed Insights tools do not rely on cookies for advertising or cross-site tracking, we do not currently display a separate cookie consent banner.

IX. Data security and data breaches

In brief: We use industry-standard measures to protect your data. If a serious breach occurs, we will notify you and the OAIC as required.

We take reasonable technical and organisational measures to protect your personal information from misuse, loss, and unauthorised access, alteration or disclosure (APP 11), including:

encryption in transit (HTTPS/TLS);
access controls and row-level security on our database;
hashed passwords (we do not store plain-text passwords);
vetting of our service providers;
configuration of error monitoring to mask sensitive content and block AI/API request bodies.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

Notifiable Data Breaches

If we experience a data breach that is likely to result in serious harm, we will comply with Australia's Notifiable Data Breaches (NDB) scheme under the Privacy Act — including notifying affected individuals and the OAIC as required. Where the PDPL or GDPR apply, we will also meet any additional breach-notification obligations.

X. Changes to this Policy

We may update this Policy from time to time. We will post the new version on gettopmarks.com with an updated "Last updated" date. For material changes that affect minors or your rights, we will take additional steps to notify you and parents or guardians as required by law.

XI. Contact us

Gettopmarks (ABN 37 188 224 297)
32 Stonewood Circuit, Hadfield VIC 3046, Australia

Privacy contact: hello@gettopmarks.com