Privacy Policy

This Privacy Policy explains how Philomathia collects, uses, protects, and shares personal information when people visit our websites, use our products, participate in pilots, or communicate with us.

Philomathia products are designed for learning, development, coaching, assessment, support, and organisational capability work. That means the data we process may include sensitive information, health-adjacent support context, disability-related context, school context, NDIS context, reflections, performance signals, learning activity, and AI-generated observations. We treat that context as business-critical information, not marketing inventory.

This policy is designed for conservative Australian privacy practice and should be reviewed by legal counsel before Philomathia represents that any particular deployment is fully compliant.

We collect information you provide directly, information generated through use of the service, and information provided by authorised organisations that deploy Philomathia for their people.

• Account and contact details, such as name, email address, role, organisation, and authentication information.
• Learning and development content, such as prompts, submissions, reflections, exercises, feedback, goals, notes, and uploaded materials.
• Product usage information, such as feature interactions, timestamps, device details, log data, diagnostics, and support history.
• Organisational context, such as teams, cohorts, capability frameworks, manager or coach relationships, and deployment configuration.
• Child, learner, participant, school, support, disability, NDIS, behavioural, and health-adjacent context where an authorised person or organisation provides it for an agreed support purpose.

Australian privacy law does not set a single under-13 threshold for privacy consent. Where case-by-case capacity assessment is not practicable, Philomathia treats individuals under 15 as not having capacity to consent to the collection of identifiable child or participant data, unless a legally reviewed deployment says otherwise.

For individuals under 15, and especially children under 13, Philomathia requires parent or guardian consent, or confirmation that an authorised school, support provider, customer, guardian, or other legally responsible organisation has authority to provide the data. The child, young person, or participant should still be involved in privacy choices as far as practicable and in language they can understand.

Additional safeguards for child, learner, participant, school, NDIS, support, sensitive, and health-adjacent data are described in the Child and Participant Data Schedule.

We use information to operate, secure, improve, and support Philomathia products. This includes generating exercises and feedback, maintaining persistent developmental context where a product requires it, supporting administrators, debugging issues, and improving the reliability of our systems.

• Provide the service and personalise relevant product experiences.
• Generate AI-assisted feedback, summaries, recommendations, and learning activities.
• Support pilots, onboarding, customer success, billing, security, and compliance.
• Analyse aggregate product performance and improve product quality.
• Communicate service updates, administrative messages, and product information where permitted.
• Maintain consent, authority, retention, access, correction, deletion, export, and complaint workflows where required.

Philomathia uses AI models to power product features. Inputs and outputs may be processed by model providers, infrastructure providers, and other subprocessors strictly to deliver and secure the service. We design these workflows to preserve customer confidentiality and minimise unnecessary data exposure.

Customer content is not sold. We do not use customer content for third-party advertising. Identifiable child or participant data is not used for model training, fine-tuning, public demos, or unrelated research unless the applicable customer agreement and required consent expressly allow it.

AI outputs are assistive only and should be reviewed by an appropriate human before being used in education, support, NDIS, employment, health, or similarly significant contexts.

Philomathia uses YouTube API Services in learning features that help users discover, preview, watch, and continue learning from public educational YouTube videos. YouTube content and YouTube embedded players are provided by YouTube, not by Philomathia.

• Public YouTube metadata we may process includes video titles, channel names, channel identifiers, thumbnails, descriptions, durations, statistics where returned by YouTube, embeddability status, video identifiers, channel metadata, and recommendation metadata.
• If you choose to connect a YouTube or Google account, Philomathia may request readonly YouTube permissions and use authorized subscription or channel signals to improve learning recommendations. This connection is optional.
• Philomathia may store product activity related to YouTube learning, such as videos opened inside Philomathia, learning progress, reflections, generated practice activities, cache entries, and recommendation context. Philomathia does not download, rehost, or redistribute YouTube video files.
• You can revoke Philomathia access to your Google or YouTube account through your Google account permissions at https://myaccount.google.com/permissions.

Google and YouTube may process information according to the Google Privacy Policy at http://www.google.com/policies/privacy. YouTube embedded players and YouTube API Services may also set, access, or recognize cookies, local storage, device identifiers, or similar technologies according to Google and YouTube policies.

Philomathia and its service providers may store, access, collect, or recognize information on or from your device or browser through cookies, local storage, IndexedDB, cache storage, pixels, logs, and similar technologies.

• We use these technologies to keep you signed in, secure the service, remember settings, cache learning data, measure product performance, troubleshoot errors, support embedded media, and provide analytics where permitted.
• Third parties that support Philomathia, including authentication, hosting, analytics, AI infrastructure, and embedded media providers such as Google and YouTube, may use similar technologies when their services are loaded or used.
• Browser and device settings may allow you to block or clear some cookies and storage. Some Philomathia features may not work correctly if required storage is disabled.

We share information only as needed to operate the business and provide the service. This may include cloud hosting, authentication, analytics, communications, payment, support, security, and AI infrastructure providers.

We may also disclose information where required by law, to protect rights and safety, to enforce agreements, or in connection with a merger, acquisition, financing, or sale of assets. If an organisation provides your access, relevant information may be visible to authorised administrators according to that organisation's configuration and agreement.

Current public-site subprocessors and data location information are listed on the Subprocessors page. Customer deployments involving child or participant data should confirm any additional AI, authentication, analytics, communications, storage, or support providers before launch.

We use technical and organisational safeguards designed to protect information against unauthorised access, loss, misuse, and alteration. These controls may include encryption in transit, access controls, least-privilege permissions, logging, backups, and vendor review.

No system is perfectly secure. We retain information for as long as needed to provide the service, meet legal and contractual obligations, resolve disputes, maintain security, and support legitimate business needs. Retention periods may vary by product, customer agreement, data type, consent status, and whether the data relates to a child, participant, or sensitive support context.

If we reasonably believe an eligible data breach has occurred, we will assess the incident and notify affected individuals, customers, and the OAIC where required by applicable law.

Depending on your location and relationship to Philomathia, you may have rights to access, correction, deletion, export, restriction, objection, consent withdrawal, or complaint handling for certain processing of personal information. Parents, guardians, learners, participants, and authorised organisations may also ask us to review child or participant data visibility where appropriate.

To make a privacy request, contact [email protected]. We may need to verify your identity and may decline or limit requests where permitted by law, contractual obligations, security requirements, or another person's rights.

Some requests may need to be handled through the organisation that provides your access because that organisation controls the deployment, user relationships, authority to share, and legal context.

Philomathia may process and store information overseas, including in Australia, the United States, and other countries where Philomathia or its subprocessors operate infrastructure or support services. Where required, we use appropriate contractual, technical, and organisational safeguards for international transfers.

If a customer requires a Data Processing Addendum, security schedule, regional hosting, advance subprocessor notice, or additional transfer terms, those terms should be addressed in the relevant customer agreement or order process.

The OAIC Children's Online Privacy Code is expected to be finalised and registered by 10 December 2026. Philomathia should review this policy, the Child and Participant Data Schedule, and related product workflows once the final Code is available.

We may update this policy as our products, vendors, and legal obligations change. Material changes will be posted on this page or communicated through reasonable channels.

Privacy questions can be sent to [email protected].