1. About this policy
Resonance Labs Pty Ltd, trading as Curiosity ("Curiosity", "we", "us", "our"), operates the Curiosity education platform at curiosityaieducation.com (the "Service").
Curiosity teaches financial literacy, AI literacy, sustainability and wellbeing habits. We run sessions in schools and provide this site as the ongoing learning resource for students.
This Privacy Policy explains how we collect, use, disclose and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
By using the Service, you consent to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
2. Information we collect
2.1 Account information
When you create an account, we collect:
- First name
- Email address
- Password, stored as a cryptographic hash. We never store or have access to your plain text password.
2.2 Lesson progress and submissions
As you work through the library, we store:
- Which lessons you have viewed and marked complete
- Your quiz answers and your scores
- Your case study and assignment submissions
- Any certificates issued to you
This data is used to track your progress, mark your work, issue certificates, and let you resume where you left off.
2.3 Booking enquiries
When a school books a scoping call or an event, scheduling is handled by Calendly, which collects the booker's name, email address and answers to the booking questions. We receive that information to prepare for and run the session.
2.4 Usage data
We automatically collect:
- IP address and browser user agent
- Timestamps of significant events including enrolment, lesson completion and quiz attempts
3. How we use your information
We use your information to:
- Provide, maintain and improve the Service
- Deliver lessons and track your progress
- Mark quiz and written submissions, including with artificial intelligence as covered in section 4
- Issue certificates on completion
- Send transactional emails, including account confirmation and password resets
- Organise and run school sessions that have been booked
- Investigate and prevent security incidents or misuse
We do not use your data for advertising, do not sell your data to third parties, and do not use your data to train artificial intelligence models.
4. AI processing and data handling
Curiosity uses large language models, currently provided by Anthropic, to mark short answer questions and case study submissions. When you submit written work, the relevant text is sent to the provider together with the marking rubric.
- No model training: your submissions are not used to train, tune or improve any model.
- Purpose limited: the provider only sees the specific text and rubric needed for marking, not your account details or any other progress data.
- Human oversight: anything the marking system is unsure about is flagged for a person to review.
5. Third party service providers
We use a small number of providers to operate the Service. Each is bound by its own privacy and security commitments.
- Supabase: database and authentication, hosted in the Sydney (ap-southeast-2) region. Stores your account, progress and certificates.
- Vercel: application hosting and delivery.
- Anthropic: the model provider used for marking written submissions.
- Calendly: scheduling for school scoping calls and event bookings.
6. Cross border data disclosure
In accordance with APP 8, we disclose that the following data may be processed outside Australia:
- AI marking sends submission text to Anthropic for evaluation in the United States. It is not stored or used for training.
- Booking data is processed by Calendly, which operates from the United States.
Our core data, including your account, progress, submissions and certificates, is hosted in Australia in Supabase's Sydney region.
7. Data security
- Encryption in transit: all data between your browser and our servers is encrypted using TLS 1.2 or higher.
- Encryption at rest: data is encrypted before storage, and passwords are cryptographically hashed.
- Row level security: database access is enforced at the row level, so you can only see and modify your own data.
- Australian hosting:core data is hosted in Supabase's Sydney region.
8. Data retention and deletion
- Account data: retained while your account is active. On deletion, personal information is removed inside 30 days.
- Progress and submissions: retained while your account is active. Deleted inside 30 days of account closure or on request.
- Certificates: retained so verification continues to work. You may request revocation at any time.
To request deletion of your data, email us at the address below. We process every request inside 30 days, subject to legal retention obligations.
9. Cookies and local storage
Curiosity uses minimal browser storage, limited to:
- Authentication session: a secure token stored as an HTTP only cookie to keep you logged in.
- Preferences: a small amount of local storage to remember things like your last lesson and quiz attempts.
We do not use analytics cookies, advertising trackers, tracking pixels or third party tracking scripts.
10. Your rights
You have the following rights over the personal information we hold about you:
- Access: request a copy of the personal information we hold about you.
- Correction: request correction of any inaccurate or out of date information.
- Deletion: request deletion of your personal information, subject to legal retention obligations.
- Complaint: if you are not satisfied with our handling of your information, you may lodge a complaint with the Office of the Australian Information Commissioner at www.oaic.gov.au.
11. Students and young people
Curiosity is built for high school and university students, and we take the privacy of young people seriously. We collect the minimum information needed to run the Service: a first name, an email address and learning progress. We never use it for advertising, profiling or model training.
We do not knowingly collect personal information from children under 13 without the consent of a parent, guardian or school. If you believe a child under 13 has provided us with personal information without that consent, contact us at info@curiosityaieducation.com and we will delete it.
Schools arranging Curiosity sessions should ensure their own consent and notification processes cover students' use of the Service. We are happy to help, just ask.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes are communicated by email to active accounts before taking effect. The "Last updated" date at the top of this page shows when the policy was most recently revised.
13. Contact us
- Email: info@curiosityaieducation.com
- Entity: Resonance Labs Pty Ltd, trading as Curiosity
- Location: Melbourne, Victoria, Australia
For complaints that remain unresolved, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or by phone on 1300 363 992.