1. About this policy
Resonance Labs Pty Ltd ("Curiosity", "we", "us", "our") operates the Curiosity courses and workspace at curiosityaieducation.com and app.resonanceai.com.au, together the "Service".
Curiosity is AI education for everyone. The Service is available to learners worldwide and to people of all ages, subject to the section on children and young people below.
This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, as well as other data protection laws that apply to you, including the EU and UK General Data Protection Regulation and similar laws.
By using the Service, you consent to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
2. Information we collect
2.1 Account information
When you create an account, we collect:
- Full name
- Email address
- Password, stored as a cryptographic hash. We never store or have access to your plain text password.
2.2 Billing information
Payment processing is handled by Stripe, a PCI DSS Level 1 certified payment provider. We store your billing email address and a Stripe customer or payment reference identifier. We do not store, process, or have access to your credit card number, CVV, or full payment card details.
2.3 Course progress and submissions
As you work through a course, we store:
- Which lessons you have viewed and marked complete
- Your quiz answers and your scores
- Your capstone case study submissions, including any attachments you upload
- Any certificates issued to you
This data is used to track your progress, grade your work, issue certificates, and let you resume where you left off.
2.4 Usage and audit data
We automatically collect:
- IP address and user agent string
- Pages viewed and actions taken inside the Service
- Timestamps of significant events including enrolment, lesson completion, quiz attempts, and certificate issue
This data is recorded in an append only audit trail used to support certificate verification and to detect abuse.
3. How we use your information
We use your information to:
- Provide, maintain, and improve the Service
- Deliver course content and track your progress
- Grade quiz and capstone submissions using artificial intelligence, as covered in section 4
- Issue and verify printable certificates on completion
- Process payments and manage your enrolments
- Send transactional emails, including account confirmation, password reset, billing receipts, and course updates
- Investigate and prevent security incidents or misuse
We do not use your data for advertising, do not sell your data to third parties, and do not use your data to train artificial intelligence models.
4. AI processing and data handling
Curiosity uses large language models, currently provided by Anthropic, to grade short answer quiz questions and capstone submissions. When you submit a quiz answer or a capstone, the relevant text is sent to the provider together with the rubric to be graded.
Key commitments regarding artificial intelligence processing:
- No model training: Your submissions are not used to train, tune, or improve any model. This is contractually guaranteed by our infrastructure providers.
- Ephemeral processing: Data sent for grading is not retained by the provider after the response is generated.
- Purpose limited: The provider only sees the specific text and rubric needed to grade. It does not see your account details, your payment information, or any other course progress.
5. Third party service providers
We use a small number of third party providers to operate the Service. Each is bound by its own privacy and security commitments.
- Supabase, the database and authentication layer, hosted in the Sydney (ap-southeast-2) region. Stores your account, course progress, and certificates.
- Vercel, application hosting and edge delivery.
- Stripe, payment processing. PCI DSS Level 1 certified.
- bunny.net, video streaming for course lessons.
- Anthropic, the model provider used for quiz and capstone grading.
- Resend, transactional email delivery for receipts, password resets, and certificate emails.
6. Cross border data disclosure
In accordance with APP 8, we disclose that the following data may be processed outside Australia.
- Payment data is processed by Stripe in the United States.
- Transactional emails are delivered via Resend, which operates from the United States.
- AI grading sends quiz and capstone text to Anthropic for evaluation. Anthropic processes this data in the United States under a Zero Data Retention agreement, so data is not stored or used for training.
- Video delivery via bunny.net uses a global edge network, and the closest edge to you serves your video request.
Our core data storage, including your account, your course progress, certificates, and capstone submissions, is hosted in Australia, in Supabase's Sydney region, and may also be processed in other countries by our service providers as described above.
7. International users and data transfers
Curiosity is available to learners worldwide. If you access the Service from outside Australia, your personal information may be transferred to, stored in, and processed in Australia and in other countries where we or our service providers operate, as described in the sections above. These countries may have data protection laws that are different from, and in some cases less protective than, the laws in your own country.
By using the Service from outside Australia, you understand and consent to the transfer of your personal information to, and its processing in, Australia and those other countries. We take reasonable steps to ensure your information is handled securely wherever it is processed.
8. Data security
We implement the following security measures to protect your information.
- Encryption at rest: All sensitive data is encrypted before storage. Passwords are cryptographically hashed.
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
- Row level security: Database access is enforced at the row level, so you can only see and modify your own data.
- Authentication: Account access requires a verified email and password. Multi factor authentication is supported.
- Data hosting: Core data is hosted in Australia, in Supabase's Sydney region, and may also be processed in other countries by our service providers.
9. Data retention and deletion
- Account data: Retained for the duration of your active account. On account deletion, personal information is removed inside 30 days.
- Course progress and submissions: Retained while your account is active. Deleted inside 30 days of account closure or on request.
- Certificates: Retained indefinitely so verification URLs continue to work. You may request revocation if you no longer want a certificate to verify.
- Billing records: Retained as required by the GST Act 1999 and applicable tax legislation, a minimum of five years.
To request deletion of your data, email us at the address below. We process every request inside 30 days, subject to legal retention obligations.
10. Cookies and local storage
Curiosity uses minimal browser storage, limited to:
- Authentication session: A secure authentication token stored as an HTTP only cookie to maintain your login session.
- Preference cookies: A small number of cookies to remember interface preferences, for example the last lesson you viewed.
We do not use any analytics cookies, advertising trackers, tracking pixels, or third party tracking scripts. We do not use Google Analytics, Segment, Hotjar, or any similar service.
11. Your rights
Wherever you live, you have the following rights over the personal information we hold about you. These rights are recognised under the Australian Privacy Principles, the EU and UK General Data Protection Regulation, and similar data protection laws.
- Access: Request a copy of the personal information we hold about you.
- Correction: Request correction of any inaccurate, out of date, or incomplete personal information.
- Deletion: Request deletion of your personal information, subject to legal retention obligations.
- Data portability: Request an export of your data in a structured, machine readable format.
- Object or restrict: Object to, or request that we restrict, certain processing of your personal information.
- Complaint: If you are not satisfied with our handling of your information, you may lodge a complaint with the Office of the Australian Information Commissioner at www.oaic.gov.au, or with the data protection authority in your own country.
To exercise any of these rights, email us at the address below. We respond inside 30 days.
12. Children and young people
Curiosity is a general audience service. It is not directed at children under 13 years of age, and we do not knowingly collect personal information from children under 13 without the consent of a parent or guardian. If you believe a child under 13 has provided us with personal information without that consent, please contact us at info@curiosityaieducation.com and we will delete it.
We encourage parents and guardians to be involved in their children's use of the Service and to help them learn safely.
13. Changes to this policy
We may update this Privacy Policy from time to time. Material changes are communicated by email to active customers at least 30 days before taking effect. The "Last updated" date at the top of this page indicates when the policy was most recently revised.
14. Contact us
If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a privacy concern, please contact us.
- Email: info@curiosityaieducation.com
- Entity: Resonance Labs Pty Ltd
- Location: Melbourne, Victoria, Australia
For complaints that remain unresolved, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or by phone on 1300 363 992.