Privacy Policy

CurricuLLM is an AI powered SaaS platform for educational staff and students. The platform is generally designed to be suitable for students aged 10 and above as a guideline. Schools are responsible for determining the appropriate age for student use based on their own policies and context. We aim to align with the Australian Privacy Act 1988 and the Australian Framework for Generative AI in Schools.

We collect

Account Information
Names and emails via Google or Microsoft authentication, and school affiliations.

User Provided Information
Users may enter content into the platform, including in chat, the workspace, live lessons and Studio. Users might inadvertently enter personal details. We discourage including sensitive information.

Learning and Progress Information
For students, information about their learning, including learning check-in responses, topics studied, progress and mastery estimates, lesson stars, Galaxy stars, streaks and badges. Some of this information is inferred by AI from a student's work and conversations.

School Records Imported for Personalisation
Where a school enables Progression Seeding, records the school chooses to provide about its students, such as reports, work samples, marked rubrics and teacher notes. The school provides these records by upload or through an API key it controls, and they are used only to personalise learning for students at that school.

Wellbeing and Safety Information
Where a school uses the Safety Centre, information about possible safety or wellbeing concerns identified in student conversations. See Section 5B.

Images
Profile photos that users choose to upload, and images attached to prompts. Schools can turn off profile photo upload for students.

Technical Data
IP addresses, device types, browsers, and usage patterns, via cookies and analytics.

Third Party Information
Limited information from Google or Microsoft for authentication purposes only. Or information from systems that a school or users choose to connect, including student information and rostering systems (such as LISS and OneRoster), learning management systems (LTI), single sign-on providers (SAML), file storage (Google Drive and OneDrive), web pages a user adds by URL, and external services a school connects through Connectors.

We collect personal information directly from you when you create an account using Google or Single Sign On authentication, when you enter content into the platform, and when you contact us. We also collect information automatically through cookies and analytics tools when you use the Service. Where schools connect external systems (such as LISS, OneRoster, LTI and SAML), or provide records through Progression Seeding, we may receive information from those systems on behalf of the school. Personal information is held in secure cloud infrastructure provided by our subprocessors, protected by the measures described in Section 7.

If you do not provide the personal information we request, we may not be able to create or maintain your account, provide the Service, or respond to your enquiries. For example, if you do not authenticate via Google or SSO, we cannot create your account. Providing content within the platform is voluntary, and choosing not to do so will not affect your ability to access other features of the Service.

We use personal information to

• Provide, operate, and enhance our services.
• Communicate service updates.
• Personalise learning for each student, including estimating their progress and suggesting what to work on next.
• Show teachers and school staff student activity, progress and possible wellbeing concerns, where the school enables these features.
• Maintain platform safety and compliance.
• Conduct anonymised research and user surveys for product improvement.

CurricuLLM does not use prompts or user content to train AI models.

Studio allows users to upload, create, edit, and export teaching and learning materials, including audio and video outputs.

Outputs created from chat in the workspace, and resources a teacher shares with a class during a live lesson, are handled in the same way as Studio content in this section.

If a user selects that Studio content is suitable for students, or ok to share with other teachers, then that content may be visible to other users inside CurricuLLM where sharing is enabled.

We encourage users not to include personal information in shared content, especially student names or identifying details.

We may review shared content for safety, quality, and compliance. This may involve human review and automated checks.

If you later change your selection to turn sharing off, we will stop new sharing within a reasonable time. Copies may still remain where other users have already accessed or exported the content, or where it is stored in backups, logs, or required for legal or safety reasons.

When you use AI-powered features of the Service, the content you provide in your prompts and any attached context (such as curriculum selections or uploaded materials) is sent to our AI inference providers for processing. Only the information necessary to generate a response is transmitted.

AI processing is performed in real time. Your prompts and content are not used to train, fine-tune, or improve any AI model. Our contracts with AI inference providers prohibit the use of user data for model training. Prompt data is not retained by our AI providers beyond the duration of the inference request, except where a provider's standard processing requires short-term transient storage, after which it is deleted.

We apply the following safeguards to AI data processing:

• All data transmitted to AI providers is encrypted in transit.
• AI inference providers are contractually bound not to use, store, or train on user data.
• Content filters are applied to both inputs and outputs to reduce the risk of harmful or inappropriate content.
• Schools may configure filter strictness levels through their admin settings.
• AI outputs are intended as drafts for educator review, not as final materials for direct student use without teacher oversight.

Users have the following controls over AI functionality:

• You choose what content to include in your prompts. You control whether to attach curriculum context or upload materials.
• Use of AI features is voluntary.
• Schools can configure content filter levels and manage which features are available to staff and students.
• You may request deletion of your data at any time in accordance with Section 12.

Our AI inference providers are listed in Section 17 (Subprocessors), along with their locations and the specific models currently in use.

When a teacher runs a live lesson or opens Drop-in, the teacher can see in real time what each student in the class is working on, including their conversations with the AI. CurricuLLM may flag students who appear to be stuck or disengaged so the teacher can check in.

Schools are responsible for telling students that teachers can see their activity on CurricuLLM.

Where a school uses the Safety Centre, CurricuLLM uses automated analysis to look for patterns in student conversations over time that may point to a safety or wellbeing concern, such as a personal disclosure, aggression or signs of self-harm. When a pattern is found, a case is created for that student with a severity level and an AI-written summary, and staff the school has chosen may be notified.

Only staff roles the school allows can see Safety Centre cases. Students never see the Safety Centre. Automated analysis can miss concerns or flag conversations that are not concerning, so every case is for a staff member to review. CurricuLLM does not make decisions about a student on its own. Schools can choose not to use the Safety Centre.

Data is retained only as long as necessary for service provision or legal compliance. Upon account deletion requests, data is deleted or anonymised within a reasonable timeframe.

Schools can ask us at any time to delete student information, including learning and progress information, records imported through Progression Seeding, and Safety Centre cases. When a school turns off Progression Seeding, no new records can be imported.

All data is stored securely, protected by encryption, restricted access, regular security audits, and industry standard practices.

CurricuLLM primarily stores and processes information within Australia and New Zealand.

However, for the purposes of providing AI inference services, limited information may be processed in the United States. This processing is limited to real time inference tasks only and is not used to train AI models.

When transferring information overseas, we ensure appropriate safeguards and contractual protections are in place, and maintain compliance with applicable privacy laws.

We share data only with essential service providers for secure hosting, authentication, and service delivery.

Some AI inference processing may occur with approved providers in the United States, with safeguards including encryption, contractual data protections, and regional privacy controls.

We may disclose personal information to the following categories of recipients: cloud hosting and infrastructure providers, authentication providers, AI inference providers, email delivery providers, and database service providers. These recipients are listed in Section 17 (Subprocessors). We do not sell personal information or disclose it to recipients for marketing or profiling purposes.

Where a school or user connects an external service, such as a Connector, Google Drive or OneDrive, the information needed for that connection is sent to that service. These services are chosen by the school or user, are not our subprocessors, and handle information under their own terms and privacy policies.

CurricuLLM provides features that help schools, teachers and students work with curriculum materials.

Some curriculum materials are licensed directly to CurricuLLM or made available under licences that permit their use. Other curriculum materials may be retrieved from official public sources on behalf of a school or educational institution.

For Australian schools, this may include material accessed and processed on behalf of a school exercising rights available to it under the Statutory Education Licence in the Copyright Act 1968 (Cth), or another applicable licence or permission.

When this occurs:

• the school authorises CurricuLLM to perform the retrieval, copying, communication and processing on its behalf;
• the activity is performed solely to provide the Service for the educational purposes of that school;
• material may be retrieved when required in response to use of the Service rather than being incorporated into CurricuLLM as a generally reusable curriculum dataset; and
• CurricuLLM does not claim ownership of third party curriculum material.

Curriculum authorities retain all copyright and other intellectual property rights in their materials.

CurricuLLM is an independent service and is not affiliated with, endorsed by, or approved by a curriculum authority unless we expressly state otherwise.

Schools must ensure that their use of curriculum material through CurricuLLM complies with any licence, statutory licence or permission applicable to them.

CurricuLLM may restrict access to curriculum material where we reasonably believe the school does not have the rights required for the proposed use.

We use cookies for authentication, preference management, and analytics. Users may manage preferences via their browser settings.

Region detection. When you first visit our marketing website, we make a single client-side request to a third-party IP geolocation service (currently ipapi.co) to detect the country your IP address resolves to. We use this only to route you to the correct regional version of the site (for example, sending United Kingdom visitors to /uk/) and to remember that choice in a first-party cookie (cl_region) and in your browser's local storage. The country result is not stored on our servers, and you can change your region at any time using the country selector in the site header.

Consent for non-essential cookies (UK visitors). On the UK version of our site (/uk/*), we comply with UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Strictly necessary cookies (region preference, security, basic site functionality) are always on because the site cannot work without them. All other cookies and trackers — including Google Analytics, Amplitude product analytics and session replay, and ad-campaign attribution (ad_attribution) — are blocked by default. We will not load them until you have given explicit consent via the cookie banner shown on your first UK visit. Your choice is stored in a first-party cookie (cl_consent) and you can change it at any time using the "Cookie preferences" link in the site footer.

Users may request access, correction, or deletion of their data, by emailing hello@curricullm.com.

Student accounts are managed by the school. Students and parents should usually contact their school first, and we will work with the school to respond.

We provide schools with a parental notification template. We limit student data collection to what is needed for the features a school enables, utilise content filters, and do not engage in direct student marketing.

Some features build a picture of each student's learning, such as progress estimates, Galaxy stars, streaks, lesson stars and after-school refreshers. This is used only to support that student's learning at their school, and never for advertising. Schools and teachers control whether these features are on.

Significant policy changes will be communicated via email and prominently on our platform. Users are encouraged to regularly review policy updates.

Questions or privacy requests, hello@curricullm.com

If you believe your privacy has been breached or mishandled, you may contact us at hello@curricullm.com.

We will

• Acknowledge receipt of your complaint within 5 business days.
• Investigate and respond with an outcome within 30 days.
• If further time is required, we will let you know and explain why.

If you are not satisfied with our response, you may escalate the matter to the Office of the Australian Information Commissioner (OAIC).

We use the following subprocessors to provide our services. These subprocessors may process personal information on our behalf in accordance with our contractual agreements and privacy requirements.

The following AI models are currently used within the platform. This list may change as models are updated, added, or retired.