1. Introduction

MARU Academy is operated by MARU ACADEMY PTY LTD, ABN 55 696 845 940, of Sydney, New South Wales, Australia (“MARU Academy”, “MARU”, “we”, “us” or “our”).

We provide a digital life-readiness education platform used by schools, teachers, students, families and individual learners. Because our platform is used by children and young people, we treat the personal information we hold as a serious responsibility rather than a compliance formality.

This Privacy Policy explains how we collect, use, disclose, store, secure and delete personal information. It is written to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and other applicable Australian privacy laws.

This Privacy Policy should be read together with our Terms and Conditions. Where there is any inconsistency between this Privacy Policy and our Terms and Conditions concerning how we handle personal information, the document that provides greater protection to the individual applies, to the extent of the inconsistency and subject to applicable law.

2. Who This Policy Applies To

This Policy applies to personal information we handle about:

•          Schools and organisations that purchase or trial a subscription

•          Teachers and school administrators who manage cohorts and access reporting

•          Students who access learning content through a school or family subscription

•          Parents and guardians who purchase or manage a family subscription

•          Individual learners aged 18 or over who purchase their own subscription

•          Website visitors and enquirers who contact us or browse our website

3. Our Approach to Collecting Information

We collect only what is reasonably necessary to deliver and administer our educational services. We do not collect information “just in case”, and we do not build profiles of students beyond what is required to track their learning progress and report it to their teacher or parent.

3.1 School and Organisation Information

•          School or organisation name and contact details

•          School administrator name, role and email address

•          Subscription and licence details, including licence counts and allocation

•          Billing records and purchase order or invoice references

3.2 Teacher and Administrator Information

•          First name and last name

•          Email address

•          School affiliation and assigned role

•          Account credentials and login activity

•          Platform activity relating to cohort and account management

3.3 Student Information

We deliberately keep this to a minimum. We collect:

•          First name and last name

•          Email address or account login identifier

•          School or organisation affiliation

•          Cohort or class allocation

•          Course enrolments and learning progress

•          Quiz responses, assessment results and completion records

•          Login activity and platform usage necessary for progress reporting

3.4 Parent and Guardian Information

Where a family subscription is purchased:

•          First name and last name

•          Email address

•          Billing information

•          Linked child account associations

•          Platform activity relating to administration of the subscription

3.5 Payment Information

All payments are processed by Stripe, a third-party payment processor operating under PCI-DSS standards.

MARU Academy does not collect, store, retain or have access to complete credit card numbers, card verification values (CVV), or other sensitive payment credentials.

We have access only to limited billing and subscription information required to administer licences, including account holder name, billing email address, transaction history, subscription status, payment status and licence status.

4. Information We Deliberately Do Not Collect

Unless voluntarily provided by a school, teacher, parent or guardian, we do not intentionally collect:

•          Student residential addresses

•          Student mobile telephone numbers

•          Student photographs or video of students

•          Student date of birth

•          Government-issued identification documents or identifiers

•          Health information

•          Sensitive information as defined by the Privacy Act 1988 (Cth), including racial or ethnic origin, religious beliefs, sexual orientation or criminal record

•          Precise geolocation data

•          Complete credit card details

We have disabled optional profile fields and features within the MoodleCloud learning management system wherever reasonably practicable, specifically in order to minimise the personal information collected about students.

MoodleCloud is operated independently of MARU Academy, and we do not control every aspect of its infrastructure. Users may voluntarily upload information, and platform updates or configuration changes may occasionally alter what is captured. We periodically review platform settings and conduct administrative audits to confirm privacy controls remain correctly configured. Where we become aware that unnecessary personal information has been collected or uploaded, we take reasonable steps to remove or restrict access to it.

5. How We Collect Information

We collect personal information when a user or their school:

•          Registers or is allocated an account

•          Purchases or trials a subscription

•          Is enrolled in a course or cohort

•          Completes lessons, quizzes or assessments

•          Contacts us for support

•          Books a meeting through Calendly

•          Attends a demonstration, training session or webinar through Zoom

•          Submits an enquiry or onboarding form

•          Subscribes to our newsletter or marketing communications

•          Browses our website

We collect most student information indirectly, from the school, teacher, parent or guardian who creates and manages the account. We rely on that school, parent or guardian to have the authority and any necessary consents to provide it to us.

Some information is collected automatically through cookies and analytics technologies. See section 14.

6. Why We Collect and Use Information

We use personal information to:

•          Provide access to the platform and deliver educational content

•          Create, allocate and manage user accounts and licences

•          Track learning progress and generate reports for teachers, schools and parents

•          Provide customer and technical support

•          Process payments and administer subscriptions, renewals and cancellations

•          Send service and administrative communications

•          Maintain platform security and prevent fraud or misuse

•          Improve platform performance, content quality and user experience

•          Comply with our legal and regulatory obligations

We do not sell personal information. We do not disclose student personal information to advertisers or data brokers.

7. Children’s and Student Privacy

This section sets out additional protections that apply to personal information about people under 18. It reflects our obligations under the Privacy Act 1988 (Cth) and is designed to align with the OAIC Children’s Online Privacy Code, which is scheduled for registration by 10 December 2026.

7.1 Best Interests of the Child

Before we collect, use or disclose personal information about a student, we consider whether doing so is in the best interests of that child. In practice this means we ask whether the information is genuinely necessary for the student’s learning, whether a less intrusive alternative exists, and whether collecting it could expose the student to harm, embarrassment or unwanted contact.

Where a proposed use of student information is not clearly in the student’s interests, we do not proceed with it.

7.2 How Student Accounts Are Created

MARU Academy does not enter into a subscription agreement directly with a person under 18. A student may only access the platform where access has been provided through:

•          a school or organisation that holds a current subscription and is authorised to provide that access; or

•          a family subscription purchased and managed by the student’s parent or legal guardian, who must be at least 18 years old.

This structure means students never self-register, and their information reaches us through an adult who is accountable for it.

7.3 We Do Not Market to Students

MARU Academy does not send marketing communications to students. Students receive only transactional and service communications necessary for account access and course delivery, including login credentials, password reset emails, and course notifications.

All commercial, promotional and product communications are directed to the school administrator, teacher, parent or guardian who manages the subscription.

7.4 No Targeted Advertising to Children

We do not use student personal information, learning progress, quiz results or platform activity for advertising or marketing purposes. We do not disclose student personal information to advertising platforms, and we do not permit advertising technology inside the learning platform itself.

Advertising and analytics technologies operate on our public marketing website only, not within the MoodleCloud learning environment where students complete their coursework. See section 14 for detail on what runs on our website and how to control it.

7.5 Consent and Parental Authority

For school subscriptions, the school warrants that it has a lawful basis and has obtained any parental or guardian consents required under applicable law and its own policies before providing student information to us.

For family subscriptions, the parent or guardian is responsible for the child’s use of the platform and for providing any consent required.

Where a parent or guardian consents to the collection of a child’s personal information on that child’s behalf, we support schools and families in making the child aware of what is being collected, in age-appropriate language.

7.6 Student and Parent Deletion Rights

A student, or a parent or guardian acting for a student, may request deletion of that student’s personal information at any time by contacting hello@maruacademy.com.au.

We will action a valid deletion request within 30 days. Where the student’s account was created by a school, we will notify the school administrator, as deleting the account will end that student’s access to the course and remove their progress records.

We may retain limited information where we are legally required to do so, or where it is necessary to establish or defend a legal claim. We will explain any such retention when we respond to the request.

7.7 Where to find this Information

This Privacy Policy is published in full at maruacademy.com.au/privacy-policy and is available to students, parents, guardians, teachers and schools at any time.

If you have a question about how we handle student information, email hello@maruacademy.com.au and we will answer it in plain language.

8. Learning Analytics and Reporting

The platform generates educational reporting so that teachers and parents can support student learning. This includes course progress, assessment results, completion status, login activity and engagement data.

For school subscriptions:

•          School administrators may access reporting for students within their subscription

•          Teachers may access reporting for students in cohorts assigned to them

•          Schools may export reports at any time during an active subscription

For family subscriptions:

•          The parent or guardian may access their own child’s progress and reporting data

Schools and parents are responsible for assigning these roles appropriately and for ensuring only authorised staff can view student records.

We use aggregated and de-identified platform data to improve course content and platform performance. De-identified data does not identify any student and is not capable of doing so.

9. Who We Share Information With

We use third-party service providers to operate the platform. These providers process information on our behalf, under their own privacy and security obligations.

Learning and Platform Services

MoodleCloud (Moodle Pty Ltd) — Learning management system, hosted in Australia. Processes: student, teacher and administrator accounts; course progress; assessment results; reporting data.

Cloudflare — Account authentication, account creation, platform security and performance. Processes: account administration data, authentication records.

Framer — Website hosting. Processes: website visitor data, enquiry form submissions.

Payment Processing

Stripe — Payment processing, subscription management, fraud prevention. Processes: billing and transaction information. Stripe does not share full card details with us.

Communications and Marketing

Klaviyo — Email communications and marketing. Processes: contact name, email address, communication preferences and engagement.

HubSpot — Customer relationship management and sales pipeline. Processes: school and contact details, enquiry history, deal and subscription records.

Calendly — Appointment scheduling. Processes: name, email address, meeting booking details.

Zoom — Online meetings, demonstrations, training and webinars. Processes: name, email address, meeting participation records.

Tawk.to — Website live chat support. Processes: chat transcripts and any contact details provided in chat.

Website Analytics and Measurement

Google Analytics (Google LLC) — Website analytics. Processes: website usage data, device and browser information.

Meta Platforms — Website advertising measurement. Processes: website visitor activity on our public marketing site only.

Other Disclosures

We may also disclose personal information:

• to professional advisers such as accountants and lawyers, under obligations of confidentiality

• where required or authorised by law, a court order, or a regulator

• where necessary to prevent a serious threat to the life, health or safety of any individual

• to a purchaser or successor as part of a genuine sale or transfer of our business, where the recipient agrees to handle the information consistently with this Policy

We do not sell personal information to any third party.

10. Overseas Storage and Disclosure

Some of our service providers store or process information outside Australia.

Student learning data is stored in Australia.

Our learning management system, MoodleCloud, hosts the MARU Academy site in the Australian (Sydney) region on Amazon Web Services. Student accounts, course progress, quiz responses, assessment results and reporting data are stored on Australian infrastructure and are not transferred overseas in the ordinary course of delivering the platform.

Other providers

Some of our supporting business systems are operated by organisations based in the United States, and information handled by those systems may be stored or processed in the United States or in other countries where they operate infrastructure.

Payment Processing

Stripe — Billing and transaction information.

Customer Management and Communications

HubSpot — School and contact details, enquiry and subscription records.

Klaviyo — Contact name, email address, marketing engagement.

Calendly — Name, email address, meeting bookings.

Zoom — Name, email address, meeting participation.

Tawk.to — Live chat transcripts.

Infrastructure

Cloudflare — Account authentication and administration data.

Framer — Website visitor data and enquiry submissions.

Analytics and Measurement

Google Analytics — Website usage data.

Meta Platforms — Marketing website visitor activity.

These systems hold information about schools, teachers, parents and enquirers. They do not hold student learning records, which remain within MoodleCloud in Australia.

Before disclosing personal information overseas, we take reasonable steps to satisfy ourselves that the recipient handles it in a manner consistent with the Australian Privacy Principles. We select established providers with published privacy and security commitments and contractual data protection terms.

We do not rely on your consent as the basis for overseas disclosure. We rely on the reasonable steps described above, and we remain accountable for how these providers handle information we give them.

11. Data Security

We take reasonable technical, organisational and administrative steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These include:

•          Storing all student learning data on Australian infrastructure

•          Encrypted connections (HTTPS/TLS) across the website and platform

•          Password-protected accounts with role-based access controls

•          Restricting administrative access to those who require it

•          Relying on established cloud infrastructure providers with recognised security certifications

•          Periodic review of platform privacy and access settings

•          Minimising the personal information we collect in the first place, which is the most effective protection available

No internet-based service can be guaranteed completely secure. Schools, teachers, parents and users must also take reasonable precautions, including keeping login credentials confidential and notifying us promptly of any suspected unauthorised access.

12. How Long We Keep Information

We keep personal information only as long as reasonably necessary for the purpose it was collected, or as required by law.

12.1 Student and Learning Data

Student personal information and learning records are retained for 30 days after a subscription expires or is terminated, and are then deleted.

This 30-day window exists so that a school has a final opportunity to export its reports, and so that a school renewing shortly after expiry does not lose its students’ progress.

Schools and parents are responsible for exporting any reports or records they need to retain before the end of this period. After 30 days, deleted learning data cannot be recovered.

12.2 Account and Billing Records

Business records, including invoices, transaction records and subscription history, are retained for seven years in accordance with Australian taxation and corporate record-keeping obligations.

12.3 Marketing Contacts

Where a person has subscribed to our marketing communications, we retain their contact details until they unsubscribe or ask us to delete them.

12.4 Enquiries and Support

Support and enquiry correspondence is retained for up to two years, so that we can maintain continuity of support and resolve any disputes.

13. Suspension, Non-Payment and Termination

If a subscription payment is overdue or a customer materially breaches our Terms and Conditions, we may suspend access to the platform.

Except where urgent action is necessary to protect a person, data, the platform or our legal position, we will give written notice of the reason and a reasonable opportunity to resolve the issue before suspending access.

Suspension restricts access. It does not immediately delete student records. Where a subscription is ultimately terminated or expires without renewal, the 30-day retention period in section 12.1 applies before learning data is deleted.

This reflects our position that student learning records should not be destroyed without warning because of a commercial dispute between MARU Academy and a school.

14. Cookies, Analytics and Advertising Technologies

14.1 What We Use

Our public marketing website at maruacademy.com.au uses:

•          Framer analytics — first-party page analytics measuring visits and navigation

•          Google Analytics — website usage analysis, including pages viewed, device type, browser and approximate location derived from IP address

•          Meta Pixel — measures the effectiveness of advertising campaigns and may be used to show our advertisements to people who have visited our website

14.2 Where These Do and Do Not Operate

These technologies operate on our public marketing website only.

They do not operate inside the MoodleCloud learning platform where students complete their courses. Student learning activity, quiz results and progress data are not shared with Google or Meta and are not used for advertising.

14.3 How to Control Them

You may:

•          Manage or block cookies through your browser settings

•          Opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on

•          Adjust your advertising preferences within your Meta account settings

•          Use browser tracking protection or privacy extensions

Blocking cookies may affect some website functionality but will not affect access to the learning platform.

14.4 A Note for Schools

We recognise that schools may have policies restricting advertising technology on services used by students. Because our advertising and analytics tools run only on the public marketing website and not within the learning environment, students completing coursework are not exposed to them.

15. Marketing Communications

We may send service updates, educational announcements, product information and marketing communications to school administrators, teachers, parents, guardians and individual adult customers.

We do not send marketing communications to students. Students receive only transactional emails necessary for account access and course management, such as login credentials and password resets.

Every marketing email to adults includes an unsubscribe link, and you may opt out at any time. We will continue to send essential service communications to all subscribers, such as billing notices, renewal notices required under our Terms and Conditions, security notifications, and platform updates, because these relate to the operation of your subscription.

16. Accessing, Correcting and Deleting Your Information

You may ask us to:

•          Access the personal information we hold about you

•          Correct information that is inaccurate, out of date, incomplete or misleading

•          Delete personal information we hold about you

Send requests to hello@maruacademy.com.au.

We will acknowledge your request within 5 business days and respond substantively within 30 days.

We do not charge a fee for making a request, or for correcting information. If a request for access requires substantial work, we may charge a reasonable cost-based fee, and we will tell you the amount before proceeding.

We may need to verify your identity before acting on a request. Where a request concerns a student account created by a school, we may need to involve the school administrator, because the school controls that account and the request affects the student’s course access.

If we refuse a request, we will tell you in writing why, and how you may complain.

17. Data Breach Response

We maintain a process for responding to actual or suspected data breaches.

If we become aware of a breach involving personal information, we will:

1.        Contain the breach and take immediate steps to limit further access or disclosure

2.        Assess what information was involved and who is affected

3.        Evaluate whether the breach is likely to result in serious harm

4.        Notify affected individuals and, where required, the Office of the Australian Information Commissioner, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth)

5.        Notify the relevant school administrator where student information is involved, so the school can meet its own obligations to students and families

6.        Review what happened and improve our controls

Where student information is involved, we treat the matter as high priority regardless of the number of records affected.

18. Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please tell us so we can put it right.

Step 1 — Contact us. Send your complaint to hello@maruacademy.com.au with the subject line “Privacy Complaint”. Include what happened, when, and the outcome you are seeking.

Step 2 — Our response. We will acknowledge your complaint within 5 business days and provide a written response within 30 days. If we need longer, we will explain why and tell you when to expect our response.

Step 3 — External review. If you are not satisfied with our response, or we do not respond within 30 days, you may refer your complaint to the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner (OAIC)
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

You may also contact your state or territory education authority where a complaint concerns student information handled through a school.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version will always be published on our website with a revised “Last Updated” date.

Where a change materially affects how we handle personal information, we will give reasonable advance notice to affected schools, parents and customers before it takes effect.

We will not apply a change retrospectively to information already collected in a way that reduces the protection that applied when it was collected.

20. Contact Us

For any question about this Privacy Policy, a request to access, correct or delete information, or a privacy complaint:

MARU ACADEMY PTY LTD
ABN 55 696 845 940
Sydney, New South Wales, Australia

Email: hello@maruacademy.com.au
Website: www.maruacademy.com.au