Privacy Policy

Version 2026-09-29 · Last updated 29 September 2026

Bright Meadow Learning (ABN 39 973 076 064) operates this service. This policy explains how we handle personal information about parents and children, including under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Contact us at admin@brightmeadowlearning.com or 8 Karragata Ct, Tallebudgera QLD 4228.

1. The short version

• Parents hold the account and create child profiles. Children do not have separate accounts, cannot chat with other users and never see ads on our site.
• We collect profile details and learning records to provide activities, save progress and help parents plan learning.
• Miss Marigold is an optional AI assistant for parents. Using her AI features sends questions and relevant child information to OpenAI. Voice features also use ElevenLabs.
• We do not sell personal information or use it for advertising. Our service providers receive information as explained below.
• You can view and edit profiles, delete a child or close your account. Some billing, security and usage records remain after deletion.

2. What we collect and why

Parent and account information

We collect your name, email address and password, or your Google account identifier if you use Google sign-in. Passwords are stored as salted bcrypt hashes, not readable passwords. We also keep account and sign-in dates, email-verification and terms-acceptance dates, the accepted terms version, family links, account status and trial or subscription details. These let us manage access, protect accounts and record your agreement.

For subscriptions we keep your Stripe customer and subscription identifiers, child count, billing status and billing dates. Stripe receives your name, email address, our internal account reference and subscription details. You provide payment details and any billing address directly to Stripe. Full card numbers and card security codes stay with Stripe.

We receive information you send when asking for support or making a privacy request. Account emails include verification, password reset, trial-ending and billing notices. Resend sends our transactional emails; Stripe may send payment emails.

Child profiles and learning

You provide each child's first name or nickname, year level, chosen avatar, optional interests and settings. Please avoid surnames or unnecessary identifying details. We record activity attempts, answers counted as correct or incorrect, scores, dates, duration, quiz results and skill progress. We also save assignments, learning sessions, in-game hero names and quest progress.

Meadow Planner stores your learning plan, focus periods, scheduled activities, custom activities, notes or reasons, preferences, completion records and your assessment of mastered skills. We use these records to show progress and reports, organise learning and provide recommendations. Information is supplied by parents and generated as children use the activities.

Technical and administrative information

Our servers and service providers receive connection information such as IP addresses, browser information and requested URLs. We use IP addresses to limit abusive requests. Error logs help us investigate faults. Administrators can access account and learning records for support and administration. Security and administrative actions, including suspension, complimentary access and deletion, are audit-logged; these records may include account identifiers and email addresses.

We measure activity use and learning outcomes within the service, and record AI usage and cost as described below. We do not use third-party website analytics or advertising trackers.

3. Miss Marigold: AI, voice and your choices

Miss Marigold's parent assistant uses AI to answer questions, summarise progress, suggest activities and help with plans. Her answers can be wrong or incomplete. Check suggestions before using them. She does not provide professional advice or make decisions about your child's education for you.

When you ask a question or choose an AI action, we send OpenAI your question, relevant recent conversation turns or a summary of earlier questions, and context needed for the feature. This can include the selected child's first name, year level, activity results, skill progress, learning goals, plan settings and planned activities. We also send a pseudonymous account identifier for abuse prevention. Account email, passwords and payment details are not part of this context, but anything you type into a question may be sent. Please do not include health information or other sensitive details about your family or anyone else.

Requests use OpenAI's store: false setting, which disables storage of the response as retrievable application history. It is not a zero-retention guarantee. OpenAI may retain prompts and responses in abuse-monitoring logs for up to 30 days, or longer where required by law or reasonably necessary to protect its services or others from harm. API data is not used for model training by default; separate provider account settings can affect data sharing. See OpenAI's data controls.

When voice replies are on, the reply text is sent to ElevenLabs to generate speech. That text may contain your child's name or details discussed in the answer. If you choose the microphone and allow browser access, ElevenLabs Scribe transcribes your recording, with a default limit of 30 seconds per clip. The transcript is automatically submitted as your question to OpenAI; there is no separate confirmation before sending. The microphone is optional and does not listen continuously.

ElevenLabs zero-retention mode is not enabled. ElevenLabs may retain input text, recordings, transcripts and generated audio under its own terms. Depending on the provider account settings and agreement, it may also use content to improve or train its models. See ElevenLabs' privacy policy and retention information.

We do not keep a permanent chat-transcript or microphone-recording archive in our application database. The current conversation and replay audio are held in browser memory. Reply text is also held temporarily in server memory for speech playback; playback access expires after 15 minutes. General answers that contain no child context can be cached in server memory. If you accept a proposed plan change, the resulting plan information is saved.

Our marigold_usage records contain parent and child identifiers, request time, feature, model, token counts, estimated cost, processing time, status, voice character counts or audio duration, and error details. They do not have question or answer transcript fields. Provider error messages can nevertheless contain text from a request, so these logs are not guaranteed to be free of personal information.

To avoid these AI disclosures: do not send Miss Marigold questions or select her AI actions, including child summaries, recommendations and AI planning. You can still use games, lessons, progress reports and the manual planner. Her AI, voice and microphone features are available by default; availability does not itself start a recording or send a question. The automatic suggestion indicator uses our own learning records without an OpenAI call. Mute her voice before asking to avoid sending new reply text to ElevenLabs, and leave the microphone unused or deny its browser permission to avoid audio transcription. Muting does not disable OpenAI text replies.

4. Service providers and overseas processing

We use the following providers. Information may be processed outside Australia, where privacy laws may differ. The countries below describe known processing arrangements; global services may also use other locations listed in their privacy and subprocessor information.

• Replit and its PostgreSQL host: run the website and store account, child, progress, planner, usage and audit data, and operational logs. Hosting and database region: United States.
• Stripe: receives parent contact details, account references, subscription and transaction information, and payment and billing details you enter. It processes payments and prevents fraud. Processing includes the United States and other countries in Stripe's privacy policy.
• Resend: receives your email address and account-email content, including your name and account links, to deliver transactional emails. Stored data is held in the United States. See Resend's security information.
• Google sign-in: if you choose it, Google receives sign-in requests and technical connection data and supplies us with your Google identifier, name, email and verification information. Google processes data globally, including in the United States. You can use email and password instead.
• Google Fonts: some pages load fonts directly from Google. Google receives your IP address and request information, even if you do not use Google sign-in. Processing uses Google's global infrastructure, including the United States. See Google's privacy policy.
• jsDelivr: 3D pages load Three.js and related files from its CDN. It and its delivery providers receive your IP address and technical request information to deliver those files. Requests use a worldwide network, which can include servers outside Australia. See jsDelivr's network and privacy policy.
• OpenAI: processes the questions, conversation context and child learning information described above to generate AI answers. Processing includes the United States; the integration does not select Australian data residency.
• ElevenLabs: processes reply text, optional microphone recordings, transcripts and generated speech. Processing includes the United States; its published cloud-provider locations also include the Netherlands and Singapore.

Where Australian Privacy Principle 8 applies, we must take reasonable steps to protect information disclosed overseas and remain accountable as required by Australian law. Using the service does not waive those protections. Providers also have their own legal, security and retention obligations.

Adults you link to your family can access shared child profiles and learning information. We may also disclose information where required or authorised by law, to respond to a serious safety threat, or to establish or defend legal claims.

5. Children and parental control

The activities are designed for children aged about 3–8, from Pre-prep to Year 2, under adult supervision. A parent or guardian creates and manages each child profile. Children cannot create an account or message other users. The service has no advertisements.

You can see and change profile details in the Parent Area and view learning records in progress and reports. Contact us to correct a learning record you cannot edit yourself. Only the profile's owning parent can pause or delete it. Deleting a profile removes its learning records and plans from the live database. Unlink an adult when they no longer need access to your family.

6. Cookies and browser storage

We use one signed login session, implemented as the bml_session cookie and its companion signature cookie, bml_session.sig. Both are HTTP-only, use SameSite=Lax and are marked Secure on the production site. They expire after up to 30 days unless renewed or cleared. Blocking them prevents sign-in.

Local and session storage on your device keep cached account and child information, learning or game state and preferences such as sound settings. You can clear this through your browser. On a shared device, sign out and clear site data when needed. Google sign-in and Stripe's hosted payment pages may use their own cookies under their policies.

7. Security and data breaches

We use HTTPS for the public service, bcrypt password hashing, signed session cookies, access checks and request limits. No system can guarantee complete security. Keep your login details private and tell us promptly if you suspect someone has accessed your account.

We investigate suspected data breaches and take steps to contain them. Where the Notifiable Data Breaches scheme applies, we take reasonable steps to assess suspected eligible breaches within 30 days. If a breach is likely to cause serious harm and remedial action has not prevented that risk, we notify the OAIC and affected people as soon as practicable, as the scheme requires.

8. Retention and deletion

• Profiles and learning: we keep them while the account exists, including during a paused profile, expired trial or cancelled subscription, so you can return. You can delete a child or your whole account.
• Whole-account deletion: deletes the child profiles you own and their progress, heroes and plans, removes family links and authentication tokens, and deletes your custom activities. Your parent record remains with a replacement name and anonymised email. Password and linked sign-in identifiers are removed. Internal identifiers, Stripe references, account dates and terms-acceptance records remain.
• Billing: we retain invoices and payment records for seven years for accounting, tax and dispute purposes, and longer if legally required. Deleting your account does not delete Stripe's customer or transaction records.
• Audit and AI usage: these records are retained separately and are not automatically erased when a child or account is deleted. Audit details may retain your original email; AI usage records retain internal parent and child identifiers and any recorded error details. These records are not fully anonymous.
• Logs and backups: operational logs and provider backups are separate from the live database. Account deletion does not immediately erase every provider copy. Retention follows the provider's arrangements and the purpose for which the record is needed.

We keep personal information only for purposes we still need, including legal obligations, security and resolving disputes. Where Australian Privacy Principle 11 requires it, we take reasonable steps to destroy or de-identify information no longer needed. Contact us about access to or deletion of retained records; we will explain any lawful reason for keeping them. Deleting a Bright Meadow account does not automatically remove information already processed by OpenAI or ElevenLabs.

9. Access, correction and complaints

You can browse the public pages without an account. Account access, saved child progress and subscriptions need the information described above. Optional interests, Google sign-in and Miss Marigold are not required to use the learning activities.

Use the Parent Area to view or edit profiles, print reports, pause or delete a child, or delete your account from Account & billing. For a copy of your information, an export, a correction or help with deletion, email admin@brightmeadowlearning.com. We may need to verify your identity and authority to act for a child. We respond within a reasonable period, generally 30 days, and explain any refusal and available complaint options.

If you have a privacy complaint, contact us at that email address or 8 Karragata Ct, Tallebudgera QLD 4228 and describe the issue. We will investigate and aim to respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) through its privacy complaints service. The OAIC determines whether it can investigate.

10. Changes to this policy

We publish updates on this page with a new date. For a material change to how we handle information, we will give notice by email or a prominent notice on the service and seek consent where the law requires it.