How AI Lift-Off collects, uses, and protects personal information in accordance with the Australian Privacy Principles
Effective date: 29 April 2026
AI Lift-Off (“the Platform”) is operated by the Western Australian Data Science Innovation Hub (WADSIH). This Privacy Policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
The Platform is an educational tool designed for use in Australian school classrooms with students in Years 5–10 (approximately 10–15 years of age). It is intended to be used under teacher supervision as part of structured classroom activities.
For technical details on our safety and content-filtering measures, see our Safety & Privacy page.
WADSIH is committed to managing personal information openly and transparently. This Privacy Policy explains how we handle personal information on the AI Lift-Off Platform. It is publicly available at /privacy-policy on the Platform and can be accessed without logging in.
We regularly review our practices and this policy. If we make material changes, we will update the effective date at the top of this page.
For questions about how we handle personal information, see Contact at the bottom of this page.
AI Lift-Off is designed so that students do not need to provide their real name to use the Platform.
Teachers are encouraged to use anonymous identifiers where their school policy requires it, making the Platform effectively pseudonymous or anonymous for students.
We collect only the personal information that is reasonably necessary for the Platform to function as an educational tool. We follow the principle of data minimisation.
| Data | Collected? | Purpose |
|---|---|---|
| Username | ✓ | Authentication and identification within the school. Set by the teacher; can be pseudonymous. |
| Password | ✓ | Authentication. Stored using industry-standard one-way hashing—the original password cannot be recovered. |
| Display name | ✓ | Optional. Shown on screen during sessions. Can be a nickname or first name only. |
| Year group | ✓ | Optional. Used to tailor content appropriateness (e.g. access to certain AI tools). |
| Email address | — | Not collected. |
| Phone number | — | Not collected. |
| Date of birth | — | Not collected. |
| Home address | — | Not collected. |
| Guardian information | — | Not collected. |
Personal information is collected directly from teachers (who create student accounts) and from students (who enter prompts and content during classroom activities). We do not collect personal information about students from third parties.
Students may inadvertently include personal information (such as their full name, email, phone number, or address) in AI prompts. The Platform automatically detects this using multiple detection methods. When detected:
Where personal information is received in this way, it is retained only as part of the safety log for teacher review. We do not use unsolicited personal information for any other purpose.
This Privacy Policy serves as our primary collection notice. At the time of collection:
We collect personal information for the following purposes:
We use personal information only for the purpose for which it was collected, or for a directly related purpose that the individual would reasonably expect.
| Purpose | Legal Basis | Data Used |
|---|---|---|
| AI-powered educational activities | Primary purpose (APP 6) | Student prompts, session data |
| Content safety and moderation | Primary purpose / legal obligation | Student prompts, safety alerts |
| PII detection | Primary purpose / legal obligation | Student prompts |
| Teacher oversight | Primary purpose (APP 6) | Interaction logs, flags, student notes |
| Authentication and session management | Primary purpose (APP 6) | Credentials, session tokens |
| Class and student management | Primary purpose (APP 6) | Usernames, class enrolments |
| Platform maintenance | Primary purpose (APP 6) | Bug reports, error logs |
To provide the Platform, certain data is shared with the following service providers:
| Service | Location | Data Shared | Purpose |
|---|---|---|---|
| OpenRouter | US | Student prompts (no names, emails, or identifying data) | AI text and image generation |
| Supabase | Australia | All Platform data | Database hosting and file storage |
| Vercel | Australia | API traffic | Application hosting |
We do not sell personal information, share it with advertisers, or allow third parties to use children’s data for purposes unrelated to the Platform.
If a school enables the WizKid AI Tutor integration, the student’s name, display name, and year group may be shared with the WizKid platform to provision a tutoring account. This integration is off by default and must be explicitly enabled by the school administrator.
We do not use personal information for direct marketing. We do not send marketing emails, promotional messages, or any unsolicited communications. We do not collect email addresses from students or teachers.
We take reasonable steps to store data within Australia. Our primary database and hosting infrastructure are located in Australia.
However, when student prompts are sent to AI models via OpenRouter, those prompts may be processed by AI model providers whose infrastructure is located outside Australia (including the United States and other jurisdictions).
Student prompts sent to AI models do not include student names, school names, or other identifying information beyond the content of the prompt itself.
We maintain Data Processing Agreements (DPAs) with our service providers where applicable to ensure data is handled in a manner consistent with the APPs.
We do not adopt, use, or disclose government-related identifiers (such as Tax File Numbers, Medicare numbers, or driver’s licence numbers) as our own identifiers. The Platform uses internally generated identifiers and school-chosen codes for identification.
If a student inadvertently includes a government identifier in an AI prompt, our PII detection system will flag and block the request.
We take reasonable steps to ensure that the personal information we collect and use is accurate, up-to-date, complete, and relevant.
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
| Data | Retention Period |
|---|---|
| Active accounts | While the school’s account remains active |
| AI interaction logs | While the school’s account is active (retained for teacher audit) |
| Safety flags | While the school’s account is active (retained for teacher review) |
| Student-uploaded images | While the school’s account is active |
| Deleted accounts | Marked as inactive and excluded from active use; removed upon school request |
Schools may request permanent deletion of their data by contacting us (see Contact section below). Upon receiving a verified deletion request, we will permanently remove the school’s data from our systems within a reasonable timeframe. Data may be retained longer if required by law.
Under the APPs, individuals have the right to request access to the personal information we hold about them.
To request access to personal information that is not available through the Platform’s interface, please contact us using the details in the Contact section below. We will respond to access requests within 30 days.
We may refuse access where permitted by law, for example if providing access would pose a serious threat to the life, health, or safety of any individual, or would unreasonably impact the privacy of others. If we refuse access, we will provide written reasons.
We take reasonable steps to correct personal information that is inaccurate, out-of-date, incomplete, irrelevant, or misleading, having regard to the purpose for which it is held.
AI Lift-Off is designed for use by school students in Years 5–10 (approximately 10–15 years of age). We recognise the particular importance of protecting children’s personal information and have built the Platform with the following safeguards:
AI Lift-Off does not use HTTP cookies—no session cookies, no tracking cookies, and no third-party cookies.
The Platform uses your browser’s local storage to hold:
Local storage data remains on your device only and is not transmitted to any third party. It can be cleared at any time by logging out or clearing your browser data.
If you have questions about this Privacy Policy, or for more information, please contact:
AI Lift-Off Program Coordinator, Western Australian Data Science Innovation Hub (WADSIH)
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the effective date at the top of this page and notify participating schools. We encourage you to review this policy periodically. Check the effective date at the top for the most recent update.