Privacy Policy

Who we are

Ziado is a product of Congero Pty Ltd (Australia) ("we", "us"). We are responsible for the personal information collected through ziado.com and app.ziado.com, and we handle it in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Ziado is intended for use in Australia and is not directed at users in the European Union or the United Kingdom.

What we collect - minimal by design

• Parent account details: your name, email address and account settings.
• Child profile: a first name or nickname and an age or year level - that's all we need to place them on the skill map.
• Learning data: question attempts, per-skill confidence and mastery, stars and streaks - the evidence the adaptive engine runs on.
• Usage data: which features are used and how the app is navigated, recorded in our own systems so we can find problems and make Ziado better.
• Technical basics: the minimum device and session information needed to keep the service secure and working.

Why we collect it

To run the adaptive learning engine, show you honest progress, improve the product, and keep accounts secure. That's it. We do not sell personal data, and we do not advertise to children.

Children's data

• Child accounts are created and controlled by a parent or guardian (parental consent model).
• We collect only the data necessary for learning to work.
• Parents can access only their own children; teachers only their assigned classes.
• There are no public child leaderboards and no child-to-child contact.
• Benchmarking, where used, is anonymised.
• We take reasonable steps to align with recognised child-safety frameworks.

School accounts and students leaving a class

Where a child uses Ziado through a school, the school controls who is enrolled and which teachers can see a student's progress.

• When a student leaves a class, or a school's subscription ends, teacher and school access to that student's data stops immediately.
• We keep the child's learning record for 12 months so that a parent or guardian can claim the account and continue without losing progress. We will email the parent or guardian, where we have their address, to explain how to do this.
• If the account is not claimed within 12 months, we delete or de-identify the learning record.
• A parent or guardian can ask us to delete the record sooner at any time.

Emails we send

We email parents and account holders, never children.

• Service emails - weekly progress digests, practice reminders, billing notices, security and account messages. These are part of the service you have signed up for.
• Marketing emails - news about new features, offers and other products. We send these only if you have opted in, and you can opt out at any time using the unsubscribe link in the email or from your account settings.

You can turn off progress digests and practice reminders in your account settings. We will still send essential account, billing and security messages.

AI and content

Some learning content is drafted with AI assistance. All content passes schema validation, deterministic answer checks, human review and simulation before it reaches a child. We send the minimum personal information necessary to AI systems, and AI is never the source of truth for an answer.

How our AI providers handle data

We use OpenAI and Anthropic as AI sub-processors under their standard commercial API terms. Under those terms, they do not use the data we send them to train their models.

Improving Ziado

We use learning data to run and improve Ziado's adaptive engine - deciding what to ask next and how to pace a child's progress. This is the core of how the product works.

Where we use learning data to develop or train our own models, we use de-identified and aggregated data that cannot reasonably be used to identify an individual child. We do not train models on identifiable children's personal information.

Payments

Subscriptions are processed by Stripe. Your card details are handled by Stripe and are not stored by Ziado. Refer to the Stripe privacy policy here.

Where your information is stored and processed

Our website and app are hosted in Germany. Our AI sub-processors, OpenAI and Anthropic, process requests in the United States under their standard commercial API terms. Payments are processed by Stripe in the United States and other countries in which it operates. Our analytics and advertising providers - Google, Meta and TikTok - process information collected through our marketing website in the United States and other countries in which they operate.

This means some personal information is disclosed to recipients outside Australia. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through the contractual commitments in our agreements with each provider. We remain accountable for that information under the Privacy Act.

Analytics and advertising

We advertise Ziado to parents on other platforms. On our marketing website (ziado.com) only, we use Google Analytics and conversion tracking pixels from Google Ads, Meta and TikTok, so we can measure which advertising leads to sign-ups.

We do not run third-party analytics or advertising pixels inside the learning app at app.ziado.com, and we never disclose a child's name, age, year level or learning data to an advertising platform. Ziado contains no advertising.

Inside the app we measure usage with our own first-party event logging. That data stays in our systems and is not shared with any analytics or advertising company.

These platforms may use the information they collect through our website for their own purposes under their own privacy policies. Full detail, including cookie names and lifespans, is in our Cookie Policy.

Cookies

We use cookies and similar technologies as described in our Cookie Policy.

Keeping information secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include:

• encryption of data in transit (TLS 1.2 or higher) and at rest;
• passwords stored using a modern one-way hashing algorithm, never in readable form;
• multi-factor authentication for staff and administrative access;
• encrypted backups with periodic restore testing;
• a documented incident response plan, reviewed at least annually.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.

Retention and deletion

We keep personal information only as long as needed to provide the service or as required by law:

• While your account is open: we keep your account and learning data so progress is not lost.
• After you close your account or ask us to delete it: we delete or de-identify personal information within 30 days, other than records we are required to keep.
• Inactive accounts: if an account is unused for 24 months, we will email the account holder and delete the account if we do not hear back within 30 days.
• Billing records: retained for 7 years to meet tax and corporate record-keeping obligations.
• Backups: deleted data persists in encrypted backups for up to 35 days before being overwritten.
• De-identified data: may be retained indefinitely, as it cannot be linked back to an individual.

Your rights and how to reach us

You can ask us to access, correct or delete your family's personal information at any time. Contact us via the contact page or [email protected]. We will respond within 30 days. If we are unable to action a request, we will explain why.

If you are unhappy with how we have handled your personal information or a privacy request, you can complain to us using the details above. We will acknowledge your complaint and respond within 30 days. If you are still not satisfied, you can refer the matter to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

Changes to this policy

If we make material changes, we'll notify account holders by email and note the new date at the top of this page.

Read the plain-English version: our Child Safety & Data promise →