Privacy Policy

This Privacy Policy sets out how ATARIS collects, holds, uses, discloses, stores and otherwise handles Personal Information in connection with its website, application and related services.

We have adopted the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way in which we collect, use, disclose, store, secure and dispose of your Personal Information.

Under no circumstances do we sell your Personal Information to any third party. We do not rent, trade, or otherwise monetise your Personal Information, and we do not disclose it to third parties for their own independent marketing or commercial purposes. Any disclosure of your Personal Information is limited to disclosures made with your consent or at your direction, to service providers acting on our behalf to operate the service, or where required or authorised by law.

A copy of the Australian Privacy Principles may be obtained from the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

What is Personal Information and why do we collect it?

Personal Information is information or an opinion that identifies an individual. Examples of Personal Information we may collect include names, email addresses, phone numbers, school or year level details (if provided), billing details (handled by our payment provider), and information you submit through our services such as practice responses or uploaded files.

We may collect Personal Information directly from you when you create an account, complete forms, use our website or application, communicate with us, or otherwise interact with our services. We may also collect certain information through cookies and similar technologies. We collect, hold, use and disclose Personal Information for purposes including providing the services, operating and improving the platform, administering billing, providing customer support, communicating with you, and complying with legal and regulatory obligations. We may also use or disclose Personal Information for related secondary purposes where you would reasonably expect that use or disclosure, or where otherwise permitted or required by law. You may opt out of marketing communications at any time by using the unsubscribe link in the relevant communication or by contacting us.

Where reasonably practicable, and where required by law, we will take reasonable steps to notify you of the purpose for which the Personal Information is collected and how it will be handled.

Sensitive Information

Sensitive information is defined in the Privacy Act to include information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

We will only collect, use or disclose sensitive information:

• For the primary purpose for which it was collected
• For a secondary purpose directly related to the primary purpose
• With your consent
• Where required or authorised by law

Third Parties

Where lawful and reasonably practicable, we will collect Personal Information directly from you. In some circumstances, however, Personal Information may be provided to us by a third party. Where that occurs, we will take reasonable steps, where required, to inform you of the collection and the circumstances in which the information was provided.

Disclosure of Personal Information

We may disclose Personal Information only in the following circumstances:

• We do not sell, rent, trade, or otherwise monetise your Personal Information
• To third parties where you have consented to the disclosure
• To service providers engaged to assist us in operating the service
• Where required or authorised by law

Service providers we use

We engage the following categories of service providers to support the operation of ATARIS. These providers may collect, store or otherwise process Personal Information on our behalf and only for purposes connected with providing the service to you:

• Supabase (authentication, database, and file storage)
• Stripe (payment processing; we do not store full card details)
• Resend (transactional email delivery)
• Cloudflare (hosting, CDN, and bot protection via Turnstile)
• OpenRouter (AI processing for automated marking features, where enabled)
• Google Vertex AI and Google AI Studio (AI processing for automated marking features, where enabled)

Our inference providers, including OpenRouter, Google Vertex AI and Google AI Studio, do not use your data to train their models for our account usage. In limited circumstances, a human administrator may manually review user answer submissions for quality assurance, support, safety, or to improve marking accuracy.

Where your data is stored

The core user data we store, including account information, database records, and uploaded content, is hosted in Australia on servers located in Sydney through Amazon Web Services (AWS) ap-southeast-2.

Some of the third-party service providers listed above may process limited Personal Information outside Australia when providing services such as payments, email delivery, AI processing, or content delivery. Where that occurs, we take reasonable steps to ensure those providers handle Personal Information in a manner consistent with applicable privacy obligations.

Security of Personal Information

We take reasonable steps to protect the Personal Information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Where Personal Information is no longer required for a permitted purpose, we will take reasonable steps to destroy or permanently de-identify that information, subject to any legal, regulatory, accounting or reporting requirement to retain it.

Access to your Personal Information

Subject to applicable law, you may request access to the Personal Information we hold about you and request correction of that information where it is inaccurate, out-of-date, incomplete, irrelevant or misleading. If you wish to make such a request, please contact us in writing.

ATARIS will not charge a fee for making an access request, but may charge a reasonable administrative fee for providing access to Personal Information where permitted by law.

To protect your privacy and security, we may require you to verify your identity before granting access to or correcting Personal Information.

Maintaining the Quality of your Personal Information

We take reasonable steps to ensure that the Personal Information we collect, use and disclose is accurate, complete and up to date. If you believe that any Personal Information we hold about you is inaccurate, incomplete or no longer current, you should contact us as soon as reasonably practicable so that we can update our records.

Policy Updates

We may amend this Privacy Policy from time to time. The current version will be published on our website at https://atar.is/privacy.

Privacy Policy Complaints and Enquiries

If you have any questions, requests or complaints regarding this Privacy Policy or our handling of Personal Information, please contact us at contact@atar.is.