Privacy

1. Who we are

Subsi is operated by Coovee Pty Ltd (ABN 25 686 831 327), based in Sydney, Australia. In this policy, “Subsi”, “we”, and “us” refer to Coovee Pty Ltd.

Questions about privacy can be sent to privacy@subsi.ai. Product support can be reached at support@subsi.ai.

2. What we collect

We collect the information needed to create and run a family account, teach each learner, keep the service safe, and meet our legal obligations.

Account and family information

• Account Holder name, email address, authentication details, and Product preferences;
• learner Profile details such as name, year level, timezone, and the Profile Access permissions chosen by the Account Holder; and
• plan, trial, payment status, and transaction references supplied by RevenueCat and the payment provider. Subsi does not receive or store full card details.

Learning information

• Courses, Topics, enrolments, Progress, and retained learning history;
• Chats, prompts, Attachments, generated teaching material, and feedback;
• Quiz Sittings, learner Answers, Judgments, Evidence, and Practice Activities when those features are used; and
• interests and learning context deliberately added to About Me.

Technical and support information

• Product Sessions, device and browser information, IP address, timestamps, security events, and operational logs; and
• support messages and information a family chooses to provide when asking for help.

3. How we use information

We use personal information to provide and improve Subsi: authenticate Users, apply family permissions, personalise teaching, generate and assess learning activities, show Progress, prevent abuse, diagnose faults, provide support, administer trials and payments, communicate important service information, and comply with law.

We do not sell personal information. We do not use a child’s Learning Record for targeted advertising, and the public Marketing Site uses no advertising cookies, analytics, tracking pixels, forms, or local storage.

The signed-in Product uses an opaque, secure Product Session so it can keep a User signed in. Its operational systems may also process the technical information needed to secure and deliver the service.

4. Children and families

Subsi’s first Product is for families with children in NSW Years 2–6. An adult Account Holder creates or governs child Profiles and decides who receives typed Profile Access. Sharing an email address does not itself grant access.

Each Profile has its own Learning Record. The Account Holder may view understandable Progress for a child they are authorised to manage. Core child-safety boundaries cannot be disabled by a family setting.

If you believe a child is using Subsi without the appropriate adult involvement, contact privacy@subsi.ai.

5. Service providers and overseas processing

We use carefully selected providers to operate Subsi. Provider categories include Google Cloud for hosting and storage, Firebase Authentication for sign-in, Resend for transactional email, RevenueCat for Subscription purchase and management, Stripe as the web card-payment gateway, and selected AI model providers for teaching and structured assessment calls.

Some providers may process information outside Australia. The location depends on the provider and service configuration. We assess providers and limit the information sent to what the function requires, but overseas recipients may be governed by different privacy laws.

We may also disclose information when required by law, to respond to a serious safety risk, or as part of a business transaction subject to appropriate confidentiality and privacy protections.

6. Security and retention

We use access controls, encrypted transport, environment separation, monitored infrastructure, restricted service permissions, and application and database authorisation controls to protect information. No online service can promise absolute security.

We retain information while an account is active and for as long as needed to provide Subsi, preserve the Learning Record the family has chosen to keep, resolve disputes, maintain security and operational records, and meet legal obligations. When deletion applies, information is removed from active systems and expires from protected backups according to their ordinary lifecycle, unless a legal requirement requires longer retention.

If a data breach is likely to cause serious harm, we will investigate, take steps to contain it, and notify affected people and the Office of the Australian Information Commissioner when required.

7. Your choices and rights

An Account Holder can update family and Profile details, control permitted Profile Access, and request account deletion through the Product or support. You may ask to access or correct personal information, request deletion where applicable, or ask how an automated learning decision was produced.

We may need to verify identity and authority before acting on a request, especially where it affects a child’s Profile. Some records may need to be retained where law, security, dispute resolution, or another person’s rights require it.

8. Contact and complaints

For access, correction, deletion, or a privacy complaint, email privacy@subsi.ai. Please explain the issue and the outcome you are seeking. We will acknowledge and investigate the matter within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

We may update this policy when the service or law changes. Material changes will receive a new effective date and, where appropriate, notice through Subsi.