Student Data Terms and Conditions

1. Parties and agreement

These terms are between Teachers Buddy Pty Ltd (ABN 69 686 840 424), trading as Teacher's Buddy, and the school or school-operating organisation identified in the acceptance record. They supplement the general Terms of Service and incorporate the versioned Student Data Privacy Policy and the processing and retention schedule presented at acceptance.

For student-data services, these terms take priority over inconsistent general service terms. A separately signed agreement takes priority where it expressly varies these terms. A processing schedule specifies the permitted services, providers, locations and retention arrangements; it cannot silently reduce the safeguards in these terms. Mandatory legal rights and obligations continue to apply.

2. Authority and activation

The person accepting must be a signed-in school owner or administrator, have authority to bind the identified school, accurately state their role and the basis of their authority, read the required sections, accept these terms and acknowledge the privacy policy. We retain an acceptance record with the account identity, declarations, versions, date and selected permissions. Authority is self-attested unless we expressly record an independent verification.

Purchasing a school plan, creating an organisation or obtaining an administrator role does not establish authority to act for a real school. Do not activate the service if you lack that authority. We may request supporting evidence or suspend processing where authority, identity or the permitted service arrangements are in doubt.

Acceptance activates the available, selected functionality when the school's processing arrangements are ready. It does not grant access to every individual file, authorise AI by default, or enable processing in a country or service outside the accepted schedule.

3. Permitted service and school instructions

The service supports educational learning-support records, student profiles, group membership, observations, adjustments, evidence and related records management. Optional AI assistance and file processing are included only when separately enabled and covered by the accepted schedule. The service is not a medical diagnostic system or a substitute for professional judgement or the school's statutory reporting duties.

The school retains its rights in its records and grants Teacher's Buddy only the rights needed to process them for these services and applicable legal obligations. We act on the school's documented instructions, including its configuration and authorised staff actions. We will raise instructions we reasonably believe would breach applicable data-protection law and may pause affected processing while the issue is resolved.

4. School responsibilities

The school must establish a lawful basis for the information and processing, provide required collection and privacy notices, obtain any necessary student or parent/guardian consent, and keep appropriate evidence. Accepting this agreement is an institutional authorisation, not parental consent or a declaration that consent is never needed.

The school must supply relevant, accurate information; limit access to staff who need it; keep membership and permissions current; supervise use; protect credentials and exports; and promptly tell us about suspected misuse, incorrect access or incidents. The school remains responsible for decisions about students and for disclosures it makes outside the service.

Recordkeeping, health privacy and child-safety obligations vary between jurisdictions and school sectors. A schedule suitable for one Victorian government, Catholic or independent school must not be assumed suitable for another. The school must identify its applicable retention and preservation requirements and authorised decision-makers.

5. Teacher's Buddy responsibilities

We will restrict processing to the agreed purposes and applicable legal obligations; apply appropriate technical and organisational safeguards; restrict personnel access according to duties; and require relevant service providers to protect information under appropriate confidentiality, security and data-processing terms. Using a service provider does not remove our obligations under this agreement.

We will provide reasonable assistance with access and correction requests, privacy incidents, authorised exports and records disposition, taking account of the service and applicable law. On a reasonable school request, we will provide available information about the relevant processing and safeguards, subject to confidentiality and protection of other customers and service security.

We do not sell student information, use it for advertising or train foundation models on student content. General account integrations and the platform's general AI provider list do not expand the student-data processing the school has authorised.

6. AI processing, minimisation and human review

The school must separately opt into AI processing. The accepted schedule identifies the provider, processing country, permitted purposes and relevant provider handling, including retention and abuse-monitoring arrangements. Where automatic support summaries are enabled within that scope, authorised staff saves and edits may trigger AI processing and storage of a generated summary without a separate confirmation for each request.

Teacher's Buddy applies automated minimisation to supported student information before provider submission, including substitution of known names and removal of common identifier patterns. This is pseudonymisation, not a warranty that every identifier is removed or that the information is anonymous. Educational, health and contextual information may remain identifying or sensitive. The student-data safeguards and the school's obligations concerning lawful authority, notices, consent and relevant information continue to apply.

For IEP creation and supported goal revisions, staff must review the outgoing information before submission and check the resulting draft against its sources before explicitly saving it. Saving a draft does not approve the plan. Automatic support summaries are stored separately as generated aids, without being represented as staff-approved records or original evidence; staff must verify them before relying on them. AI content may be inaccurate, biased, incomplete or out of date. The school remains responsible for decisions and agreed provision.

The school must not use these features for autonomous diagnoses, disability or funding eligibility, discipline or other significant decisions about a student. Staff must not attempt to bypass the student-data processing controls by placing protected content in ordinary resource-generation prompts or unrelated integrations.

If an approved route is unavailable, the service must fail without silently switching to an unapproved provider or country. We may update models within the approved provider and country without renewed acceptance while purposes and material data-handling terms remain unchanged. Changing that scope requires renewed school acceptance before the changed processing. Model names are operational details rather than a separate consent requirement.

Disabling provider-stored completions does not establish zero retention; provider abuse monitoring, support handling and other retention are governed by the accepted schedule and applicable provider arrangements. Withdrawal stops new authorised requests but cannot recall material already sent to a provider. Minimised inputs and generated outputs remain subject to the student-data access, preservation, export and disposal safeguards.

7. Records, retention and end of access

Records are retained and disposed of according to the accepted school-specific schedule, applicable law and preservation holds. A single default deletion period does not apply to all student information. A request to remove a record may require review of record class, retention dates, authority and holds before it can proceed.

An authorised school administrator may withdraw in Integrations & Permissions. Withdrawal stops ordinary access and new processing; it does not immediately erase records, undo prior lawful processing or revoke information already exported. Restricted management may continue for lawful preservation, controlled retrieval, export and approved disposal. Re-enabling requires fresh acceptance, and outstanding operations may need to settle first.

On service closure or termination, we and the school will arrange authorised return or export and disposal subject to recordkeeping obligations. The schedule must distinguish active records, backups, provider copies and audit evidence. We will not certify deletion of every copy when only primary records have been erased. Changing staff or cancelling a subscription does not override required retention.

8. Incidents and legally required disclosure

Each party must promptly report relevant suspected security incidents and cooperate with investigation, containment and remediation. We will notify the affected school without undue delay after becoming aware of a breach affecting its student information and provide available information needed for its response. Each party remains responsible for notices to individuals and regulators required by law.

Where a legal obligation requires disclosure or continued retention, we may comply and will inform the school where legally permitted. Neither party may use this agreement to prevent a lawful complaint, safeguarding report or exercise of privacy rights.

9. Changes and renewal

We retain versioned documents and acceptance records. Material changes are notified through an administrator notice, email or equivalent service communication. Processing outside the accepted provider, location, purposes or material data-handling terms requires renewed acceptance; continued use alone is not treated as agreement to that expansion.

A new principal or other authorised representative can renew using their own account and current authority details. Renewal creates a new receipt and preserves earlier receipts. It does not erase records or retrospectively rewrite who accepted an earlier agreement.

10. Responsibility, legal rights and disputes

Each party remains responsible for its own acts, omissions and obligations under applicable law and this agreement. Nothing in these student-data terms excludes rights, remedies, consumer guarantees or liabilities that cannot lawfully be excluded. The general Terms of Service's blanket exclusion of liability does not exclude responsibility for breach of these student-data obligations.

Raise disputes first with legal@teachersbuddy.com so the parties can seek a resolution. This does not restrict urgent court relief, regulator complaints or individual privacy rights. These terms are governed by Victorian law, and the parties submit to the non-exclusive jurisdiction of Victorian courts, subject to mandatory laws and rights applying elsewhere.