ClassBasics Pty Ltd (ACN 159 529 236) operates vwx.au and classbasics.com. This policy explains what personal information we handle — which is deliberately very little — and why. Contact: admin@vwx.au. Revision 1 — effective 23 September 2026.
Data minimisation is the design, not an afterthought. We align with the Australian Privacy Principles (Privacy Act 1988 (Cth)) as a matter of policy. The platform is built so that students are pseudonymous and the purchaser's email address is the only standing personal identifier we hold. We never store student names, ages or dates of birth, and we never sell data. We do advertise our own service to you — the free workbooks carry our name and web address on every page, and the catalogue promotes the paid pass — but we run no third-party advertising, no ad personalisation and no cross-site tracking. If third-party advertising ever comes to our services, this policy will be updated first.
Card payments are processed by Stripe. Card details are entered directly into Stripe's embedded component and never pass through or are stored on our servers. Stripe handles that data under its own privacy policy and applicable payment-card standards.
Email addresses are verified at two layers. At capture: when an account is created or a purchase is made, the address entered may be checked by Reoon, an email-verification service that tests whether the address is deliverable. Reoon receives only the email address itself — never passwords, learning data or other personal information — and if the verification service is ever unavailable, sign-up simply proceeds normally: the check can never block a legitimate purchase. Before sending: our mail provider Emailit verifies recipient addresses before delivery and suppresses undeliverable ones. Sent-message logs are retained for up to 365 days and no longer.
The service is designed for students under a purchaser's (parent, guardian or school's) oversight. We do not knowingly collect personal information from children: student accounts are pseudonymous by design, and the purchaser — an adult — holds the relationship with us. Where a student asks to access material above a purchaser-set ceiling, the request is routed to the purchaser (a one-click signed link to the purchaser's email); we make no age-based decisions and store no age data.
We disclose personal information only to providers who need it to run the service:
As the service grows we may engage additional providers — for example Gumlet (video delivery) or DigitalOcean / OVH (additional hosting, Australian-region data centres) — and this policy will be updated before any of them handles personal information.
We use third-party AI language-model services (e.g. Alibaba Cloud, Moonshot) in content production — to author and quality-assure workbook content before it is published (the models run in those providers' clouds, not on our hardware); purchaser and student personal information is never submitted to them. Analysis of learning results for personalisation currently runs on our own infrastructure over pseudonymous records; we may in future use Australian-hosted cloud AI services that satisfy education-department requirements for this analysis. Where AI services assist in analysing the service for improvement, the inputs are aggregated or de-identified first. We do not disclose personal information for marketing, and disclose it otherwise only where compelled by law.
Some providers (Cloudflare, Stripe, Emailit, Reoon) operate globally and may process data outside Australia. Australian Privacy Principle 8 — the cross-border disclosure principle in the Privacy Act mentioned in clause 1 — requires us to take reasonable steps so that overseas recipients handle your information consistently with those principles. We do that by using established providers bound by their published privacy policies, limiting what they receive to the minimum needed, and confining their processing to the functions described above.
We use strictly necessary cookies (session and authentication) and, where enabled, first-party analytics cookies. There are no advertising cookies (we run no third-party advertising — clause 1) and no third-party tracking cookies.
Account and learning data are kept while the account is active and deleted on request. Transactional records are retained as company law and tax law require (generally up to seven years for financial records). Email logs follow the 365-day limit above. Aggregated analytics are short-lived and non-identifying.
HTTPS end-to-end, hardened and access-controlled servers, hashed credentials, pseudonymisation of student records by design, and publish-time integrity checks on every public document. If an eligible data breach occurs we will assess and notify under the Notifiable Data Breaches scheme.
Write to admin@vwx.au to access or correct your information, delete an account, unsubscribe from communications, or complain. The same channel — and the one-click signed links carried in your service emails — serves all of these: one mechanism, by design. We will respond within a reasonable time; if unresolved, you may contact the Office of the Australian Information Commissioner.
This policy may be updated as the service grows (for example when new processors are added); the revision date above will change and material updates will be announced where users will reasonably see them.