Our Privacy Policy

Plume is operated by Plume HSC Specialist Tuition Pty Ltd (ACN 700 645 807). This policy covers our public website, free-trial enquiries, student portal and parent portal.

For privacy questions, access or correction requests, deletion requests, marketing opt-outs or complaints, contact support@plumehsc.com.au.

Depending on how you use Plume, we may collect:

• trial-enquiry details such as parent or guardian name, email, phone, requested subject, student year, selected trial time, optional message, marketing choice and submission or consent timestamps;
• account details such as name, email, optional phone, role, authentication status and onboarding status;
• student details including year, school, enrolments, assigned classes and assigned tutors;
• learning records including schedules, attendance, quiz results, progress measures, homework, uploaded files or Google Docs links, tutor feedback and messages;
• parent information including linked children, communication preferences, chats, invoices and billing status;
• optional Google information including the connected Google account email, OAuth tokens, calendar identifiers, event-link mappings and sync status;
• technical information processed by Cloudflare, Supabase and Google as needed to deliver, secure and troubleshoot their services; and
• evidence of marketing consent if the optional email checkbox is selected.

Plume does not intentionally collect health information, disability information, allergy information or other sensitive information. Please do not put sensitive information in a free-text field unless Plume has specifically requested it through an appropriate process.

We collect information directly from families and students, from authorised Plume administrators or assigned tutors, through portal use, and through optional Google integrations.

We use it to respond to and arrange a free trial; create and administer accounts and enrolments; deliver tuition; monitor progress; mark work; communicate with families; manage schedules, optional calendar syncing, invoices and service notifications; secure and troubleshoot our systems; and meet record-keeping or other legal obligations.

We send email news or offers only where the separate optional marketing choice has been selected. Plume does not sell or rent personal information.

Accounts are created by Plume administrators. There is no public student or parent self-registration. Student and parent users are asked to acknowledge this policy during first onboarding; that acknowledgement confirms the notice was shown and is not blanket consent to every future use.

A correctly linked parent account can see the student information deliberately made available in the parent portal. We consider a young person's age, maturity and capacity when handling access, correction, deletion or consent questions, and may involve a parent or guardian where appropriate.

• authorised Plume administrators can access information needed to operate the service;
• assigned contractor tutors can access only the students and classes they teach;
• a correctly linked parent can access the information made available about their child;
• Supabase provides authentication, database, Edge Functions and file storage. Plume's Supabase application data is hosted in Sydney, Australia;
• Cloudflare provides global website delivery, Pages Function execution, security and request metadata or log handling; and
• Google supports sign-in, optional Calendar sync, Docs links or previews, and the public Maps embed.

Cloudflare operates a global network, so request processing or log metadata may occur outside Australia. Google may also process information outside Australia under its own privacy terms. We do not promise a fixed country list that those providers cannot guarantee.

We do not currently disclose student or family information to an accountant, school, payment processor, marketing platform or other external recipient. We will review and update this policy before a new provider begins processing personal information.

Plume does not use analytics, advertising pixels or session recording. The portal uses necessary authentication and browser storage to keep users signed in and operate the service. Google sign-in, optional Calendar sync, Docs links or previews, and Maps are separate Google integrations. The public Google Maps embed may set or read Google cookies under Google's terms.

Email marketing is optional and requires the separate unticked checkbox on the free-trial form. A booking is available on the same terms when the checkbox remains unticked. No SMS marketing is authorised by that checkbox.

Future commercial emails must identify Plume and include a functional unsubscribe method. Until Plume selects a marketing-email provider, you can unsubscribe or withdraw consent by emailing support@plumehsc.com.au. We retain only the minimal suppression and consent record needed to honour and evidence an opt-out.

We use encrypted transport, access controls, role-based permissions, private storage, service credentials kept outside browser code, and reasonable monitoring and backup practices. No online system can be guaranteed completely secure.

Our current retention schedule is:

• trial enquiries: 12 months;
• student and parent account and academic records: while tuition is active and generally two years after tuition ends;
• homework and tutor feedback: generally two years after tuition ends;
• Google tokens: until Calendar is disconnected or the account closes;
• financial records: seven years, or longer if legally required; and
• marketing records: while subscribed, followed by the minimal suppression or consent record needed to honour and evidence the opt-out.

When information is no longer required, we delete it or genuinely de-identify it, subject to legal duties and technical backup cycles. Trial-enquiry expiry is automated. Former-student and file retention is reviewed operationally because the portal does not yet hold one reliable tuition-end date for every record.

Email support@plumehsc.com.au to ask for access to personal information, correction of inaccurate information, or deletion where available. We may need to verify identity and authority before disclosing or changing a record. Legal retention duties and the rights of other people may limit what can be deleted.

Send a privacy complaint to support@plumehsc.com.au. We will acknowledge it within five business days, investigate it, and aim to provide an outcome within 30 calendar days.

If an eligible complaint remains unresolved, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

We will notify affected people and regulators of a data breach where legally required. We may update this policy when our practices, providers or legal obligations change; the effective date at the top shows the current version.