Privacy Policy

Edvana (ABN 42 606 861 566), a partnership operating at edvana.ai ("Edvana", "we", "us", "our") respects your privacy and is committed to handling your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles ("APPs"), and other applicable privacy laws including the EU and UK General Data Protection Regulation ("GDPR"/"UK GDPR") where they apply to you.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it.

Effective date: 2 May 2026 Last updated: 2 May 2026

---

1. About Edvana

Edvana operates an AI-powered study platform for students of the International Baccalaureate Diploma Programme ("IB DP"). Our service includes practice paper generation, essay planning and marking, internal assessment oral practice, and other subject-specific study tools.

We are based in New South Wales, Australia. Our service is offered globally; if you access Edvana from outside Australia, your information will be transferred to and processed in Australia and other locations described in this Policy.

2. The personal information we collect

We collect the following categories of personal information:

(a) Account information. Your name, email address, password (handled and stored as a hash by our authentication provider, Clerk — we never see or store your password in plain text), school or institution name (optional), year of study, IB subject selections, and approximate age range.

(b) Profile and study information. Your subject choices, target grades, study history, generated practice papers and your responses, essay drafts you submit, and other content you create or upload while using Edvana ("Submitted Content").

(c) Payment information. If you subscribe to a paid plan, we collect billing details necessary to process payment. Card numbers are processed by our payment processor (Stripe) and are not stored on Edvana's systems. We retain only transaction metadata such as plan tier, amount, currency, and timestamp.

(d) Technical and usage information. IP address, device type, browser type, operating system, referrer URL, pages visited, features used, timestamps, error logs, and similar diagnostic data, collected automatically when you use the service.

(e) Communications. Records of correspondence when you contact us by email, in-app chat, or other channels.

(f) Information from schools (where applicable). If your school or teacher has licensed Edvana on your behalf, we may receive your name, school email address, year level, and class assignment from them.

(g) Information from third-party sign-in services. If you sign in using Google, we receive your name, email address, and profile picture, in accordance with the permissions you grant.

We do not knowingly collect sensitive information (as defined under the Privacy Act) such as health information, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. Please do not include such information in essays, prompts, or other content you submit to Edvana.

3. How we collect personal information

We collect personal information:

• Directly from you when you sign up, configure your profile, subscribe to a paid plan, or use the service;
• Automatically through cookies, local storage, and server logs when you interact with the service;
• From your school or teacher, where they have licensed Edvana for your use;
• From third parties such as Clerk (our authentication provider), Google sign-in, and Stripe (our payment processor); and
• From you when you contact us with feedback, questions, or support requests.

4. Why we collect, hold, use and disclose personal information

We use your personal information for the following purposes:

(a) To provide the service. To create and manage your account, generate practice papers, mark essays and other submissions, generate diagrams and study materials, save your study history, and otherwise deliver the features you request.

(b) To process AI-generated content. Submitted Content (essays, paper responses, prompts, etc.) is sent to large language model providers operated through Amazon Web Services ("AWS") to produce study outputs. See Section 6 for detail on how these providers handle your data.

(c) To process payments and manage subscriptions. To take payment, issue invoices, manage renewals and cancellations, and prevent fraud.

(d) To improve the service. To analyse aggregated and de-identified usage patterns, fix bugs, evaluate feature performance, and develop new features. We do not use your Submitted Content or identifiable personal information to train AI models — see Section 7.

(e) To communicate with you. To send service-related notices (such as billing receipts, security alerts, and changes to these terms) and, where you have opted in, to send product updates and educational content. You can unsubscribe from marketing communications at any time.

(f) To protect Edvana and others. To detect, investigate, and prevent fraud, abuse, security incidents, or violations of our Terms of Service, and to comply with legal obligations.

(g) For legal and regulatory purposes. To comply with applicable laws, respond to lawful requests from authorities, enforce our agreements, and establish, exercise, or defend legal claims.

5. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and detect abuse. We use the following categories:

• Strictly necessary cookies — required for sign-in, security, and core functionality; cannot be disabled without breaking the service.
• Functional cookies — remember your preferences (e.g., subject view).

We do not use analytics cookies, advertising cookies, or third-party tracking. You can manage cookies through your browser settings; disabling strictly necessary cookies will prevent the service from functioning.

6. Who we share your personal information with

We share personal information only with the parties listed below, and only to the extent necessary for the purposes described.

Recipient	Purpose	Location
Amazon Web Services, Inc. ("AWS")	Hosting, storage, and AI inference (Amazon Bedrock)	Australia (ap-southeast-2), United States (where required for specific Bedrock models)
Anthropic	Provider of Claude language models accessed via AWS Bedrock	United States
Clerk, Inc.	User authentication, account creation, password management, multi-factor authentication, and authentication-related emails (sign-up, email verification, password reset, magic links)	United States
Stripe Payments Australia Pty Ltd	Payment processing and billing-related emails (receipts, invoices, payment failure notices)	Australia, United States
Google LLC	Sign-in via Google account, if you choose to use it; receipt and storage of email correspondence sent to Edvana addresses	United States
Cloudflare, Inc.	DNS, content delivery, web application firewall, and inbound email routing for Edvana addresses	United States, global edge network
Professional advisers (lawyers, accountants, auditors)	Legal and accounting services	Australia

We may also disclose personal information:

• to a buyer or successor entity in the event of a merger, acquisition, or sale of all or part of Edvana's business (we will notify you of any such change);
• where required by law, court order, or to a regulator with lawful authority; and
• where you have given us consent.

We do not sell your personal information.

7. AI processing and training

Edvana uses third-party large language models, accessed via AWS Bedrock, to produce study outputs.

Your Submitted Content is not used to train AI models. AWS has stated that customer prompts and outputs in Bedrock are not stored, are not shared with model providers, and are not used to train any foundation models.

We do not separately use your Submitted Content to train, fine-tune, or evaluate any models — proprietary, open-source, or otherwise.

AI outputs may be inaccurate. Marks, feedback, model answers, and explanations generated by Edvana are generated by AI and are not guaranteed to be correct, complete, or aligned with official IB assessment criteria. AI-generated marks are not official IB marks. You should always verify outputs against official IB resources and seek your teacher's guidance.

Automated decision-making. We use AI to assess and score essays and paper responses. These scores influence the feedback you receive. They are not used to make legal or significantly affecting decisions about you. From 10 December 2026, additional Australian transparency obligations apply to automated decision-making; we will update this Policy to comply with those obligations and provide further information about how our AI features work.

8. Cross-border transfers

By using Edvana, you acknowledge that your personal information will be transferred to, stored in, and processed in Australia, the United States, and other countries where our service providers operate.

When we send personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. Specifically:

• AWS is contractually bound by AWS's Data Processing Addendum, which incorporates relevant safeguards including the EU Standard Contractual Clauses and UK International Data Transfer Addendum where applicable;
• Stripe is bound by Stripe's Data Processing Agreement and equivalent safeguards; and
• Where applicable, we rely on the EU Standard Contractual Clauses or other approved transfer mechanisms for transfers from the EU/UK.

9. How we keep your information secure

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure, including:

• Encryption in transit (TLS 1.2 or higher) and at rest;
• Password hashing using industry-standard algorithms;
• Role-based access controls and the principle of least privilege;
• Audit logging of administrative actions;
• Regular security reviews and dependency updates; and
• Use of hosting and processing providers that hold relevant security certifications (AWS holds SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, and others).

No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") in accordance with the Notifiable Data Breaches scheme.

10. How long we keep your information

We retain personal information only for as long as we need it to provide the service or as required by law:

• Account and profile data — for the life of your account, plus up to 12 months after account deletion to allow recovery and to comply with legal and accounting obligations;
• Submitted Content (essays, papers, study history) — for the life of your account; you can delete individual items at any time through the service, and deleted items are removed from our active systems within 30 days and from backups within 90 days;
• Payment and transaction records — for at least 7 years, as required by Australian tax law;
• Server logs and security records — typically 90 days, unless retained longer for security investigations; and
• Marketing communications data — until you unsubscribe.

When information is no longer needed, we delete or de-identify it.

11. Your rights

You have the following rights with respect to your personal information:

• Access — request a copy of the personal information we hold about you;
• Correction — ask us to correct information that is inaccurate, out of date, incomplete, or misleading;
• Deletion — request deletion of your account and associated data (subject to legal retention obligations);
• Export — request a machine-readable export of your account data;
• Withdraw consent — withdraw any consent you have given us (this may affect our ability to provide the service);
• Object — object to certain processing, where the law gives you that right;
• Complain — make a privacy complaint (see Section 13).

If GDPR or UK GDPR applies to your information, you also have the rights to data portability, restriction of processing, and to lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office or your EU Member State's data protection authority).

To exercise any of these rights, contact us at privacy@edvana.ai. We will respond within 30 days. We may need to verify your identity before acting on your request.

12. Children and minors

Edvana is designed for IB DP students, who are typically aged 16 to 19. We do not knowingly collect personal information from children under 13.

If you are between 13 and 18 (or the age of majority in your jurisdiction):

• We encourage you to review this Policy with a parent or guardian;
• Where required by law, we will seek parental consent before collecting your personal information;
• If your school has licensed Edvana on your behalf, your school is responsible for obtaining any parental consents required under local law and education sector privacy regulations.

If you are a parent or guardian and believe your child has provided personal information to us without your consent, please contact privacy@edvana.ai and we will take reasonable steps to delete that information.

The Australian Children's Online Privacy Code, expected to be registered by 10 December 2026, will introduce additional protections for online services likely to be accessed by children. We will update this Policy and our practices to comply with the Code when it takes effect.

13. How to contact us, and how to complain

If you have questions about this Policy, want to exercise a right, or want to make a privacy complaint:

Email: privacy@edvana.ai

We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, 1300 363 992;
• UK Information Commissioner's Office (ICO), if UK GDPR applies — www.ico.org.uk; or
• Your local data protection authority, if GDPR applies in your jurisdiction.

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email and/or by a prominent notice in the service before the changes take effect. The "Last updated" date at the top of this Policy indicates when it was last revised.

---

Edvana is a partnership registered in Australia under ABN 42 606 861 566.