Our Privacy Policy

Plume is operated by Plume HSC Specialist Tuition Pty Ltd (ACN 700 645 807). This policy covers our public website, free-trial enquiries, student portal and parent portal.

For privacy questions, access or correction requests, deletion requests, marketing opt-outs or complaints, contact support@plumehsc.com.au.

Depending on how you use Plume, we may collect:

• booking and enquiry details such as parent or guardian name, email and phone; student name, school and year; optional student email and phone; requested subjects, classes, tutors or workshops; an optional message; and marketing choices and submission or consent timestamps;
• account details such as name, email, optional phone, role, authentication status and onboarding status;
• student details including year, school, enrolments, assigned classes and assigned tutors;
• learning records including schedules, attendance, quiz results, progress measures, homework, uploaded files, homework Google Docs and submitted copies of them, tutor feedback and messages;
• parent information including linked children, communication preferences, chats, invoices and billing status;
• optional Google information including the connected Google account email, OAuth tokens, calendar identifiers, event-link mappings and sync status;
• technical information processed by Cloudflare, Supabase and Google as needed to deliver, secure and troubleshoot their services;
• website usage information collected through Google Analytics, such as pages and referring URLs, interactions, visit times, browser and device details, approximate location and cookie identifiers; and
• evidence of marketing consent if the optional email checkbox is selected.

Plume does not intentionally collect health information, disability information, allergy information or other sensitive information. Please do not put sensitive information in a free-text field unless Plume has specifically requested it through an appropriate process.

We collect information directly from families and students, from authorised Plume administrators or assigned tutors, through portal use, through optional Google integrations, and automatically through our public website's analytics and service infrastructure.

We use it to respond to and arrange free workshops and two-week free trial requests; create and administer accounts and enrolments; deliver tuition; monitor progress; mark work; communicate with families; manage schedules, optional calendar syncing, invoices and service notifications; secure and troubleshoot our systems; and meet record-keeping or other legal obligations.

We send email news or offers only where the separate optional marketing choice has been selected. Plume does not sell or rent personal information.

We use website analytics to understand how people find and use our public pages, assess which content is useful, and improve the website.

Plume enrols each student and issues separate, expiring setup links for the student and a parent. The person who opens a link chooses their own email-and-password or Google sign-in and must verify their email address. Creating a sign-in without a valid setup link does not give access to any student information. Student and parent users are asked to acknowledge this policy during first onboarding; that acknowledgement confirms the notice was shown and is not blanket consent to every future use.

A correctly linked parent account can see the student information deliberately made available in the parent portal. We consider a young person's age, maturity and capacity when handling access, correction, deletion or consent questions, and may involve a parent or guardian where appropriate.

• authorised Plume administrators can access information needed to operate the service;
• assigned contractor tutors can access only the students and classes they teach;
• a correctly linked parent can access the information made available about their child;
• Supabase provides authentication, database, Edge Functions and file storage. Plume's Supabase application data is hosted in Sydney, Australia;
• Cloudflare provides global website delivery, Pages Function execution, security and request metadata or log handling;
• Purelymail provides email delivery and mailbox services, including booking notifications containing the details submitted to Plume; and
• Google provides public website analytics, sign-in, optional Calendar sync, homework documents in Google Docs, and the public Maps embed.

For homework, Plume creates a Google Doc for each student's task in a Plume-owned Google account and shares it with the student's verified email address so they can edit it. Tutors open these documents through Plume's account. When work is submitted, Plume keeps a PDF copy so the submitted version is preserved.

Cloudflare operates a global network, so request processing or log metadata may occur outside Australia. Google and our email provider may also process information outside Australia under their service and privacy terms. Our providers' processing locations can change.

We share information with these providers as needed for the purposes described in this policy. We will review and update this policy before introducing a provider or use that materially changes how we handle personal information.

Google Analytics loads when you visit our public website, without waiting for a cookie-consent choice. It uses first-party cookies, including _ga and _ga_*, to distinguish browsers and sessions. Their default expiry is two years and may refresh on later visits, subject to shorter browser limits. These identifiers are not the same as your Plume account.

Your browser sends Google website usage and technical information, including the page URL, referring URL, browser and device information and IP address. Google uses IP addresses for purposes including approximate location and service operation. See how Google uses information from sites that use its services and Google's Privacy Policy.

Our website tag disables Google Signals and ad personalisation. We do not install this tag in the student, parent or tutor portal, and do not deliberately send booking-form contents, contact details, homework or other portal records to Google Analytics. Plume does not use session recording.

You can block or delete cookies through your browser settings. Blocking cookies alone may not prevent analytics requests. To prevent Google Analytics from using your visits in supported browsers, you can install the Google Analytics opt-out browser add-on. Blocking analytics does not prevent you from browsing our site or making a booking. The optional email-marketing checkbox is separate from website analytics.

The portal uses necessary authentication and browser storage to keep users signed in and operate the service. Google sign-in, optional Calendar sync, homework Google Docs, and Maps are separate Google integrations. The public Google Maps embed may set or read Google cookies under Google's terms.

Email marketing is optional and requires the separate unticked checkbox on the booking form. A booking is available on the same terms when the checkbox remains unticked. No SMS marketing is authorised by that checkbox.

Future commercial emails must identify Plume and include a functional unsubscribe method. Until Plume selects a marketing-email provider, you can unsubscribe or withdraw consent by emailing support@plumehsc.com.au. We retain only the minimal suppression and consent record needed to honour and evidence an opt-out.

We use encrypted transport, access controls, role-based permissions, private storage, service credentials kept outside browser code, and reasonable monitoring and backup practices. No online system can be guaranteed completely secure.

Our current retention schedule is:

• trial enquiries: 12 months;
• student and parent account and academic records: while tuition is active and generally two years after tuition ends;
• homework and tutor feedback: generally two years after tuition ends;
• Google tokens: until Calendar is disconnected or the account closes;
• financial records: seven years, or longer if legally required; and
• marketing records: while subscribed, followed by the minimal suppression or consent record needed to honour and evidence the opt-out.

Google Analytics user and event data is retained according to our Analytics property's retention settings and Google's terms. Cookie expiry is separate from this retention period, and aggregated reports may remain available for longer. Contact support@plumehsc.com.au for information about our current analytics retention settings or a privacy request.

When information is no longer required, we delete it or genuinely de-identify it, subject to legal duties and technical backup cycles. Trial-enquiry expiry is automated. Former-student and file retention is reviewed operationally because the portal does not yet hold one reliable tuition-end date for every record.

Email support@plumehsc.com.au to ask for access to personal information, correction of inaccurate information, or deletion where available. We may need to verify identity and authority before disclosing or changing a record. Legal retention duties and the rights of other people may limit what can be deleted.

Send a privacy complaint to support@plumehsc.com.au. We will acknowledge it within five business days, investigate it, and aim to provide an outcome within 30 calendar days.

If an eligible complaint remains unresolved, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

We will notify affected people and regulators of a data breach where legally required. We may update this policy when our practices, providers or legal obligations change; the effective date at the top shows the current version.