Privacy Policy

What Edapt collects, where it goes, how long we keep it, and what you can ask us to do.

Last updated: 14 October 2026. These documents sit with a lawyer for review, and we will update this page when that review finishes.

On this page: Who this covers, What we collect, Why we collect it, Where your information goes, How long we keep it, Welfare, Your rights, Security, Changes, Contact.

1. Who this covers

Edapt is a study companion for Years 7 to 13. It follows the New Zealand Curriculum for Years 7 to 10, and its own study programme for Years 11 to 13. It asks students questions about their own work. The student writes the work.

Edapt sells family accounts. A parent or guardian holds the account and adds each child to it. Edapt sells no school account in this version. No school holds a record here.

Students, this is about you. Your name, what you type to Edapt, and what Edapt notices about your learning all count as your information. You can ask to see it. You can ask us to correct it.

If a parent set up the account, ask them first. You can also write to us at the address in section 10.

2. What we collect

About the student. The display name the account holder gives, and the student's year level.

The student's own account. A student can hold an account of their own. Where they do, Edapt stores the email address they give and their password as a hash. Edapt never stores the password itself. A student who uses Edapt without an account of their own gives neither.

The whole study conversation. Edapt stores every message a student types and every reply the tutor writes. A tutoring conversation is the service, so we hold the conversation.

Drafts. A student can paste a draft for feedback. Edapt stores that draft and the task description the student enters.

What Edapt works out while teaching. Edapt stores the curriculum topics in focus, the misconceptions that appear, and the hints used. It also stores response times and a mastery level for each curriculum statement.

Welfare records. A student may write something suggesting distress, self-harm, or that someone is hurting them. Edapt then records a category and a confidence level. The record holds no quotation and no free text. Section 6 explains this in full, because it is the most serious thing on this page.

About the account holder. An email address, and a password stored only as a hash. Edapt never stores the password itself. We also store the tenant and role the account holds.

Sign-in records. Sign-ins, failed sign-ins, lockouts, password changes, transcript exports, and student erasures. Each record holds numeric identifiers, a timestamp, and the calling address. None holds student text.

Billing records. Stripe holds your card details. Edapt stores a Stripe customer reference, a subscription reference, and the plan. It also stores the billing period, the seat count, and the payment status.

Server records. Technical request records: the route called, the result, and the calling address. Server logs hold no student text and no secrets.

3. Why we collect it

We run the tutoring service from the conversation, the study focus, and the year level. We adapt the teaching from the misconceptions, the hint history, and the mastery levels.

We keep a student safe through the welfare record and the alert to the adult on the account. We show a parent progress from the learning signals, and a transcript on request.

We take payment through the Stripe references and the plan. We keep accounts secure through the sign-in and security records.

We sell no personal information. We use no student conversation to advertise anything. Edapt trains no model of its own on your information.

4. Where your information goes, and out of New Zealand

Read this section even if you skip the rest. Edapt cannot run without sending information outside New Zealand. Here is where it goes.

Anthropic, in the United States. Anthropic's Claude models write the tutor's replies, so Anthropic receives the study conversation as it happens. Anthropic's commercial terms state that Anthropic may not train models on customer content. We have not confirmed how long Anthropic keeps a conversation. Treat it as held by Anthropic. Edapt has not turned on Anthropic's zero data retention option.

Fly.io, in Sydney, Australia. Fly.io runs the service and holds the working database file on a volume in Sydney.

Tigris, region unconfirmed. Tigris, a storage service inside Fly.io, keeps a continuous copy of the database. That copy lets us recover from a failure. Tigris places a bucket in no fixed region by default. We have not pinned this copy to a single region. Treat the backup as held outside New Zealand. Pinning it to Sydney is on our list.

Amazon Web Services, in its Auckland, New Zealand region. Amazon SES sends four emails: the welfare alert, an email verification link, a password reset link, and a renewal reminder. The reminder goes seven days before a subscription renews. Each email carries a recipient address, and the welfare alert also carries a student's first name.

Stripe. You enter your card on a page Stripe hosts, and Edapt never receives the card number. Edapt sends Stripe an account reference, the plan, the billing period, and the seat count. Edapt sends Stripe nothing about a student. Stripe publishes a New Zealand privacy policy and a New Zealand services agreement. We have not confirmed which country holds your payment records.

New Zealand keeps no list of approved countries. Some countries maintain one. New Zealand does not, and no country carries a finding of comparable safeguards. Under New Zealand law no country holds that status, including Australia and the United States.

What we do instead. Fly.io, Tigris, and Amazon hold and process the information for us alone. The law therefore treats it as still held by us. Anthropic and Stripe are the harder cases, and a lawyer is settling how to treat each.

One thing we must be straight about. We have not yet completed a written agreement with every supplier on the Privacy Commissioner's model clauses. Until we do, your information travels under each supplier's own standard terms. We are working on those agreements now.

If you would rather your information stayed in New Zealand, Edapt cannot offer that. We would rather say so than bury it.

5. How long we keep it

Study sessions and conversations: 12 months. A daily sweep deletes a study session once it passes the retention period on the account. The period runs from the date the session started, and the default sets it at 365 days. An account holder can ask us to shorten it.

Welfare records: with their session. A welfare record dies when its study session dies, on the same 12-month clock. No separate welfare clock exists.

Drafts, guardrail records, and retrieval records: with their session. They share the same clock.

Learning signals: until erasure. Mastery levels, review due dates, and study focus rows survive the session sweep. The student's display name and year level survive it too. They stay until someone asks us to erase the student. This clock differs from the conversation clock, so read this paragraph twice.

Security records: 90 days. We purge sign-in and security records after 90 days.

Account and billing records: while the account exists. We delete an account's records when the account holder asks us to close it. We close an account by hand on request, and we confirm by email when it is done. We keep only what the law requires.

Deletion records: kept. When we delete something we keep a record that a deletion happened: what kind, how many rows, and when. That record holds no name and no content, and it carries no deletion clock of its own.

The backup copy. We keep a continuous backup of the database so we can recover from a failure. The backup holds a copy of a deleted record for up to 30 days. After that the copy ages out of every backup. A deletion with a 30-day echo belongs in a privacy policy.

6. Welfare, and when we tell an adult

This part of Edapt matters most, and people deserve to understand it before they sign up.

Edapt watches for signs of distress, of a student about to hurt themselves, or of someone hurting them. Edapt records every sign it sees. What happens next depends on which of those it sees.

First, Edapt responds with care in the conversation. It gives the 1737 line and Youthline, free to call or text at any hour. A student can reach them without an adult.

Second, where a student may be about to hurt themselves, we email the adult on the account. That is the only sign that sends an email. Only a high-confidence sign sends it. No other sign emails anyone on the account. The account holder can switch that email off from the family dashboard.

What the email says. It names the student's first name and says in plain words what concerned us. It repeats the sentence the student wrote, so the adult can judge how urgent it is. It asks the adult to check in that day. It names 1737 and Youthline, and it gives an address to reply to. The welfare record holds no copy of the student's words. The sentence passes straight from the conversation into the email, and the record keeps the category and the time.

Where a student says somebody is hurting them, we tell nobody on the account. We tell the student instead, and give them services they can reach on their own. Call 111 in danger. Oranga Tamariki answers 0508 326 459 at any hour. Youthline is 0800 376 633, or text 234. The 1737 line is free at any hour. We do that because the adult on the account is sometimes the person the student means. An email would tell that person the student had spoken. Edapt keeps the record, and the family dashboard shows no trace of it.

A sign of distress alone is recorded and answered in the conversation, and sends no email. We draw the line there on purpose. A student can then say they are struggling without an email going home that day. A student who expects an email stops saying it.

The alert reaches a confirmed address only. An account whose email address is still unconfirmed receives no alert. The service keeps retrying, and the alert goes out once the address is confirmed. Confirm your address at signup, or a welfare alert will wait. We send at most one email a day for each student. An email that waited for a confirmed address, or was retried, repeats nothing the student said. It points you to the family dashboard instead.

We do this without asking the student first. When a child is at risk, we will not wait for permission to tell someone who can help. The law allows a disclosure needed to prevent or lessen a serious threat to life or health.

Students, we are telling you now so it is not a surprise later. If you tell Edapt something serious, an adult may find out. That is not a punishment, and it is not because you did something wrong. Some things are too big to carry alone.

Who else we tell. Edapt sends the alert to the adult on the account and to nobody else. Edapt files no automatic report with Oranga Tamariki or with the Police. The law permits us to tell someone who can help where a child faces a serious threat. We would use that permission.

What Edapt is not. Edapt is not an emergency service, and it does not watch an account in real time. In an emergency call 111.

One limit. Edapt cannot tell whether the adult it emails is the person a child's disclosure describes. That is why a disclosure that somebody is hurting the student sends no email. The reply to the student names services a child can reach alone.

7. Your rights

You may ask what we hold about you and get a copy. You may ask us to correct anything wrong. Where we disagree, you may have your correction noted alongside the record.

You may ask us to erase a student's learning record. A parent erases a student from the family dashboard, with their password, and it happens at once. We act on an emailed erasure request within 10 working days. The backup keeps a copy for up to 30 days after that, as section 5 explains.

You may complain to us, and then to the Office of the Privacy Commissioner. The Commissioner can investigate us on their own authority.

How to ask. Write to edapt.support.privacy@gmail.com. We answer within 20 working days. Access and correction run through that address today rather than through a button in the app.

A parent can also export a transcript. Sign in, confirm your password again, and export a study session from the app. We record each export in the security log.

Who may ask. A parent or guardian may ask about a child in their care. A student may ask about themselves. We weigh a student's request by their understanding rather than by a fixed age. The Privacy Act sets no age for this.

When we withhold from a parent. The Privacy Act lets us refuse a parent where release would work against a child under 16. A welfare record about a parent is the plain example. We would use that power to protect a child.

8. Security

We hash passwords with PBKDF2-HMAC-SHA256 at 600,000 iterations, and we never store them as text.

Repeated failed sign-ins lock an account for 15 minutes. A sustained run of failures extends that to 12 hours.

The service answers over HTTPS only, and refuses a request from any origin other than its own.

Every route that touches student data checks the caller's membership first, so one family's account cannot read another's.

A transcript export and a student erasure each need a fresh password confirmation on top of the signed-in session.

Server logs hold no student text and no secrets. The security log records only identifiers, timestamps, and a fixed list of event types.

No service can promise it will never suffer a breach. Where a breach could cause serious harm, we will tell the affected people and the Privacy Commissioner.

9. Changes

We will post a change here and update the date at the top. Where a change matters to you, we will tell you rather than rely on you noticing.

10. Contact

Write to edapt.support.privacy@gmail.com.

The Office of the Privacy Commissioner takes complaints at privacy.org.nz and on 0800 803 909.

The Terms of Use sit alongside this policy.