Privacy Policy

CampusBridge collects information necessary to provide school management services. The types of information we collect include:

• Account Information: Name, email address, phone number, and role within the school community.
• Student Records: Academic records, attendance data, enrolment information, and emergency contacts as entered by the school.
• Sensitive Information: Medical information, wellbeing data, counsellor notes, and NDIS plans — collected only with explicit consent and stored with enhanced encryption.
• Usage Data: Log data, device information, and analytics to improve the service.
• Payment Information: Processed securely via Stripe. We do not store credit card numbers.

We use collected information to:

• Provide and maintain the CampusBridge school management platform
• Facilitate communication between schools and families
• Generate AI-assisted content (with pseudonymisation and human review)
• Process fee payments and generate financial reports
• Analyse attendance and wellbeing patterns to support student outcomes
• Send notifications and emergency broadcasts
• Improve and develop new features

We never sell personal information. We never use student data for advertising. AI features are subject to our Responsible AI Policy.

All data is stored in Australia (AWS ap-southeast-2, Sydney region). We employ multiple layers of security:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption at rest for sensitive fields
• Self-hosted authentication (Better Auth) within the VPC
• Row-level security at the database layer for tenant isolation
• 26-role RBAC with school-scoped authorisation on every API call
• Regular security audits and penetration testing

For full details, see our Security page.

Under the Australian Privacy Act 1988 and applicable state legislation, you have the right to:

• Access the personal information we hold about you or your children
• Request correction of inaccurate or incomplete information
• Request deletion of personal data (subject to legal retention requirements)
• Withdraw consent for optional data processing
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

Schools retain ownership of all data entered into the platform. Upon contract termination, schools receive a full data export within 30 days.

For privacy-related enquiries or to exercise your rights:

We aim to respond to all privacy enquiries within 5 business days.