Privacy Policy

Last updated: June 2026

1. Introduction

Docent is a voice-first AI homeschooling platform operated by Innovenses Pty Ltd, a company registered in Victoria, Australia. We provide curriculum-aligned AI tutoring for students in Grades 1–12 across Australia, the United Kingdom, the United States, India, South Africa, and New Zealand, generating jurisdiction-specific home-education compliance documents from each student's verified learning data.

This Privacy Policy explains what personal information we collect about parents, guardians, and students, why we collect it, how we use it, and the rights you have under the applicable laws in your country. It applies to the Docent website, mobile applications, voice-tutor service, and all related products operated by Innovenses Pty Ltd.

By creating an account or allowing your child to use the Docent service, you agree to the practices described in this policy. If you do not agree, please do not use the service. Material changes are communicated by email at least 30 days before they take effect, as described in Section 9.

Questions about this policy or your data rights may be directed to our Data Protection Officer at dpo@docent.academy.

2. Information We Collect

We collect the minimum personal information necessary to deliver the service. Account information includes the parent or guardian's name, email address, country and region, and payment details (held by Stripe — we store only the card's last four digits and brand). Student information includes first name, date of birth, year level, and any neurodiversity or learning-preference flags that a parent voluntarily provides to personalise the tutor's approach.

Student learning data comprises per-curriculum-code mastery scores (scored 0–1), lesson transcripts, assessment results, and the mastery history used to generate compliance documents. This data is the core product output — it is what drives personalised lesson sequencing, BKT-based skill modelling, and the compliance document generation pipeline.

Voice audio submitted during tutor sessions is processed in-flight through our speech-to-text pipeline and is not stored beyond the duration of the live session. We do not build voice profiles for children, and we do not use voice recordings to train any AI model. The resulting transcript is retained as part of the learning record for the duration described in Section 5.

Usage analytics are collected on parent and teacher accounts only. Analytics are anonymised before being sent to PostHog (EU region) and are opt-in for accounts subject to DPDP or GDPR. We do not collect behavioural analytics on student accounts or run targeted advertising against any account on our platform.

3. How We Use Your Information

We use account information to create and maintain your subscription, authenticate your identity, process payments, send transactional emails (welcome, daily learning digest, compliance-document ready notifications), and comply with statutory tax and record-keeping obligations.

We use student learning data to provide personalised AI tutoring, sequence lessons according to each student's current mastery state, and surface parent-facing progress reports. The same mastery data powers our compliance document generation: VRQA (Victoria), NESA (NSW), HEU (UK), IHIP (US-NY), PA portfolio (US-PA), Section 51 (India), and NIOS documents are all derived directly from the student's verified learning record.

We use anonymised, aggregated learning signals to improve the quality and accuracy of our AI tutoring models and curriculum alignment. No individual student's data is shared with model providers for training purposes; our agreements with Anthropic and Groq include zero-data-retention and no-training clauses.

Safety monitoring runs in parallel with every tutor interaction. Our local regex prefilter and Claude-based safety moderator operate in real time to detect harmful content, self-harm signals, or safeguarding concerns. When a high-severity signal is detected, the tutor reply is halted and the parent is notified within five minutes, with the jurisdiction-specific helpline surfaced to the student.

4. Data Sharing

We do not sell personal information. We do not share personal information with third parties for advertising, marketing profiling, or any commercial purpose beyond providing the Docent service. We will never sell your child's data or use it to target advertising on any platform.

We share data only with sub-processors that are necessary to operate the platform, each operating under a Data Processing Agreement that prohibits use of data beyond the specified purpose. The complete list of sub-processors, the data they receive, the region in which they process it, and a link to their DPA or privacy policy is published at docent.academy/sub-processors and is updated at least 30 days before any material change.

We may disclose personal information if required by law, court order, or governmental authority, or if necessary to protect the safety of a child or other person. Where legally permitted, we will notify affected users before complying with such a request. In the event of a safeguarding disclosure required by law, the safety event log is retained for five years as chain-of-custody evidence.

5. Data Retention

Active account data — including parent account information, student profiles, mastery scores, lesson transcripts, and compliance documents — is retained for as long as your subscription is active. You may request a full data export at any time from the account settings page. Voice audio is processed in-flight and is not retained beyond the duration of the live session; no audio file is written to disk or stored in any database.

Student mastery history is retained for five years after account closure to support retrospective compliance document generation, assessor audits, and re-enrolment after a gap in homeschooling. Compliance documents themselves (PDFs generated for VRQA, NESA, IHIP, etc.) are retained for seven years to match the audit window of the relevant education authority. Payment records are retained for seven years to comply with statutory tax obligations.

When you close your account or submit a deletion request, all active learning data, student profiles, and parent account information are deleted within 30 days. Mastery history retained for the five-year post-closure period is stored in a restricted archive inaccessible to the tutor service, and is purged automatically at the end of the retention period. Safety event logs are retained for five years regardless of account closure, as required by safeguarding law in multiple jurisdictions.

6. Your Rights

Under the General Data Protection Regulation (GDPR) and UK GDPR, residents of the EU and UK have the right of access to personal data we hold about them, the right to rectification of inaccurate data, the right to erasure (the right to be forgotten), the right to restriction of processing, the right to data portability in a machine-readable format, and the right to object to processing. You may exercise these rights via the account settings page or by emailing dpo@docent.academy; we respond within 30 days as required by Article 12 GDPR.

Under the Children's Online Privacy Protection Act (COPPA), parents and guardians of children under 13 in the United States must provide verifiable parental consent before their child may use the service. Parents have the right to review their child's personal information, request that it be deleted, and refuse further collection or use of their child's information. Consent may be withdrawn at any time by contacting support@docent.academy.

Under India's Digital Personal Data Protection Act 2023 (DPDP), all processing of personal data requires consent-based lawful grounds. Data principals have the right to access, correct, and erase their personal data, and to withdraw consent at any time. For users under 18, verifiable parental or guardian consent is required before any data may be collected or processed. We support DigiLocker and Aadhaar-offline-KYC verification for Indian accounts, retaining only the last four digits of any Aadhaar number.

Under the Protection of Personal Information Act 2013 (POPIA), South African data subjects have the right to access, correct, and object to the processing of their personal information. All personal information collected from South African users is processed only for the specific purpose for which it was collected (purpose limitation). Data subjects may lodge complaints with the Information Regulator of South Africa. Under the Privacy Act 1988 (Australia) and the Australian Privacy Principles (APPs), Australian individuals have the right to access and correct personal information we hold about them and to make a complaint to the Office of the Australian Information Commissioner (OAIC) if they believe we have not complied with the APPs.

7. Children's Privacy

Docent is designed specifically for students under 18. Parents and guardians are the data controllers for their child's personal information; we act as data processor on their behalf. We collect only the minimum information necessary to deliver curriculum-aligned tutoring and to generate the compliance documents required by the home-education authority in your jurisdiction.

All AI interactions are filtered by our two-stage safety pipeline: a local regex prefilter running on every utterance and an optional Claude-based moderator for escalated content. The pipeline is designed to detect and respond to safeguarding concerns, self-harm signals, and inappropriate content in real time. We do not rely solely on post-hoc content moderation; safety runs in parallel with the tutor response so that harmful completions are suppressed before the student sees them.

We do not run behavioural advertising against any student account, do not build behavioural profiles for children, do not use child voice recordings to train any AI model, and do not share child personal information with any third party for commercial purposes. These commitments apply regardless of whether COPPA, DPDP, the California Age-Appropriate Design Code, or the UK Online Safety Act technically require them in a given jurisdiction — they are defaults, not compliance minimums.

8. Contact

For data protection enquiries, subject-access requests, erasure requests, or complaints, contact our Data Protection Officer at dpo@docent.academy. We aim to acknowledge all requests within two business days and to respond in full within 30 days (GDPR Article 12) or 7 days for requests from Indian data principals under DPDP.

For general support, billing queries, and account issues, contact support@docent.academy. Our support team can assist with data exports, account deletion, parental consent withdrawal, and neurodiversity flag management.

If you believe your data rights have not been respected, you have the right to lodge a complaint with the relevant supervisory authority: the OAIC (Australia), the ICO (UK), your national DPA (EU), the FTC (US), the Data Protection Board of India, or the Information Regulator of South Africa.

9. Changes to this Policy

We will notify active account holders by email at least 30 days before any material change to this Privacy Policy takes effect. Material changes include adding new categories of data collection, changing the purposes for which data is used, adding new sub-processors that access child data, or shortening retention periods in ways that affect data you have already provided. The effective date at the top of this page will be updated whenever a change is published.

Non-material changes — such as clarifications, corrections of typographical errors, or reorganisation of content without substantive change — may be made without advance notice, though the updated date will always reflect the most recent revision. We keep a changelog of all policy versions available on request from dpo@docent.academy.

Continued use of the Docent service after a material change takes effect constitutes your acceptance of the updated policy. If you do not accept the updated policy, you may close your account before the effective date and request deletion of your data without penalty.

Innovenses Pty Ltd · Melbourne, Australia · dpo@docent.academy · support@docent.academy · Sub-processors · Terms of Service