Privacy Policy

    Last updated: 19 October 2026

    ReportRocket is an AI report writing tool for Australian primary school teachers, run by Report Rocket Pty Ltd. This policy explains how we collect, use, store and protect personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

    Student names stay with us. Before anything is sent to Google's AI, we replace student names, and your school's name, with made-up stand-in names. The real names go back in when the comment comes back to you. See AI Processing for the details.

    Information We Collect

    User Account Data

    • Email address (for authentication and notifications)
    • Full name (for display and identification)
    • School affiliation (for organisation membership)
    • User role (teacher, reviewer, or school admin)
    • Purchase/licence status (for access management)

    Student Information

    To help you write reports, we hold:

    • Name and preferred name (preferred name is optional)
    • Pronouns
    • Year level
    • The performance levels you choose
    • Student ID (optional, used to match students when you re-upload a class list). We store a one-way hash of it and its last three characters, never the full ID
    • Your notes and report comments

    ReportRocket doesn't ask for students' addresses, dates of birth, photos, health information or family details.

    How We Collect It

    Teachers and school administrators give us this information when they create an account, enter or upload class lists, write notes and comments, or contact us. We also record how the app is used, for example how many AI requests each account makes.

    If You Don't Provide It

    An account needs a name and an email address. Without a student's details, ReportRocket can't draft that student's comment.

    How We Use Your Information

    • Providing AI-powered report comment generation
    • Managing your account and licence
    • Enabling collaborative review workflows
    • Sending service emails, and occasional product updates with an unsubscribe link in every message
    • Providing customer support
    • Improving our platform and services

    We do not use student data for marketing purposes or share it with third parties for their marketing use.

    Data Storage and Security

    Australian Data Residency

    Everything ReportRocket stores, including accounts, classes, students and comments, is kept on servers in Sydney. Student information leaves Australia in two ways:

    • AI requests: to write or check a comment, we send Google the student's year level and pronouns, the criteria and performance level you chose, your notes and the comment text. Student and school names are swapped for made-up stand-in names first (see AI Processing).
    • Emails: if you type a student's name into a review pack title or comment, or a message to us, it goes out in that email.

    We don't ask for students' dates of birth, addresses, photos or family details, so none of these is part of what we send.

    We'll tell you before that changes. We will email school administrators and account holders at least 30 days before we start storing information outside Australia, or add a service provider, beyond those named in this policy, that processes personal information in another country. This doesn't apply to the tools our own staff use to run the service.

    Security

    Information is encrypted in transit and at rest, and access rules in our database limit each person to the information their role allows.

    AI Processing

    ReportRocket uses Google's Gemini AI to write and check report comments. To do that, we send Google the details needed for the comment you're working on:

    • The student's year level and pronouns
    • The curriculum criteria and performance level you selected
    • Your notes about the student
    • Your style guide and example comments (or your school's)
    • The comment itself, when you check, reword or shorten it, or ask for a fix to a reviewer's note

    Student names are replaced before anything is sent. We swap the student's name, the names of other students at your school (or in your own classes, for a personal account) and your school's name for made-up stand-in names. Google writes about the stand-in, and we put the real names back before the comment reaches you.

    Names are matched against your class lists, so a nickname or a family member's name that isn't on a list won't be replaced. Using the names from your class list in your notes keeps everything covered.

    How Google handles it. We use Google's paid service. Under Google's terms, Google does not use what we send, or what it returns, to train its models or improve its products. Google keeps a copy for a limited period, solely to detect misuse of its service and meet legal requirements, and may process or briefly store it in any country where it has facilities, including outside Australia. If Google's main service is busy, the request goes to Google Cloud's Vertex AI instead, with the same name replacement and Google Cloud's equivalent terms.

    Analytics & Cookies

    Website analytics

    We use Google Analytics to understand how people find and use our website, such as which pages are visited and which buttons are clicked. It records general details like your browser, device and approximate location. It doesn't receive student names or the content of your reports, and we don't use it for advertising.

    Google reCAPTCHA

    Our contact and invoice request forms use Google reCAPTCHA to block spam. Google's Privacy Policy and Terms of Service apply.

    Cookies

    ReportRocket, Google Analytics and reCAPTCHA use cookies and similar browser storage to keep you signed in, remember settings, block spam and see how people find our website. You can block cookies in your browser settings, though some features may stop working.

    Third-Party Services

    We use these services to run ReportRocket. We share information with each one only so it can provide its part of the service. Each name links to that provider's privacy policy.

    ServicePurposeData Shared
    SupabaseAustraliaDatabase and app infrastructureAccounts (name, email, school, role); students (name, preferred name, pronouns, year level, optional student ID (hashed, last three characters kept)); performance levels, notes, report comments and review feedback
    Google Gemini and Vertex AIWorldwideWriting and checking commentsStudent year level and pronouns, chosen criteria and performance level, your notes, style guide and example comments, and the comment text. Student and school names are swapped for stand-in names first
    StripeUnited StatesPaymentsName, email and payment details
    ResendUnited StatesSending emailsTeacher and staff names and email addresses, and email content such as review pack titles, reviewer comments and support messages, which can include a student's name if you type one
    Google reCAPTCHAWorldwideSpam protection on our formsIP address and browser details
    Google AnalyticsWorldwideWebsite analyticsPages visited, device and approximate location
    CloudflareUnited StatesWebsite hosting and the sign-in bot checkIP address and browser details

    Data Retention and Deletion

    Retention Periods

    • User account data: Retained for the lifetime of your account
    • Student data: Controlled by teachers; retained until deleted
    • Generated reports: Controlled by teachers; retained until deleted

    Your Deletion Rights

    You can delete your data at any time:

    • Teachers can delete individual students, classes, or reports within the app
    • Personal accounts: You can delete your account directly from your profile menu. Deletion is immediate and permanently removes all your data including classes, students, reports, and settings. Backup copies are kept for a limited time and then removed.
    • School members: You must first leave your school (via School Admin settings), then you can delete your account. Classes you created for the school stay with the school.

    Your Rights

    Under the Privacy Act 1988, you have the right to:

    • Access your personal information held by us
    • Request correction of inaccurate information
    • Request deletion of your data
    • Know how your information is being used
    • Complain to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached (see Complaints below)

    Complaints

    If you have a complaint about how we handle your personal information, email [email protected]. We'll look into it and reply. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

    Contact Us

    If you have questions about this Privacy Policy or wish to exercise your privacy rights:

    • Company: Report Rocket Pty Ltd · ABN 95 694 320 048
    • Email: [email protected]
    • Contact: Contact Form
    • For security-related concerns, please mention "security" in your message subject.

    Changes to This Policy

    We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements, and will post the updated policy here with a new "Last updated" date. If a change materially affects you, we will tell you before it takes effect. A change to where information is stored or processed is also emailed in advance, as set out under Australian Data Residency.

    See also our Terms of Service