Privacy Policy

Last updated 2026-09-13

Draft awaiting review by [ENTITY NAME]. Items in square brackets are placeholders to be completed before launch.

KindyStudio is operated by [ENTITY NAME] (ABN [ABN]) (“we”, “us”). We make learning resources for Australian early childhood educators, and we handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy explains what we collect, why, where it goes and how you can control it. Because some of what you type describes children, we hold ourselves to the standard the Privacy Act sets even where a small business might be exempt.

1. What we collect

About you (the account holder)

• Your email address and a password (the password is stored only as a secure hash).
• Your display name, the name of your centre or service, your state or territory, and whether you are an educator or a parent or carer.
• Billing details when you buy credits or a plan: these are collected and held by our payment processor (Stripe). We store only a customer reference and the plan or pack you bought, never card numbers.
• Technical information: your IP address (held in hashed form for abuse prevention), browser type, and the time of sign-ins and actions.

About children (only what you choose to type)

• A child's first name, only when you enter it for a resource that uses it (a certificate, a name pack, a personalised storybook). We accept a single given name only - the form refuses surnames.
• The topic text you write for a resource. For a social story this describes a situation (for example waiting for a turn), not a child. The forms refuse topics that carry surnames, ages, health or family details, or a named behaviour incident. Once the resource has a title, the topic is replaced by it.
• We never ask for, and you must never upload, photographs, dates of birth, addresses, health information or any other detail about a child.

Consent

Before you enter a child's first name you confirm that you have the family's consent to use it. We record that confirmation (the date, time, your account and the policy version) so you and your service can show it later. Your service's own consent and privacy obligations to families continue to apply.

2. Why we collect it

• To make the resources you ask for: the topic and any first name you enter are the instructions for the resource.
• To run your account: sign-in, credits, purchases, receipts and support.
• To keep the service safe: screening topics for content that is unsuitable for children, preventing abuse and fraud, and reviewing anything that is reported to us.
• To improve the product using aggregate statistics (for example how many storybooks were made this week). We do not use your resources or children's names to train any AI model. [CONFIRM WITH MEDIA PARTNERS: no training on API requests]

3. Where your information goes

We share personal information only with the service providers that make KindyStudio work, and only what each one needs:

• Our database and file storage are hosted in Australia (Sydney region). Your account, your resources, the topic text and any first name you enter are stored there.
• A US AI provider writes the words of your resources and the studio assistant's answers, on servers in the United States. We send it the topic text and, where the resource needs it, the child's first name, with request storage turned off. The studio assistant only proposes: anything that spends credits, shares or changes a resource waits for you to confirm, and we keep no chat history on our servers (the conversation lives in your browser tab).
• Our media partners overseas generate the pictures, narration, songs and video in your resources (and the writing, if the US AI provider is unavailable). Picture and video instructions never include the child's name; narration includes the words it reads aloud. These partners process requests on servers outside Australia (including in the United States). [CONFIRM WITH MEDIA PARTNERS: request data is deleted after processing and is not used to train their models.]
• Stripe processes payments and holds your billing details under its own privacy policy.
• Our hosting provider serves the website and holds short-lived technical logs.
• Email delivery providers send sign-in, confirmation and receipt emails.

We do not sell personal information, and we do not share it with advertisers. If we are required by law, or need to protect a child, we may disclose information to the relevant authority.

4. Sharing links

Every resource is private to your account unless you turn sharing on. A share link shows the resource - including any child's first name inside it - to anyone who has the link. Share links are marked so search engines do not index them, but treat a share link as you would a printed copy: give it to families and colleagues, not the public. Turning sharing off makes the old link stop working. The pictures, sound and video on a share page are served through links that expire after one hour, and a child's parent or carer can take a shared resource down from the share page itself (see section 8).

5. How long we keep it

• Your resources, including any first name inside them, stay until you delete them or close your account.
• Resources that failed or were cancelled before finishing are deleted, with their files, after 30 days.
• Once each picture, narration or clip is made, the instructions used to make it are cleared, and the topic you typed is replaced by the resource's title.
• We do not close inactive accounts automatically. If we ever start, we will email you a notice first.
• Purchase and credit records are kept for the period Australian tax law requires (generally five years), in a form that does not identify a child.
• Hashed technical logs used for abuse prevention hold no names or content. We intend to delete them after 90 days; that clean-up is not automatic yet.

6. Your choices and rights

• Delete any resource at any time from your library. Deleting removes the resource and its generated files from our storage.
• Close your account from Settings. This cancels any subscription, deletes every resource and generated file, and removes your profile. Purchase records are retained without any child's details, as the law requires.
• Ask us for a copy of the personal information we hold about you, or to correct it, at the contact below. We respond within 30 days.
• You can use most makers without entering a child's name at all.

7. Security

Data is encrypted in transit and at rest. Generated files live in private storage and are served through short-lived signed links. Access inside our team is limited to what is needed to run and support the service. Every request that makes a resource is screened for content unsuitable for children before it is sent to an AI provider or media partner, and educators and families can report any resource to us from its share page or by email.

8. Children's privacy

KindyStudio is a tool for adults. We do not offer accounts to children and we do not knowingly collect information directly from a child. The only information about children we hold is what an educator or parent chooses to type, with the family's consent, to make a resource for that child: at most one first name.

We design to the best interests of the child, the standard of the Children's Online Privacy Code being prepared by the Australian Information Commissioner. In plain terms:

• Every fact about what we keep, where it goes and how long it stays is on one page: What we keep about children.
• A child's parent or carer can have a shared resource taken down without an account: every share page has the link “Is your child in this? Ask for it to be taken down”. The link stops working at once and the educator is told.
• A family can also ask us, at the contact below, to delete a resource that names their child, or to tell them whether we hold one. We will act on it even if they do not hold an account.
• Directors can find a printable summary for their policy folder at For directors and approved providers.

9. Complaints and contact

Questions, access requests and complaints: [CONTACT EMAIL] or [POSTAL ADDRESS]. We will acknowledge a complaint within 7 days and aim to resolve it within 30. If you are not satisfied you can contact the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

10. Changes

We will post any change here with a new date at the top, and email account holders about changes that affect how children's information is handled.