Privacy Policy
Last updated: 20 August 2026
1. Who we are
In this Privacy Policy, 'us', 'we' or 'our' means Stackable Group Pty Ltd (ACN 692 067 244) (Stackable). We are committed to respecting your privacy. This Privacy Policy sets out how we collect, use, store and disclose your personal information.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where the law requires your consent to collect or use particular information about you, such as your health information, we ask for it at or before the point of collection. Where you record information about another person, such as a client or a student, we have no relationship with that person; we rely on you to have any consent or authority you need (see Section 2.5).
We may update this Privacy Policy from time to time. The current version, with the date it took effect, is always available on our website.
2. The personal information we collect
We collect personal information directly from you (for example, when you create an account, complete a course activity or contact us), automatically as you use the platform (see Section 2.4), and from third parties such as a sign-in provider or our payment processor where you use those services.
2.1 Personal information
We may collect the following personal information:
- your name
- your email address
- your phone number
- your role (for example, Education Support Worker, educator or allied health professional)
- where you use professional features: your profession, the body you are registered with, your registration number and date, and your registration type (for example, provisional or general registration as a psychologist with AHPRA)
- the country and state or territory you live in
- your job title or position
- the organisation or school you work with
- records of your interactions with us, including emails, support tickets and course discussions
- your course enrolments, progress, completion status and certificates
- payment transaction records (we do not store card numbers; payments are processed by Stripe, Inc.)
- profile information we receive from third-party sign-in providers (such as Google or Apple), where we offer those options and you choose to sign in that way, typically your name, email address and profile picture
2.2 Sensitive information
Sensitive information includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union or professional association membership, sexual orientation or practices, criminal record and health information.
We do not actively collect sensitive information, except:
- health information (see Section 2.3)
- sensitive information you choose to share with us (for example, in a course reflection, support email or discussion post)
2.3 Health information
Health information is information or opinion about your physical, mental or psychological health.
The health information we may collect includes:
- reflections, journal entries or notes you write within a course about your own wellbeing, mental health or reactions to your work
- wellbeing check-ins, self-assessments or "Self Check" responses you complete inside our courses
- information you provide in support emails or course discussions about your own physical or mental health
Sharing health information with Stackable is voluntary. Where a course feature requests health information, we explain why at or before the point of collection.
We apply the safeguards described in Section 8 to health information. Records you keep about clients in professional tools are covered in Section 2.5.
2.4 Technical information
When you use Stackable, we may collect:
- your IP address
- your device type, operating system and browser
- pages you visit and how long you spend on them
- course activity logs (when you log in, what you click, what you complete)
- referral information (the website that sent you to us, if any)
- cookies and similar tracking technologies (see Section 7)
2.5 Information about people you support
Some Stackable features let you record information about a person you work with, such as a student in the Social Story Builder. Those records can include a first name or initials, a year level, notes, profile answers and the stories you write. We store them in our database against your account so they are private to you and available across your devices.
Professional tools can also hold records about your clients, such as questionnaire responses, logbook entries and session notes. We hold these records under the Privacy Act 1988 (Cth) and applicable state and territory health records laws, such as the Health Records Act 2001 (Vic), and only so the tool works for you; we use them for no other purpose. Where a tool is end-to-end encrypted, we cannot read the content at all. We do not ask your clients for consent and cannot do so on your behalf; obtaining any consent your profession or the law requires is your responsibility.
Enter only what the feature needs. Use a first name or initials rather than a full name, and leave out identifying details the record does not need. Only record information about another person where you have the authority or consent to do so.
Where you share a story by link, the published copy contains the story as it reads on the page, including any photos you have added to its pages. The student's profile, notes and the working record behind the story are not included, and the unedited originals of your photos never leave your device.
Some in-course activities process what you type in your browser only; it is not sent to us and is lost when you close the page. Your completion of the activity is still recorded.
When writing reflections or other open responses, you may incidentally mention people you work with. Share only what is necessary and avoid identifying details where they are not needed.
2.6 AI-assisted features
Some features use artificial intelligence to help draft content. For example, the Social Story Builder can draft story text from your answers about a situation. What you enter into an AI-assisted feature, which can include a student's first name and your answers, is sent to our AI provider, Anthropic, to generate the draft. Anthropic's commercial API terms do not permit it to use that content to train its models.
3. Why we collect, use and disclose personal information
We collect, hold, use and disclose your personal information for the following purposes:
- to provide you with access to Stackable and the courses, content and features you sign up for
- to operate, secure, maintain and improve our services, including by analysing how the platform is used
- to deliver and measure advertising about Stackable, including through third-party platforms (see Section 7)
- to send you service communications, including support, technical notices, security alerts, account updates and information you request
- to send you marketing communications about Stackable, where you have not opted out
- to comply with our legal obligations, resolve disputes and enforce our terms of service
- in connection with a sale or transfer of all or part of our business or assets
Where we collect sensitive information (including health information), we use it only for the purpose for which you provided it, unless you give us further consent or we are required or authorised to use it by law.
4. Direct marketing
We may send you direct marketing communications about our services by email. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by contacting us using the details in Section 14.
5. Who we disclose your personal information to
We may disclose personal information to:
- our employees and contractors who need access to perform their duties
- third-party service providers who help us operate Stackable, including:
- cloud infrastructure, database and authentication providers (Supabase)
- hosting and content delivery providers (Vercel)
- our payment processor (Stripe, Inc.)
- our AI provider for drafting features (Anthropic)
- email and marketing service providers (Brevo and, during our transition away from it, HubSpot)
- office productivity and collaboration tools (Microsoft 365)
- analytics and advertising providers (Google, Meta and LinkedIn)
- our professional advisers, such as our lawyers, accountants and auditors
- third parties you have authorised to receive your personal information
- any party to whom our business or assets are transferred or proposed to be transferred, including in a sale, merger, restructure or insolvency
- government agencies, regulatory bodies and law enforcement agencies, where required, authorised or permitted by law
Some of these recipients are located outside Australia. See Section 6 for details about overseas disclosure.
6. Disclosure of personal information outside Australia
Our main database, holding your account and course records, is hosted in Sydney, Australia. Some of our service providers process personal information outside Australia, including in:
- France (our email service provider, Brevo)
- the United States (Anthropic, Stripe, Inc., Vercel, HubSpot, Google, Meta and LinkedIn)
Where we disclose personal information to a recipient outside Australia, we take reasonable steps to ensure that the recipient handles your personal information in a manner consistent with the Australian Privacy Principles.
8. Security
We hold your personal information in electronic form within the systems of the service providers identified in Section 5.
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:
- using established service providers that publish their security practices and whose service terms include data protection commitments
- encrypting personal information in transit (using TLS) and at rest, as provided by those service providers
- requiring authentication for access to user accounts; sign-in is passwordless (an emailed link or one-time code, or a passkey), so there is no account password to steal or reuse
- encrypting the content of certain records, such as professional logbook entries, on your device before it reaches us, so that we cannot read it
However, no system is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee its security.
9. Notifiable data breaches
We are subject to the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If we have an eligible data breach involving your personal information, we will notify you and the Office of the Australian Information Commissioner as required by that scheme.
10. How long we keep your personal information
We keep your personal information for as long as we need it for the purposes set out in this Privacy Policy. The retention period depends on the type of information and why we hold it. We keep records of the certificates we issue so they can be verified later.
Where we no longer need your personal information, we will take reasonable steps to destroy or de-identify it, unless we are required or permitted by law to keep it (for example, for tax, accounting or audit purposes).
11. Links to other websites
Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any third-party website before providing your personal information to it.
12. Accessing or correcting your personal information
You can request access to the personal information we hold about you, or ask us to correct any information you believe is inaccurate, by contacting us using the details in Section 14. We may need to verify your identity before responding.
If you ask us to correct information, we will take reasonable steps to do so.
In some cases, we may not be able to provide access to all of your personal information, or to correct information as requested (for example, where doing so would unreasonably affect the privacy of others, or where the Privacy Act 1988 (Cth) permits us to refuse). If we refuse, we will explain why.
13. Making a complaint
If you think we have breached the Privacy Act 1988 (Cth), or you wish to complain about how we have handled your personal information, contact us using the details in Section 14. Include your name, contact details and a clear description of your complaint.
We will acknowledge your complaint and respond within a reasonable period.
If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
- Email: enquiries@oaic.gov.au
14. Contact us
For questions about this Privacy Policy or our privacy practices, or to make a privacy-related request or complaint, contact us:
- Email: support@stackable.app
- Address: Level 13, 727 Collins Street, Docklands VIC 3008