Privacy Policy
1. Who we are
In this Privacy Policy, 'us', 'we' or 'our' means Stackable Group Pty Ltd (ACN 692 067 244) (Stackable). We are committed to respecting your privacy. This Privacy Policy sets out how we collect, use, store and disclose your personal information.
By providing your personal information to us, you consent to our collection, use and disclosure of that information in accordance with this Privacy Policy. We may update this Privacy Policy from time to time. The current version is always available on our website.
2. What personal information do we collect?
2.1 Personal information
We may collect the following personal information:
- Your name
- Your email address
- Your phone number
- Your role (for example, Education Support Worker, educator or allied health professional)
- Your job title or position
- The organisation or school you work with
- Records of your interactions with us, including emails, support tickets and course discussions
- Your course enrolments, progress, completion status and certificates
- Payment transaction records (we do not store card numbers; payments are processed by Thinkific Payments using Stripe, Inc.)
- Profile information we receive from third-party sign-in providers (such as Google or Microsoft) when you choose to sign in using those accounts, typically your name, email address and profile picture
2.2 Sensitive information
Sensitive information includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union or professional association membership, sexual orientation or practices, criminal record and health information.
We do not actively collect sensitive information, except:
- Health information (see Section 2.3); and
- Sensitive information you choose to share with us (for example, in a course reflection, support email or discussion post).
2.3 Health information
Health information is information or opinion about your physical, mental or psychological health.
The health information we may collect includes:
- Reflections, journal entries or notes you write within a course about your own wellbeing, mental health or reactions to your work
- Wellbeing check-ins, self-assessments or "Self Check" responses you complete inside our courses
- Information you provide in support emails or course discussions about your own physical or mental health
Sharing health information with Stackable is voluntary. Where a course feature requests health information, we explain why at or before the point of collection.
We apply the safeguards described in Section 8 to health information.
2.4 Technical information
When you use Stackable, we may collect:
- Your IP address
- Your device type, operating system and browser
- Pages you visit and how long you spend on them
- Course activity logs (when you log in, what you click, what you complete)
- Referral information (the website that sent you to us, if any)
- Cookies and similar tracking technologies (see Section 7)
2.5 Information about people other than you
Some Stackable features ask you to enter limited information about a person you work with. For example, the Student Profile tool asks for a student's initials and contextual details.
This information is processed in your browser. It is not transmitted to or stored by Stackable, and is lost when you refresh or close the page.
When writing reflections or other open responses, you may incidentally mention people you work with. Share only what is necessary, use initials rather than full names, and avoid identifying details where they are not needed.
If we change how this feature handles information (for example, by transmitting it to a third party), we will update this policy.
3. Why do we collect, use and disclose personal information?
We collect, hold, use and disclose your personal information for the following purposes:
- to provide you with access to Stackable and the courses, content and features you sign up for;
- to operate, secure, maintain and improve our services, including by performing analytics on how our platform is used;
- to deliver and measure advertising about Stackable, including through third-party platforms (see Section 7);
- to send you service communications, including support, technical notices, security alerts, account updates and information you request;
- to send you marketing communications about Stackable, where you have not opted out;
- to comply with our legal obligations, resolve disputes and enforce our terms of service;
- in connection with a sale or transfer of all or part of our business or assets.
Where we collect sensitive information (including health information), we use it only for the purpose for which you provided it, unless you give us further consent or we are required or authorised to use it by law.
4. Do we use your personal information for direct marketing?
We may send you direct marketing communications about our services by email. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by contacting us using the details in Section 14.
5. To whom do we disclose your personal information?
We may disclose personal information to:
- our employees and contractors who need access to perform their duties;
- third-party service providers who help us operate Stackable, including:
- cloud infrastructure, database and authentication providers (Supabase);
- our learning platform provider (Thinkific) and the payment processor used by that platform (Stripe, Inc.);
- hosting and content delivery providers (Vercel);
- email and marketing service providers (Brevo and, during our transition away from it, HubSpot);
- office productivity and collaboration tools (Microsoft 365);
- analytics and advertising providers (Google, Meta and LinkedIn);
- our professional advisers, such as our lawyers, accountants and auditors;
- third parties you have authorised to receive your personal information;
- any party to whom our business or assets are transferred or proposed to be transferred, including in connection with a sale, merger, restructure or insolvency;
- government agencies, regulatory bodies and law enforcement agencies, where required, authorised or permitted by law.
Some of these recipients are located outside Australia. See Section 6 for details about overseas disclosure.
6. Disclosure of personal information outside Australia
We may disclose personal information to recipients located outside Australia, including in:
- Canada (our learning platform provider, Thinkific);
- France (our email service provider, Brevo); and
- the United States (Stripe, Inc., Vercel, HubSpot, Google, Meta and LinkedIn).
Where we disclose personal information to a recipient outside Australia, we take reasonable steps to ensure that the recipient handles your personal information in a manner consistent with the Australian Privacy Principles.
8. Security
We hold your personal information in electronic form within the systems of the service providers identified in Section 5.
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:
- using established service providers that publish their security practices and have data protection agreements with us;
- encrypting personal information in transit (using TLS) and at rest, as provided by those service providers; and
- requiring authentication for access to user accounts, with passwords stored as one-way cryptographic hashes by our authentication providers.
However, no system is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee its security.
9. Notifiable data breaches
We are subject to the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). If we have an eligible data breach involving your personal information, we will notify you and the Office of the Australian Information Commissioner as required by that scheme.
10. How long we keep your personal information
We keep your personal information for as long as we need it for the purposes set out in this Privacy Policy. The retention period depends on the type of information and why we hold it.
Where we no longer need your personal information, we will take reasonable steps to destroy or de-identify it, unless we are required or permitted by law to keep it (for example, for tax, accounting or audit purposes).
11. Links to other websites
Our website may contain links to websites operated by third parties. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any third-party website before providing your personal information to it.
12. Accessing or correcting your personal information
You can request access to the personal information we hold about you, or ask us to correct any information you believe is inaccurate, by contacting us using the details in Section 14. We may need to verify your identity before responding.
If you ask us to correct information, we will take reasonable steps to do so.
In some cases, we may not be able to provide access to all of your personal information, or to correct information as requested (for example, where doing so would unreasonably affect the privacy of others, or where the Privacy Act 1988 (Cth) permits us to refuse or decline). If we refuse, we will explain why.
13. Making a complaint
If you think we have breached the Privacy Act 1988 (Cth), or you wish to complain about how we have handled your personal information, please contact us using the details in Section 14. Include your name, contact details and a clear description of your complaint.
We will acknowledge your complaint and respond within a reasonable period.
If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
- Email: enquiries@oaic.gov.au
14. Contact us
For questions about this Privacy Policy or our privacy practices, or to make a privacy-related request or complaint, contact us:
- Email: privacy@stackable.app
- Address: Level 13, 727 Collins Street, Docklands VIC 3008