Privacy Policy

Edvias respects your privacy and is committed to handling personal information responsibly, transparently and in accordance with applicable privacy laws.

This Privacy Policy explains:

• what information we collect;
• how we collect it;
• why we collect it;
• how we use it;
• who we share it with;
• how long we keep it;
• your choices and rights; and
• how to contact us.

This Privacy Policy applies to:

• https://edvias.com
• the Edvias web application
• future mobile applications
• AI features
• Connections
• Study Groups
• messaging
• public profiles
• OCR
• voice features
• subscription services
• Institution accounts
• all other Edvias services.

This Privacy Policy forms part of the Edvias Terms of Use.

Edvias is operated by Arzaro Holdings Pty Ltd (ABN 31 701 933 771), trading as Edvias.

Throughout this Privacy Policy, Edvias, we, our and us mean the operator of the Edvias platform.

• Website: https://edvias.com
• Privacy enquiries: admin@edvias.com
• Support: support@edvias.com

If Edvias later becomes operated by Edvias Pty Ltd, this Privacy Policy will continue to apply unless replaced.

This Privacy Policy applies whenever you:

• visit our website;
• create an account;
• log in;
• upload documents;
• use AI features;
• use OCR;
• use voice recognition;
• create Connections;
• join Study Groups;
• send messages;
• purchase subscriptions;
• contact support;
• participate in surveys;
• interact with our services.

It also applies where an educational institution provides you with access to Edvias.

For this Privacy Policy:

• Account means your Edvias account.
• AI Features means artificial intelligence functionality including educational assistance, document analysis, OCR, AI tutoring, writing assistance and future AI tools.
• Connection means another user that you connect with through Edvias.
• Institution means a school, university, TAFE or other educational organisation.
• Personal Information means information about an identified individual or an individual who is reasonably identifiable.
• Sensitive Information means information treated as sensitive under applicable privacy laws.
• Study Group means a collaborative group created within Edvias.
• User Content means information, documents, messages and files uploaded by users.

The information we collect depends on how you use Edvias. We may collect the following categories.

Edvias is not designed to intentionally collect:

• payment card numbers;
• passwords for third-party accounts;
• government identity documents;
• health information unrelated to providing the requested service;
• biometric information beyond what is reasonably necessary for voice functionality;
• unnecessary sensitive information.

If unnecessary personal information is accidentally submitted, we may delete or de-identify it where appropriate.

Information may be collected:

• directly from you;
• from your browser;
• from your device;
• from authentication providers;
• from educational institutions where applicable;
• from payment providers;
• from analytics services;
• from security systems;
• from your use of the Services.

We do not intentionally collect information by covert or deceptive means.

We use personal information only where reasonably necessary to operate, improve, secure and support Edvias. Depending on how you use the Services, we may use your information to:

Edvias does not sell your personal information. We may share information only where reasonably necessary.

Edvias is operated from Australia, but some of the technology providers used to operate Edvias process or store information outside Australia.

Edvias uses Base44 as part of its platform infrastructure. Based on Base44's currently published subprocessor list, relevant processing or storage may occur in countries including the United States, Germany, the United Kingdom and Israel. Base44 currently identifies, among others, Mongo for data storage and hosting in the United States, Supabase for media hosting in the United States, OpenAI and Anthropic for LLM API calls in the United States, Langfuse for LLM logging in Germany, Logfire for logging in the United Kingdom, and Wix.com Ltd. in Israel.

The providers, functions and locations used in connection with Edvias may change over time.

Where Australian privacy law applies to an overseas disclosure, Edvias will take reasonable steps required by applicable law in relation to that disclosure and will review material changes to its service-provider arrangements. Where practicable and required, we will keep our privacy disclosures about likely overseas recipients and countries current.

To provide AI functionality, prompts, uploaded content, OCR results, images, messages or transcripts may be processed using Base44 infrastructure and authorised AI/LLM subprocessors or other providers used for the relevant Edvias feature.

Base44's currently published subprocessor list identifies OpenAI and Anthropic for LLM API calls in the United States.

Where Base44 processes Personal Data on Edvias' behalf under its Data Processing Addendum, Base44 states that it uses Personal Data to provide the Services, or following full anonymisation or aggregation, and that its subprocessors must not process Personal Data for another purpose except on an aggregated or anonymised basis.

Edvias does not currently make an absolute promise that user content is 'never used for AI training' by every provider in every circumstance. We encourage users not to submit highly sensitive information unless it is necessary for the intended educational purpose.

Edvias uses cookies and similar technologies to:

• keep users signed in;
• remember preferences;
• improve security;
• maintain sessions;
• understand usage;
• improve performance.

Some cookies are essential for the operation of the Services. Optional analytics or similar technologies will only be used where required permissions have been obtained.

Users may manage cookie preferences through browser settings and any cookie controls provided by Edvias. Disabling certain cookies may affect functionality.

We may send communications relating to:

• product updates;
• feature announcements;
• educational content;
• promotions;
• newsletters.

Where required by law, we will obtain your consent before sending marketing communications. You may unsubscribe from marketing emails at any time using the unsubscribe link or by adjusting your communication preferences.

Service-related communications (such as security notices, subscription reminders and legal updates) may still be sent where reasonably necessary.

Edvias takes reasonable technical and organisational measures to protect information against unauthorised access, loss, misuse, alteration or disclosure. These measures may include, depending on the systems and providers used:

• encrypted communications where supported;
• authentication and access controls;
• security monitoring and logging;
• software and dependency updates;
• backup and recovery measures provided by relevant infrastructure providers;
• incident response procedures.

Edvias relies in part on Base44 and other service providers for infrastructure security. Base44's Data Processing Addendum states that it maintains technical and organisational measures designed to prevent unauthorised access, disclosure or corruption of Personal Data. Edvias remains responsible for appropriately configuring the features and controls available to it and for assessing whether its providers meet Edvias' needs and legal obligations.

No online service can guarantee absolute security. Users are responsible for helping protect their Accounts by choosing strong passwords, securing their devices and reporting suspected unauthorised access.

We retain personal information only for as long as reasonably necessary to:

• provide the Services;
• maintain your Account;
• provide customer support;
• comply with legal obligations;
• investigate complaints;
• resolve disputes;
• enforce our Terms;
• protect users;
• detect fraud;
• improve platform security.

The length of time information is retained depends on the type of information, the purpose for which it was collected, legal requirements and operational needs. Examples include:

• Account information – while your Account remains active and for a reasonable period afterwards where required for legal, security or operational purposes.
• Subscription and billing records – for the period required by applicable taxation, accounting and financial record-keeping laws.
• Support requests – for as long as reasonably necessary to respond to your enquiry, improve support services and resolve future issues.
• Security logs – for a reasonable period to investigate security incidents, fraud, abuse and unauthorised access.
• Messages and Study Group content – until deleted by users, removed under our policies or retained for legal, moderation or safety reasons.
• AI conversations and uploaded files – for as long as necessary to provide the requested functionality, subject to your deletion requests, legal obligations and our operational requirements.
• Backups – deleted information may continue to exist in provider backups for a limited period before being overwritten or deleted in accordance with applicable provider retention and recovery processes. Edvias will not describe backups as encrypted or subject to a specific deletion period unless that has been verified for the relevant provider and configuration.

We periodically review the information we hold and take reasonable steps to securely delete or de-identify information that is no longer required.

You may request deletion of your Account through your account settings or by contacting us.

Deleting your Account will generally result in:

• removal of access to your Account;
• deletion or de-identification of personal information from active systems where appropriate and technically supported;
• removal of your public profile;
• cancellation of future access to subscription features, subject to the separate subscription cancellation process where applicable.

The exact effect and timing of deletion can depend on the Edvias feature and the service providers involved. Edvias will not promise immediate deletion from every provider, backup or log unless that behaviour has been verified.

Some information may be retained after deletion where reasonably necessary to:

• comply with law;
• maintain financial records;
• investigate fraud;
• investigate abuse;
• enforce our Terms;
• resolve disputes;
• comply with court orders;
• maintain security;
• preserve evidence relating to reports or legal claims;
• protect other users.

Deleting your Account does not necessarily delete information already shared with another user, such as messages, shared files or content that another user has lawfully retained. Where possible, retained information will be restricted to authorised personnel and used only for the purposes for which it has been retained.

Depending on applicable law, you may have the right to:

• access personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information in certain circumstances;
• withdraw consent where processing is based on consent;
• object to or request restrictions on certain processing activities where applicable;
• request a copy of certain personal information you have provided to us;
• manage communication preferences;
• manage privacy settings within your Account.

Some requests may be limited where:

• another person's privacy would be affected;
• legal obligations prevent disclosure;
• the request is unreasonable or excessive;
• information must be retained for security, fraud prevention or legal reasons.

We may take reasonable steps to verify your identity before responding to certain requests.

Edvias is designed for users aged 13 years and over, subject to any higher minimum age required by applicable law or for a particular feature.

We may collect age or age-eligibility information where reasonably necessary to determine account eligibility, apply age-appropriate privacy and safety settings, or control access to particular features. Exact date of birth should not be collected unless Edvias determines that it is reasonably necessary for the applicable age-assurance method or legal requirement.

We recognise that users under 18 may require additional privacy and safety protections. Edvias is designed so that age-related feature permissions can be configured separately for educational, messaging, Connections, Study Group, profile and other community functionality rather than assuming that every feature has the same legal minimum age.

Accordingly, Edvias aims to:

• apply privacy-focused default settings for minors where appropriate;
• minimise unnecessary collection and exposure of age and other personal information;
• keep exact date of birth, email, phone number, precise location, private AI conversations, private messages and private uploaded documents non-public by default;
• provide tools to report, block and restrict unwanted contact where community features are available;
• restrict or disable age-sensitive features where required by applicable law, regulatory requirements or Edvias safety settings;
• provide age-appropriate information and controls as the applicable Australian regulatory framework develops.

Users under 18 should use Edvias with appropriate guidance from a parent, guardian or educational institution.

We do not knowingly allow users below the applicable minimum age to create standard personal Accounts unless a separate lawful and appropriately designed educational or authorised process applies.

If we become aware that an Account has been created in breach of applicable age requirements, we may suspend or remove the Account and take reasonable steps to delete or de-identify associated information where appropriate.

Australia's Children's Online Privacy Code is scheduled to be finalised and registered by 10 December 2026. Edvias will review this Policy and relevant product settings when the final Code is available and where it applies to Edvias.

Edvias is operated from Australia.

If you access the Services from outside Australia, you acknowledge that your personal information may be transferred to and processed in Australia and in other countries where our authorised service providers operate. Privacy laws in those countries may differ from those in your jurisdiction.

If you believe we have handled your personal information in a way that is inconsistent with this Privacy Policy or applicable privacy law, you may contact us. Please provide sufficient detail to allow us to investigate your concern.

We aim to acknowledge and respond to privacy complaints within a reasonable period.

If you have questions about this Privacy Policy, wish to exercise your privacy rights or would like to make a privacy-related request or complaint, please contact us.

• Website: https://edvias.com
• Privacy & Administration: admin@edvias.com
• Customer Support: support@edvias.com

We will make reasonable efforts to respond to enquiries as promptly as practicable.

This Privacy Policy should be read together with the:

• Edvias Terms of Use;
• AI & Academic Integrity Policy;
• Community Guidelines;
• Subscription & Billing Policy;
• Cookie Policy;
• Data Retention & Account Deletion Policy;
• Security Policy;
• Accessibility Statement.

Where another policy provides more detailed information about a specific topic (for example, cookies, subscriptions or community behaviour), that policy supplements this Privacy Policy.

Nothing in this Privacy Policy limits any rights or obligations that cannot be excluded under applicable law.