eddi logo
eddi
Book a Chat

Privacy Policy

Effective Date: 15th of July, 2026
Jurisdiction: Victoria, Australia

1. Introduction

EDDI EDUCATION PTY LTD ("eddi", "we", "our") is committed to protecting the privacy of all of its users, including but not limited to school staff, educators, staff, guardians, and students. This Privacy Policy outlines how we collect, use, store, and protect personal data in compliance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the Safer Technologies 4 Schools (ST4S) framework.

2. Information We Collect

eddi provides a comprehensive suite of educational tools, including student management, learning management, and school management systems. As a data processor acting on behalf of the School, we collect the following categories of information:

  • Identity and Contact Details: Names, email addresses, and identification documentation for staff, students, and parents/guardians.
  • Educational Records: Enrolment data, attendance, class assignments, learning activities, assessments, and timetable configurations.
  • Sensitive Information (Well-being & Behaviour): Records of behaviour incidents, behavioural observations, professional case notes, support arrangements, reason for absence, health and medical details (including medical action plans), and sensitive social, emotional, or mental health information.
  • Identifiers: Commonwealth Unique Student Identifier (USI).
  • System Usage: Logs of interaction with our tools, including online meetings, file hosting, forum usage, and visitor management.

Ephemeral Storage of Compliance Documents: Identity and compliance documents (such as Working with Children Checks or birth certificates) uploaded for verification are held using an ephemeral storage model. Once the School verifies the documentation, the physical files are automatically and permanently purged from eddi's systems.

3. How We Use the Data

All data collected is used strictly for the provision, maintenance, and security of the eddi platform. We do not sell any data, nor do we use it for targeted advertising or third-party marketing.

4. Data Storage and Sovereignty

eddi operates on a strict Australian data sovereignty model. All platform infrastructure is hosted exclusively within Australia via Amazon Web Services (AWS) in either Melbourne, Perth, or Sydney, depending on the school's location.

To ensure maximum security and data isolation, eddi employs a strict single-tenant infrastructure model. Every School is provisioned its own dedicated, logically isolated AWS account, which encompasses everything required to run eddi. All authorised sub-processors, including our email and SMS delivery gateways, are hosted entirely within this onshore AWS infrastructure. We do not route, process, or back up school or student data offshore.

5. Sensitive Information Control

Access to Sensitive Information (such as health data and behavioural notes) operates on a default-deny configuration. The School retains exclusive administrative control over Role-Based Access Control (RBAC), determining which specific staff members have the authority to view a student's medical or well-being records.

6. Financial Processing and Payment Data

The eddi platform facilitates payments for school fees, canteen orders, and events. eddi integrates with industry-leading, PCI-DSS compliant third-party payment gateways to handle all financial transactions securely. eddi acts only as a conduit; we do not directly collect, process, or store raw credit card numbers or sensitive banking details within our databases.

7. Artificial Intelligence (AI)

eddi provides dedicated Artificial Intelligence models hosted on your school's private eddi cloud to assist with educational tasks. This fully managed private hosting ensures maximum security, data isolation, and compliance with Australian policies. We do not utilise public third-party AI APIs, ensuring data never leaves your school's isolated boundary and no personally identifiable information (PII) is shared externally. Furthermore, eddi maintains a strict zero data training policy — no student, teacher, or school data is ever used to train or fine-tune foundational AI models. Your data remains entirely yours.

8. Data Retention and Deletion

Upon the termination of a School's agreement with eddi, we will provide the School with a full export of their dedicated database. Following this export, eddi will permanently and irreversibly destroy the School's database and all associated infrastructure within 30 days.