Legal
Privacy Policy
Last updated: 23 August 2026
Applies to the Stroma web application (app.stroma.com.au) and related services.
Who we are
Stroma is operated by Stroma Technologies Pty Ltd, ABN 78 701 118 210 ("we", "us"). Stroma is a faculty-management tool for Australian secondary school teachers. Contact: info@stroma.com.au.
We are committed to complying with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).
The short version
- Teachers are our users. Students never have Stroma accounts.
- Schools stay in charge of their students' information. Teachers enter student first names, class lists and assessment marks so the product can do its job; we store that on the school's behalf and use it for nothing else.
- If you use Stroma as a solo teacher (through Stroma's self-serve sign-up, using the teacher app, with no Head Teacher), student names never leave your browser, on any plan: our servers store marks against short codes you choose.
- We never sell personal information, and we never use it for advertising.
- AI features send lesson and report text to our AI providers (Anthropic and Google). Report-comment prompts are designed not to include student names. AI providers do not train on this data under our service terms.
- You can ask us at any time what we hold and to correct or delete it.
What we collect
About teachers and school staff (our users)
- Name, school email address, school and faculty, and role (Head Teacher / teacher / executive). We use these to create and route your account.
- The teaching data you enter: timetables, staffing allocations, programs, lesson-delivery records, meeting minutes, cover notes, calendar events, and private unit reflections.
- Sign-in is via Google (Firebase Authentication). We receive your email and basic profile from Google; we never see your password.
- Basic technical logs (from our hosting and database providers) for security and reliability.
Files and links you attach to lessons
Teachers can attach a file or a link to a lesson: a worksheet, slide deck or other teaching resource. A file you upload is stored with our cloud storage provider (Google), in a location scoped to your account; its file name, size, type and who added it are recorded in Firestore alongside your programs. An attachment stays private to you until you explicitly share it with your faculty. This feature is for teaching resources. It is not designed to hold student-specific documentation, and we do not ask you to attach any.
"Report a problem" diagnostics
If you use the in-app "Report a problem" tool, or the app captures an error on its own, we store a diagnostic record built from a fixed set of fields: an app version, the kind of event, which page and area it happened in, an error message and stack trace, how many times it recurred, an optional note you type, basic browser/device details, your school and faculty, and the time. None of your programs, roster, marks or notes are included (the record is built field-by-field and never includes any part of your saved data), and any student name or ID pattern the app can recognise, together with email addresses, are stripped from the message, note and stack trace before it's stored. Nothing is sent automatically, whether the app captured the error on its own or you used "Report a problem": the record is saved on your device first, and only reaches us if you open it and choose to send it. At that point you see the exact record before it goes.
About students (entered by teachers, on behalf of their school)
- Class roster names and preferred pronouns (Head Teacher-managed faculties; see the paragraph below for how it differs for a solo teacher account).
- Assessment marks and grades (the markbook).
- HSC assessment completion status and, where a teacher records one, a brief note and a link to documentation stored on the school's own systems. We never store the documentation itself (no medical certificates, no appeal forms).
- Class-level learning-adjustment profiles (NCCD categories). These are recorded per class, never per student. Stroma holds no individual disability, diagnosis, health or wellbeing records.
- We do not collect student email addresses, dates of birth, photos, addresses, or any government identifiers.
Signed up as a solo teacher? Student names never leave your browser. This applies if you joined through Stroma's self-serve sign-up as a solo teacher (using the teacher app, with no Head Teacher), on any plan, not a feature of one particular plan. A faculty set up and managed by a Head Teacher does not have this protection: rostered students' names sync normally so the Head Teacher and staff can share a roster. While your account remains a solo account, the markbook is private by design: our servers store marks against short codes or initials you choose, together with preferred pronouns. Student full names stay in your browser, on your device, and are never sent to or stored on our servers. Even a breach of our systems could not reveal your students' names alongside their results.
Because the names live only on your device, they are yours to manage: clearing your browser storage removes them (your marks are unaffected), and the app gives you a class-list file and a backup file (both created on your device) to restore them; those files contain student names, so store them as carefully as any class list. The codes, pronouns and marks we do hold may still be personal information in some contexts, and we treat them with the same care as the rest of your data. Free-text notes you write are synced, so we ask you (and the app reminds you) not to put student full names in them.
Payments
Handled entirely by Stripe. We never receive or store card details; we receive confirmation of your subscription and the sign-in email you provide at checkout.
Waitlist registration
While Stroma is opening to Australian schools, the "Register your interest" form on our website collects your name, school email address, school, role, and which plan you're interested in. The form is handled by Netlify Forms, a data processor for our website host, and the submissions are stored in our Netlify account dashboard. No separate database is used for it. We use this information solely to contact you about Stroma's availability, and for nothing else. Email info@stroma.com.au to have a waitlist entry deleted at any time.
Why we collect it
Solely to provide the product: running your faculty's timetable, programs and compliance records; generating teaching resources and report comments you request; showing your school executive the summaries their role permits; billing. We do not use personal information for marketing to third parties, profiling, or sale, and we will not use it for a secondary purpose you wouldn't reasonably expect without asking you first.
AI features (please read this one)
When a teacher uses an AI feature (report comments, lesson resources, minutes, extraction), the relevant text is sent to our AI providers, Anthropic (Claude) and Google (Gemini), to generate the result:
- Report-comment prompts are constructed without the student's name: before an observation note is sent, the app replaces the student's own name and roster label with their pronoun, and replaces every classmate's name and label with "a classmate". This only catches names and labels the app recognises from your class roster. It does not screen for other identifying details (like a relative's name), so avoid those in free-text notes. Marks-based achievement summaries are included so comments reflect real results.
- Teachers should avoid putting identifying student details in free-text notes; we provide in-app guidance on this.
- Under the commercial API terms we use, our AI providers do not use this content to train their models. Providers may retain data briefly for security and abuse monitoring.
- AI processing may occur outside Australia (see the next section).
Where your data lives, and overseas disclosure
- Our application database is Google Cloud Firestore in australia-southeast1 (Sydney). Our server functions run in australia-southeast1 (Sydney).
- Some service components process data outside Australia: Google's authentication service, Netlify (site hosting/CDN, and waitlist form submissions via Netlify Forms), Stripe (payments), and AI processing by Anthropic and Google, which may occur in the United States. Where the Privacy Act's APP 8 applies to these disclosures, we rely on the contractual safeguards in each provider's data-processing terms.
Who can see what
- Your faculty's data is readable and writable only by your faculty's Head Teacher and staff, enforced by database security rules.
- A school executive (Deputy/Principal) granted access by a Head Teacher can read faculty summaries but cannot read per-student marks, and can write only whole-school items (calendar, notes to faculties, class-level NCCD coordination).
- Private unit reflections are visible only to their author and the Head Teacher.
- Stroma's operator can access data for support and incident response, and accesses it only for those purposes.
Security
Data is encrypted in transit (TLS) and at rest by our cloud providers. Access is enforced by per-faculty database security rules that are version-controlled and tested. The app also keeps a working copy of your faculty's data in your browser's local storage on devices where you sign in. On shared computers, use your own operating-system profile and sign out. Backup files you export are your responsibility to store securely.
Retention and deletion
See our Data Retention & Deletion Policy. In short: we keep your data while your subscription (or free account) is active; after a subscription ends we delete the school's data within 90 days of a written request, or 12 months of inactivity, whichever comes first, except records we must keep (e.g. tax records of payments). Schools can export their data at any time (JSON export in-app).
Access, correction, complaints
Email info@stroma.com.au to access or correct personal information we hold about you. Because student data is entered by schools, we will refer or coordinate student-data requests with the relevant school. If you have a privacy complaint, contact us first; we aim to respond within 30 days. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Data breaches
We maintain a data-breach response plan. If a breach is likely to result in serious harm, we will notify affected schools/users and the OAIC in accordance with the Notifiable Data Breaches scheme, and affected schools promptly enough to meet their own obligations.
Found a security issue? Email info@stroma.com.au. Please include enough detail for us to reproduce it and, where safe and lawful, give us a reasonable opportunity to fix it before disclosing it publicly.
Changes
We will post changes here and, for material changes affecting schools, email subscribing schools before they take effect.
28 July 2026. Public contact address corrected to info@stroma.com.au; security-reporting route added.
4 August 2026. Added disclosure of the pre-launch waitlist registration form (name, school email, school, role, plan of interest), handled by Netlify Forms.
6 August 2026. The operator is now named: Stroma is operated by Stroma Technologies Pty Ltd, ABN 78 701 118 210. No collection, use, disclosure or retention practice changed.
23 August 2026. Accuracy pass: the private-markbook protection is described as applying to solo teacher accounts using the teacher app (self-serve sign-up, no Head Teacher), not to a Head Teacher-managed faculty, and not to the Solo Teacher plan name; the "(and free)" plan reference was removed, since no current plan is called that; the observation-notes AI wording now describes the actual name/label substitution rather than calling it anonymisation; the "Report a problem" disclosure states plainly that nothing is sent automatically; and two disclosures were added (lesson file/link attachments, and the diagnostic record stored when "Report a problem" is used). No collection, use, disclosure or retention practice changed by this pass. It corrects wording to match existing behaviour.