Your privacy matters to us.
Last updated: June 1, 2026
This page covers both Campus AI's Data Residency commitments and our Privacy Policy. As an AI platform built for Australian higher education, data sovereignty is a foundational design principle, not an afterthought.
Data Residency
Where Your Data Lives
- Application & Database: Hosted in AWS Sydney (ap-southeast-2) via Supabase. All data at rest, including user accounts, course content, AI interactions, and usage logs, remains within Australia.
- AI Inference: Processed in Google Cloud australia-southeast1 region. No customer data leaves Australia for AI processing.
- Edge Delivery: Application content delivered via Vercel's AU-region edge network (Sydney).
No-Model-Training Guarantee
Campus AI does not use customer data — including prompts, outputs, uploaded content, or usage patterns — for model training, fine-tuning, or service improvement. This is contractually guaranteed. Our AI providers (Google Cloud Vertex AI) are bound by the same contractual restriction. Institutions can audit this through our logging and reporting controls.
Offshore Processing Notice
In the event that onshore AI capacity is insufficient, Campus AI may process select non-personal, anonymised inference requests in Google Cloud's US-central or europe-west4 regions. Institutions will be notified in advance of any offshore processing configuration. Personally identifiable information and institutional content will never be processed offshore. Institutions can restrict processing to AU-only through their admin console configuration.
Privacy Policy
This Privacy Policy explains how Campus AI collects, uses, and protects your personal information when you use our AI-powered study platform.
Information We Collect
We collect information you provide directly to us, including your name, email address, institution, role (student, academic staff, or administrator), and unit enrolments when you create or access an account. We also collect data generated through your use of the platform, including AI chat interactions, quiz responses, draft submissions, flashcard reviews, simulation attempts, and usage analytics. This data is necessary to provide, maintain, and improve our AI learning services.
How We Use Your Information
Your information is used to provide and personalise AI-powered learning support; to generate formative feedback on drafts; to recommend study materials; to communicate platform updates and relevant educational content; to ensure platform security and prevent abuse; and to generate anonymised usage analytics for institutional reporting. We do not use personal data for advertising, profiling, or any purpose beyond the operation and improvement of the platform. Aggregated, de-identified data may be used for research and product development.
AI & Data Processing
Campus AI uses large language models (currently Google Gemini 2.5 Flash) to process your questions, draft submissions, and study materials. Prompts and context are sent to the AI model solely to generate a response and are not retained by the model provider for training. We do not use customer data — including prompts, outputs, or uploaded content — for model training, fine-tuning, or service improvement. This is contractually guaranteed with our AI provider. Conversation data is stored within Campus AI's AU-hosted infrastructure for audit and continuity purposes and is retained per your institution's data retention policy.
Data Classification & Handling
Campus AI supports multiple data sensitivity classifications. Account information and learning interactions are treated as internal or confidential data by default. Institutions can configure handling rules for different interaction types. The platform is designed for teaching and learning data (typically classified as Internal or Confidential in university frameworks). It is not intended for handling classified government data or highly sensitive personal information without additional controls, which can be configured in partnership with your institution's IT security team.
Data Sharing & Disclosure
We do not sell personal information. We may share data with trusted service providers who enable platform operation — including cloud hosting providers (AWS via Supabase, Vercel), AI inference providers (Google Cloud Vertex AI), and authentication providers (Clerk) — all under strict data processing agreements that prohibit use of data for any purpose other than providing the contracted service. We may disclose information if required by law (including under the Privacy Act 1988 and the Right to Information Act 2009) or to protect our rights and the safety of our users.
Data Retention
Account information is retained for the duration of your account's active status. Upon account deactivation or institutional contract termination, personal data is deleted within 30 days, subject to institutional record-keeping requirements (typically 7 years for student academic records under the Public Records Act). AI chat logs and draft submissions are retained for the duration of the student's enrolment plus 12 months, unless a shorter period is configured by the institution. Anonymised usage analytics may be retained indefinitely. Audit logs are retained for 7 years to meet university record-keeping obligations.
Your Rights
Under the Privacy Act 1988 (Cth) and applicable state legislation, you have the right to access, correct, or delete your personal data. Current students can manage their data through account settings. Alumni and former staff may request data access or deletion by contacting their institution's privacy officer or our privacy team directly. Data export (full account archive) is available on request. We will respond to all data subject requests within 30 days.
Security
We implement industry-standard security controls including encryption at rest (AES-256) and in transit (TLS 1.3), role-based access controls, audit logging, and regular security reviews. However, no online service is 100% secure. Institutions are responsible for managing their own user access and should ensure students and staff use strong authentication methods. Our full security controls, including encryption, guardrails, audit logging, and compliance roadmap, are documented on our Security Overview page.
Changes to This Policy
We may update this Privacy Policy as our platform and regulatory obligations evolve. We will notify institutions of material changes at least 30 days in advance via email and the platform admin dashboard. Continued use after changes take effect constitutes acceptance of the updated policy. This policy was last updated on July 1, 2026.
Contact Us
For questions about this policy, data residency, or our data practices, please contact our privacy team at privacy@campusai.edu.au. Institutions may also direct inquiries to their dedicated account manager. QUT-specific privacy inquiries can be directed to QUT's Privacy Office.