1. Who we are and what this policy covers
Letts Learn Pty Ltd (ABN 77 683 713 028) provides Handwriting Boost. In this policy, “we”, “us” and “our” mean Letts Learn Pty Ltd.
This policy explains how we collect, hold, use and disclose personal information through the Handwriting Boost public website, the app at app.handwritingboost.com, account-free lessons, workspaces, practice links and related support services.
It applies to parents and guardians, teachers, school representatives, other adult account holders, learners and website visitors. We manage personal information in accordance with applicable Australian privacy law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.
Our Terms and conditions explain use of the service. This policy explains our information handling; visiting the website does not amount to consent to unrelated uses of personal information.
2. Information we handle
- Adult account holders: email address, display name, authentication and security information, account type, setup choices, handwriting preferences and workspace membership.
- Activities and workspaces: workspace names, members, folders, activity titles, words, sentences, instructions, handwriting settings, practice levels and sharing choices entered by adults.
- Learners: an adult-chosen display name or nickname, class or group membership, assigned activities, and when an assignment is opened, started or marked as practised.
- Support and communications: contact details, messages and information supplied when you ask for help or make a privacy request.
- Technical information: browser and device details, IP address, request, authentication, delivery, error and security logs handled by us and our service providers.
“Practised” is a self-report. Handwriting Boost does not assess or store a child’s physical handwriting. Learners do not need an email address, password, date of birth or full legal name. Adults should use a first name or nickname and keep unnecessary personal or sensitive information out of learner names, activities and support messages.
During setup, the app may use the browser’s time zone to suggest a teaching state or territory. The suggestion can be changed. The app does not request precise device location or save the browser time zone to the account.
3. How we collect information
We collect information directly when an adult creates or uses an account, sets up a workspace, creates or shares an activity, manages learners, contacts support or makes a request. A parent, guardian, teacher or school representative may provide learner information. We also receive technical information when the website or app is used.
You can browse the public website and try the account-free lesson without identifying yourself to us. An adult email address and the fields identified in the app are required to create and operate an account. Where practical, you may make a general enquiry anonymously or using a pseudonym.
4. Adults, children and authority
Adults create and manage Handwriting Boost accounts and workspaces. Learners do not independently create accounts or enter into a contract with us.
A parent or guardian using Handwriting Boost at home is responsible for deciding that the service is suitable for their child and for providing any authority or consent required to add and use the child’s information. A teacher, school or other organisation is responsible for having authority to provide learner information and for any notices, permissions or consents required by law or its policies.
We use learner information only to provide, secure and support the requested practice service. We do not sell learner information, use it for advertising or commercial profiling, or send direct marketing to children.
For a learner record controlled through a school workspace, parents and learners should ordinarily contact the school first. For a home workspace, contact the parent or guardian who manages it, or contact our Privacy Officer using the details below.
5. Why we use and share information
We use information to provide accounts and workspaces, save and display handwriting activities, prepare printable materials, operate practice and learner links, record self-reported participation, provide support, protect the service, communicate material service information, improve reliability and meet legal obligations.
Adult members of a workspace can access that workspace’s activities and learner records according to their role. We share information with service providers needed to operate the service, people you authorise through your workspace and sharing choices, or authorities where required or permitted by law.
We do not use artificial intelligence to generate handwriting activities, assess a learner’s handwriting or make decisions about a learner. Handwriting models use prepared formation paths and licensed fonts.
We may use information that has been appropriately de-identified or aggregated to understand service reliability and improve the product. We assess whether a person could reasonably be identified before treating information as de-identified.
7. Service providers and processing locations
Supabase provides authentication, database and storage services. The production project’s primary database is in Supabase’s Sydney region. Netlify provides public website and app delivery. Microsoft 365 receives support mail. Amazon Simple Email Service (Amazon SES), configured in Sydney, delivers authentication messages.
These providers operate internationally. Website delivery, provider support, security, authentication and email delivery may involve processing outside Australia, including in the United States and other locations used by providers and recipients’ email services. We do not represent that every item of operational information remains in Australia merely because the primary database is in Sydney.
We limit provider access to the information and purpose needed for the service and use available contractual, access and security safeguards. Contact our Privacy Officer if you need current information relevant to a particular provider or request.
8. Browser storage and the public website
Adult sign-in information and some unfinished setup choices are kept in browser storage. Personal learner sessions are kept in the current tab for up to eight hours. The database stores hashes of learner link and session credentials rather than their raw values.
The public website has no account form, advertising or tracking analytics. Its help search and scroll-effects control run locally in the browser, and contact links open the visitor’s own email application.
You can clear browser storage in your browser settings. On a shared device, adults should sign out and learners should use “Switch student” when finished.
9. Keeping information secure
We use safeguards appropriate to the service and information, including encrypted connections, provider-managed encryption at rest, workspace and role-based access, restricted database permissions, hashed learner credentials, protected authentication flows and backups. No online service can guarantee absolute security.
If you suspect unauthorised access, disable or rotate an affected practice or learner link where available and contact us promptly. We investigate suspected incidents, take reasonable containment and remediation steps, and notify affected people or regulators where required by law.
10. Retention, backups and deletion
Account and workspace records remain in the live service while needed to provide an active account or workspace. We have not set an automatic deletion date for inactive accounts. Support correspondence and provider logs may be retained for support, security, dispute resolution or legal purposes under the applicable provider settings and record-keeping requirements.
Adults can download their account data. Workspace owners can download workspace information, including learner records. Adults can edit learner names and assignments. Deleting an activity removes its assignments, recorded participation and published share. Deleting a learner removes that learner’s assignments, participation and access. Deleting a workspace removes its activities, learners, assignments, participation and practice links from the live database.
An adult can delete their account after transferring or deleting any workspaces they own. Shared teaching material remains in a workspace when a member leaves or deletes their account.
The production database is backed up daily through Supabase Pro. Deleted information may remain in protected backup copies until those copies expire under the provider’s current backup schedule. A legal preservation requirement may require limited information to be retained longer. Deletion cannot recall copies already printed or downloaded by another person.
11. Accessing or correcting information
Adults can edit their display name in Settings, manage learner names, access and assignments in Students, and use Account and data to export or delete information. You may also contact our Privacy Officer to request access to personal information we hold about you, correct inaccurate or incomplete information, or discuss deletion.
We may need to verify your identity and authority over a workspace or learner before providing information or making changes. We consider requests under applicable privacy law and will explain any lawful reason we cannot fulfil a request. Please do not send passwords, learner access links, identity documents or sensitive learner records in an initial email.
12. Service communications and marketing
We send messages needed to authenticate accounts, protect the service, respond to requests and communicate material service information. We do not send direct marketing to learners.
If we introduce marketing to adult contacts, we will use appropriate consent and unsubscribe arrangements. Opting out of marketing will not prevent necessary authentication, security or service messages.
13. Privacy questions and complaints
Tell our Privacy Officer what happened and how you would like the matter resolved. We will acknowledge the complaint, investigate the relevant information handling, seek further details if needed and explain our response. We will tell you if we need more time.
If you are dissatisfied with our response and the Privacy Act applies, you may contact the Office of the Australian Information Commissioner (OAIC). You can also ask us for this policy in another accessible form.
14. Changes to this policy
We update this policy when our practices or legal requirements change and show the revision date above. We will notify affected account holders of material changes where practicable. Where a new use requires consent or another authorisation, updating this page alone does not provide it.
15. Contact our Privacy Officer
Handwriting Boost Privacy Officer
Letts Learn Pty Ltd
ABN 77 683 713 028
Queensland, Australia
support@handwritingboost.com
For general help, visit our contact page.