Privacy policy

Who we are

mandumagpi is a sole trader providing maths tutoring and worksheets, based in Sydney, New South Wales, Australia. ABN 79 567 010 980.

You can reach us about anything on this page at mandumagpi@gmail.com.

A business our size is often exempt from the Privacy Act. We have written this policy as though it applies to us anyway. The statutory tort of serious invasion of privacy applies regardless of that exemption, the rules for children's data are tightening, and we would rather not rebuild everything the year they do.

What we collect, and why

We collect the least we can get away with, and each item below exists because something would not work without it.

• Student name, email address, year level and course — to make an account and know which worksheets are relevant.
• Date of birth — solely to work out whether a student is under 15 and therefore needs a parent or guardian to agree to the account. We do not use it for anything else.
• Parent or guardian name and email — only when the student is under 15, so we can ask you to agree, and so lesson arrangements go to you rather than to the student.
• Lesson enquiries — the student's name, your contact details, year, course, preferred format and times, and whatever you tell us in the free-text boxes.
• Consent records — if you agree to a child's account, we keep the exact wording you were shown, and the date. Not just a tick.
• Your IP address — held briefly to count requests, so that one script cannot flood a form or guess passwords.
• A session cookie, so you stay signed in.

What we do not do

• We do not sell personal information to anyone, ever.
• We do not show advertising, and we do not let anyone else advertise to you here.
• We do not run analytics or tracking on this site. If that changes, this policy will say so before it happens.
• We do not use anything a student types to train an AI model.
• There is no messaging between a tutor and a student on this site. Anything about lessons goes to the parent or guardian's email address.

Students under 15, and parental consent

Australian privacy guidance treats a person aged 15 or over as able to decide about their own information, and someone under 15 as presumed not to be. We use 15 as the line.

If a student is 15 or over, they can create an account themselves.

If a student is under 15, the account does nothing at all until a parent or guardian agrees. We email the address the student gives us, show that person exactly what they would be agreeing to, and keep a copy of that wording with their answer.

• The agreement can be withdrawn at any time. Withdrawing switches the account off — it does not quietly carry on.
• We tell the student that a parent or guardian agreed on their behalf, and when. They can see it on their account page.
• A parent who has been invited but has not yet agreed can see nothing about the student. The invitation on its own grants nothing.
• An invitation link expires after 14 days.

If you did not expect an invitation from us, you do not have to do anything. Ignore it and it expires, the account never switches on, and we will not email you about it again. If you would like us to delete what we hold, say so and we will.

Who can see what

The database enforces this, not just the screens. Each rule below is a policy in the database itself, and is tested — a student signed in as themselves cannot retrieve another student's row even by asking the database directly.

• A student sees their own information and nobody else's.
• A parent or guardian sees the students linked to them, once that link is verified, and nothing about any other family.
• A tutor sees the students they teach and the enquiries that come in.
• Nobody who is signed out can read anything about a person.

Where your information is stored, and who else touches it

We use other companies to run this site. They are listed here because you are entitled to know who holds your information, and because several of them are based overseas even when the data itself stays in Australia.

• Supabase — the database and sign-in. Data is stored in Sydney (ap-southeast-2). Supabase is a United States company and its staff can access systems that hold the data.
• Vercel — runs the website. Configured to the Sydney (syd1) region. Vercel is a United States company.
• Cloudflare — domain, security, and the check that confirms you are a person rather than a script. Cloudflare is a United States company with a worldwide network, and a request may pass through equipment outside Australia.
• Upstash — counts requests for the limits described above, which means it briefly holds IP addresses or account identifiers. Hosted in the Asia-Pacific region.
• Resend — sends our email. A United States company, and our sending region is Tokyo, Japan, so an email we send you passes through both.
• Sentry — tells us when the site breaks. It receives a technical description of the failure: what went wrong, which page it happened on, and what the browser was doing beforehand. We have turned off the settings that would send your IP address, your headers or a recording of your screen, and we remove invitation links, sign-in tokens and email addresses before anything is sent. A United States company.

This means some of your information is disclosed to recipients outside Australia. We chose Australian hosting regions where the option exists, which is why the database and the website run in Sydney rather than the cheaper default in the United States.

How long we keep it

• Account information: while the account is open, and for 12 months after it is closed, so a student returning after a year does not lose their history. Ask us and we will delete it sooner.
• Consent records: 7 years. These are the record of a decision made about a child, and they are the first thing anyone would ask us to produce.
• Lesson enquiries that do not become customers: 12 months.
• Rate-limit counters: minutes to hours. They expire on their own.

Keeping it safe

What we actually do, rather than a claim that we take security seriously:

• Every table denies access by default. Permission is granted narrowly and deliberately, and there are 35 automated tests whose job is to confirm the wrong person is refused.
• Passwords are stored hashed by our sign-in provider. We never see them.
• Traffic is encrypted in transit, and worksheets are served through short-lived links after checking you are entitled to them, not from a public folder.
• Sign-in, sign-up and password reset are rate limited, so guessing passwords in bulk does not work.
• We designed out the biggest risk rather than managing it: there is no private channel between an adult and a child on this site.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If we ever have a breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner.

Seeing, correcting or deleting your information

Email mandumagpi@gmail.com and ask. We will reply within 30 days, and usually much sooner.

You can ask for a copy of what we hold about you, ask us to fix something wrong, or ask us to delete it. A parent or guardian can ask on behalf of a child they are linked to. A student aged 15 or over can ask for themselves.

If we cannot do what you ask — which is rare, and usually means a record we are required to keep — we will tell you why in writing.

Complaints

If you think we have mishandled your information, tell us first at mandumagpi@gmail.com. We will acknowledge it within 5 business days and respond properly within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or on 1300 363 992. You do not need our permission and you do not need to go through us first.

Changes to this policy

If we change it, we will change the date at the top. If the change matters — new information collected, a new company holding it — we will email account holders rather than relying on you to notice.

Agreements already given to a child's account stay attached to the wording that was shown at the time. A change here does not rewrite what you agreed to.