Nurture Signal Privacy Policy

This Privacy Policy explains how Nurture Technology Ltd (“Nurture”, “we”, “our”, or “us”) collects, holds, uses and discloses personal information in connection with Nurture Signal, and how individuals may request access to or correction of their personal information or make a complaint.

This Privacy Policy is intended to align with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and to reflect our broader data protection obligations under applicable law.

1. Scope and nature of Nurture Signal

This Privacy Policy applies specifically to Nurture Signal, a standalone platform operated by Nurture Technology Ltd.

Nurture Signal is designed to support structured participation, engagement and feedback in school and organisational settings. It is intentionally designed to process only limited, low-risk personal information.

Where an organisation enables curriculum grounding, hosts may additionally upload teaching material — such as a syllabus, unit plan or lesson resource — so that AI-assisted content generation stays within that material. Curriculum documents are teaching material supplied by a host, not information about participants, and hosts are asked not to upload documents containing personal information. Section 3.5 describes how they are handled.

This Privacy Policy does not apply to:

other Nurture products or services;
the general Nurture marketing website, except where expressly stated; or
third-party products, websites or services linked to from Nurture Signal.

Nurture Signal is a standalone platform. It is not a learning management system or a student records system, and it is not currently available as a Microsoft Teams application. A school may also choose to launch Nurture Signal from inside Canvas through an optional integration that the school’s own Canvas administrator installs; section 3.6 describes the information involved.

2. Roles in schools and organisations

Where a school, education authority, or other organisation uses Nurture Signal, that organisation will generally determine:

which users may access the platform;
the purpose for which the platform is used; and
what information is submitted to or generated through the platform.

In those circumstances, the relevant school or organisation typically acts as the controller of personal information, and Nurture Technology Ltd acts as a processor or service provider on its behalf.

Where we collect personal information directly for our own business operations, such as support, security, service administration or legal compliance, we may act as a controller in our own right.

3. Personal information we collect and hold

Nurture Signal is designed on a data minimisation basis. We only collect and hold the limited personal information necessary to operate the platform.

We may collect and hold the following categories of personal information:

3.1 Account information

name;
email address; and
organisation or school affiliation, where applicable.

3.2 Session activity

responses to questions, polls and other activities, including written answers;
reactions;
comments;
timestamps; and
other basic interaction data generated through participation in sessions.

3.3 Technical and operational information

authentication events;
browser and device metadata;
IP address and network information;
platform logs;
security events; and
usage information necessary to maintain, secure and improve the platform.

3.4 Support and communications

information provided when contacting us for support or with other enquiries; and
records of communications with us.

3.5 Curriculum documents, where curriculum grounding is enabled

Where an organisation enables curriculum grounding, a host may attach documents to a group. Only a host may upload, view or delete them; participants cannot access them, and they are not part of the participant experience.

Supported formats are documents, spreadsheets, presentations, plain text and images (PDF, Word, PowerPoint, Excel, OpenDocument, Markdown, CSV, text, JPEG and PNG). We do not accept audio or video.

For each attached document we hold:

the uploaded file itself;
a duplicate copy in a private storage container used only for indexing;
for Office formats, a converted PDF used to display the document in the platform;
machine-generated passages of the document’s text together with their numerical representations (embeddings), used to find relevant material;
file name, file type, size, upload time and processing status; and
a record of each AI generation, which includes the prompt sent to the provider and therefore a copy of whichever passages were used for it. These records exist so we can investigate and account for AI usage, and are retained under section 13 like other operational records.

Document text is processed by our AI service providers, and relevant passages are included in prompts sent to an AI provider, as described in section 8. Uploaded documents are used only to ground content generated for the group they were attached to. They are not shared with other organisations or accounts, and we do not use them to train AI models — see section 8 for the position on our providers.

Curriculum documents are intended for teaching material. Hosts should not upload documents containing personal information, including student submissions, coursework, assessment records or anything containing special category or sensitive information. Where a host does so, that information is processed as part of the document under this Privacy Policy, and the organisation remains responsible for its lawful basis for doing so.

3.6 Canvas, where a school installs the integration

Where a school’s Canvas administrator installs the Nurture Signal integration (an LTI 1.3 tool), we also collect and hold:

from what Canvas sends when a user opens Nurture Signal: the Canvas user, course and assignment identifiers, the user’s name and email address, and their course role, which we use to treat them as a teacher or a student. Depending on the school’s Canvas settings, Canvas may also send details such as an SIS ID or profile picture; we do not keep them;
the course membership of each person who opens Nurture Signal from a course. The installation grants read-only access to the Canvas course roster, but we do not currently read it, so we do not collect the full course roster; and
the score for the Nurture Signal assignment, which we write back to the Canvas gradebook.

Where the school also issues a Canvas API token (this is optional; without one, assignments are created through the standard LTI flow), the integration uses it to create and manage Nurture Signal’s own assignments in those courses. The token is issued from a dedicated Canvas account and stored encrypted. With it, Nurture Signal reads a course’s assignment list to find its own assignments and which students they are assigned to. It does not read the school’s gradebook or change any other assignment. The school can review, restrict or remove the integration in Canvas at any time.

4. Information we do not seek to collect

Nurture Signal is not intended to collect or process high-risk or unnecessary categories of data.

In particular, we do not intentionally collect or store through Nurture Signal:

academic grades or formal assessment records held in a school’s other systems. Where the Canvas integration is installed, Nurture Signal writes back only the score for its own assignment and does not read the gradebook (section 3.6);
student coursework, essays or assignments from a school’s other systems (the answers and comments participants give in a session are described in section 3.2);
audio or video uploads;
file uploads of any kind from participants — only a host may upload documents, and only the curriculum documents described in section 3.5;
special category or sensitive personal information; or
passwords, as Nurture Signal does not use password-based authentication.

Users and organisations should not use Nurture Signal to submit or store sensitive personal information unless expressly agreed by us in writing.

5. How we collect personal information

We may collect personal information:

directly from users when they sign in to or use Nurture Signal;
from schools, education authorities or other organisations that provision or authorise user access;
through authentication providers where users sign in using secure Single Sign-On, such as Microsoft or Google;
from Canvas, where a school has installed the Nurture Signal integration (section 3.6); and
automatically through the operation, security and use of the platform.

Apart from the optional Canvas integration described in section 3.6, we do not collect information from learning management systems for Nurture Signal.

6. Why we collect, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

to provide, operate and maintain Nurture Signal;
to authenticate users and manage access to the platform;
to enable participation in sessions and display session interactions;
to provide AI-assisted content generation for hosts, and, where curriculum grounding is enabled, to store, index and retrieve a host’s curriculum documents so that generated content stays within that material;
to provide customer support and respond to enquiries;
to monitor usage, performance, reliability and security;
to detect, prevent and investigate misuse, fraud, or security incidents;
to comply with legal, regulatory and contractual obligations; and
to establish, exercise or defend legal claims.

We do not use personal information collected through Nurture Signal for advertising purposes.

7. Authentication and account security

Nurture Signal uses passwordless authentication. Users authenticate through:

one-time email login codes;
secure Single Sign-On through Microsoft or Google, where enabled; or
a verified launch from Canvas, where a school has installed the Nurture Signal integration (section 3.6). Canvas signs each launch, and we accept it only once and only for a short time.

We do not store user passwords because Nurture Signal does not use password-based login.

8. AI and automated processing

Nurture Signal includes AI-assisted features. Most assist a host in drafting session content, explaining quiz answers, and summarising how a session went. Two others assess a participant’s answer: written answers may be marked against the criteria a host set, and answers may be flagged as likely guesses or low effort.

Those two produce an assessment of an individual, and we say so rather than claiming none is made. They are aids to a host, who sees the result and remains responsible for it; no automated decision producing legal or similarly significant effects is made about any user.

To provide these features we send the following to an AI provider:

session and question text written by the host;
when a participant submits an answer, that answer — and, for guess checking, their reasoning, the question and its options, and what they selected. This happens automatically on submission, not at a host’s request;
when a host requests a summary or explanation, the relevant participant responses, comments and reactions for that session or question; and
where curriculum grounding is enabled, short passages from the host’s uploaded curriculum documents that relate to what is being generated.

We do not send account names or email addresses to the AI provider as part of these features.

Separately, a host may choose to connect their own AI agent to Nurture Signal. Where a host does so, that agent reads the session data available to that host — which, unless redaction is enabled, includes participant names and email addresses — and sends it to whichever AI client the host has connected. A host can enable pseudonymous redaction of names and email addresses on the Connect AI agent page, and an organisation administrator can require it for every host at that organisation. Redaction replaces identity fields; it cannot remove personal information a participant has written into free text such as a comment.

Personal information collected through Nurture Signal is not used by us to train AI models. We select AI providers on terms intended to prevent them using customer content to train their models.

The AI provider depends on how the platform is deployed. Our hosted service uses a managed AI gateway; an organisation running Nurture Signal in its own environment may direct generation to its own provider, in which case that organisation’s arrangements apply. Curriculum documents are processed by Microsoft Azure services as described in section 10.

We will update this Privacy Policy and related product documentation if the scope of AI-assisted processing materially changes.

9. Disclosure of personal information

We may disclose personal information to:

the relevant school, education authority or organisation using Nurture Signal;
authorised users within that organisation, where disclosure is part of the platform’s intended functionality;
our service providers and subprocessors who assist us with hosting, authentication, infrastructure, support, monitoring, communications, and security;
our professional advisers, including legal, audit and insurance advisers; and
regulators, law enforcement bodies, courts, tribunals or other third parties where required or authorised by law.

We limit disclosures to what is reasonably necessary for the relevant purpose.

10. Service providers and infrastructure

Nurture Signal runs on Microsoft Azure. Data is always stored in Azure, in the region of the deployment that serves the organisation. For some cloud deployments the application itself runs on Vercel. Vercel does not store account records, session content or responses; on those deployments it also provides web analytics, recording page views (the page visited, referrer, browser, device type and country) without cookies or an account identifier. An organisation can also run Nurture Signal entirely in its own Azure tenancy.

Where curriculum grounding is enabled, uploaded documents are also processed and stored using Microsoft Azure services — private blob storage, Azure AI Search, and Azure AI services used to read text from documents and images and to generate the embeddings that make passages searchable. These services process the document on our instructions, within our own cloud resources, as described in section 8.

We use service providers to support delivery of the platform, including for:

hosting and infrastructure;
authentication;
document storage, text extraction and search indexing, where curriculum grounding is enabled;
AI-assisted content generation, as described in section 8;
monitoring and logging;
email delivery; and
support and administration.

Where service providers process personal information on our behalf, we require them to do so subject to appropriate security and confidentiality obligations.

11. Overseas disclosure, storage and access

Nurture Signal has separate deployments in several regions, including Australia, the European Union and the United States. Each organisation’s data is stored in Microsoft Azure in the region of its deployment, or in the organisation’s own Azure tenancy, including uploaded curriculum documents and the passages derived from them. A user who starts on another region’s deployment is sent to their own deployment before signing in, and sign-in completes there.

Some processing takes place outside that region:

where a user signs in with a one-time code, their email address and the code are sent through our email delivery provider;
where a user signs in with Microsoft or Google, that provider processes the sign-in;
error tracking is handled by operational tooling configured to exclude names, email addresses and session content, with session recordings masked;
where product analytics is enabled, usage activity is recorded against a pseudonymous account identifier, never a name or email address;
where the organisation allows it, users can retrieve data they can already see through tools they choose to connect, such as an AI assistant; and
where a cloud deployment’s application runs on Vercel, requests pass through it in transit, and its web analytics records page views as described in section 10.

Authorised Nurture personnel or service providers located outside Australia may access personal information where reasonably necessary for limited purposes such as:

technical support;
monitoring, debugging and maintenance;
service administration;
security monitoring;
incident response;
reporting; and
legal or compliance review.

We take reasonable steps to ensure personal information is not transferred to jurisdictions with known privacy or regulatory risks without appropriate safeguards.

12. Data security

We take reasonable technical and organisational measures to protect personal information against misuse, interference, loss, and unauthorised access, modification or disclosure.

These measures include:

encryption in transit using HTTPS with TLS 1.3;
encryption at rest using AES-256 through our infrastructure providers;
passwordless authentication and secure Single Sign-On options;
access controls based on least-privilege principles;
logging, monitoring and security review processes; and
use of infrastructure providers with recognised security certifications, including SOC 2 Type II and ISO 27001 aligned environments.

No method of transmission or storage is completely secure. While we take reasonable steps to protect personal information, we cannot guarantee absolute security.

13. Data retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the platform and meet legal, operational, security and compliance requirements.

In general:

account information is retained while the relevant account or organisation relationship remains active;
session activity is retained for as long as required to provide the service and support legitimate operational needs;
technical logs may be retained for security, diagnostic and audit purposes for a limited period; and
curriculum documents are retained while attached to a group, subject to the paragraph below.

Deleting a curriculum document. When a host deletes a curriculum document, or deletes the group it belongs to, the document immediately stops being visible in the platform and stops being used to ground any AI-assisted generation. The underlying copies described in section 3.5 — the uploaded file, the indexing copy, any converted preview, and the derived passages — are retained so that we can investigate processing problems, and are not erased by that action. Deletion in the platform is therefore immediate in effect but is not an erasure. Erasure of the underlying copies is handled as a deletion request under the paragraph below.

Where a verified deletion request is received from an authorised organisation administrator, or where we otherwise determine data is no longer required, we will delete or de-identify relevant personal information within a reasonable period, and ordinarily within 30 days, except where retention is required or permitted for legal, security, backup, audit or dispute-resolution purposes.

Nurture Signal is designed to process only limited personal information relating to student users, namely:

name;
email address;
session interactions such as responses, reactions, comments and timestamps; and
where the Canvas integration is installed, the Canvas details described in section 3.6.

Schools, education authorities and other organisations using Nurture Signal are responsible for:

determining whether the platform is appropriate for their use case;
ensuring they have a lawful basis to disclose personal information to us and use the platform;
obtaining any parental or guardian consent required under applicable law or internal policy; and
where curriculum grounding is enabled, ensuring their hosts upload only teaching material and do not upload student submissions, coursework, assessment records or other personal information as curriculum documents.

15. Access and correction

Individuals may request access to, or correction of, personal information we hold about them by contacting us using the details below.

Where the relevant school or organisation controls the workspace or relationship, we may:

direct the request to that organisation; or
require the request to be made through an authorised administrator.

We may need to verify identity before actioning a request.

16. Complaints

If you have a complaint about how we handle personal information, please contact us at:

Email: support@gonurture.com Attention: Privacy

Please provide sufficient detail so that we can investigate the matter.

We will review the complaint and respond within a reasonable time. If you are not satisfied with our response, you may be entitled to make a complaint to the Office of the Australian Information Commissioner (OAIC).

17. Data breaches

We maintain an incident response process for suspected and confirmed data security incidents.

Where applicable, and where a data breach is likely to result in serious harm, we will comply with our obligations under the Notifiable Data Breaches scheme and other applicable laws, including notifying affected individuals and regulators where required.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, technology, our services, or our information-handling practices.

Any updated version will be made available through the relevant Nurture channel or website and will take effect from the revised effective date.

19. Contacting us

Nurture Technology Ltd Email: support@gonurture.com