Privacy
Sprout OS privacy policy.
How the Sprout OS platform and the Work Placements app handle personal information for the schools that use them. Version 2.0, effective 7 October 2026. Next review due October 2027.
1. Who we are
The business behind the apps.
Sprout OS is a registered business name of Salesian College Sunbury (ABN 51 645 098 602), 1 Macedon Street, Sunbury VIC 3429 (“Sprout OS”, “we”, “us”).
Sprout OS provides online software to Australian schools, including the Sprout OS platform (app.sproutos.com.au) and the Work Placements app (workplacements.sproutos.com.au). This policy explains how we handle personal information in those services, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Our marketing website has its own, shorter website privacy policy. There is a plain-language version for students in section 15.
2. Our role
We act for your school.
When a school uses Sprout OS, the school decides whose information goes into the service and what it is used for. We handle that information on the school’s behalf, under our agreement with the school, and only to provide the service. We do not use school data for our own purposes.
If you are a student, parent or staff member, your school’s own privacy policy also applies, and your school is usually the best first contact for questions about your information.
We are responsible in our own right for information we collect to run our business, such as billing contacts and support emails.
3. What we collect
Information we collect.
What we hold depends on which apps a school uses and what the school and its users enter.
Students
- Name, school email, student number, year level and home group.
- Date of birth, phone, home address and postcode, where the school or student enters them.
- Placement details: employer, dates, work address, attendance, forms, signatures, the student’s own evaluation, and the employer’s evaluation of the student.
- Emergency contact details.
- Health and accessibility information (for example medical conditions and allergies) where entered for a placement. This is sensitive information (see section 4).
- Certificates the school records, such as an OHS induction or white card.
Parents and guardians
- Name, email, phone and relationship to the student.
- Consents and signatures for a placement, including any travel or overnight accommodation consent.
Employers and host supervisors
- Business name, contact and supervisor names, emails, phones and business address.
- Working With Children Check number, expiry and verification status.
- Signatures, attendance records and evaluations they enter.
School staff
- Name, school email and role.
Everyone who signs in
- Sign-in records, and an audit log of actions taken in the service, which can include IP address and browser details.
We do not collect government identifiers such as Medicare, tax file or passport numbers, and we never use a government identifier as our own identifier for a person.
4. Sensitive information
Health information.
Health and accessibility information is entered only so a student can be placed safely. It is shown to an approved employer only where the student and a parent or guardian have given permission, and only what that placement needs. Employers see it only by signing in to the platform.
5. How we collect it
Where the information comes from.
- From the school, for example a student list the school uploads.
- From users who enter it themselves: students, parents, employers and staff.
- Automatically, when someone signs in or uses the service (sign-in and audit records).
You can contact us without identifying yourself, for example to ask a general question. Using the service itself requires an identified account, because schools need to know who is placed where and keep students safe.
6. Why we use it
What we use it for, and what we never do.
- To provide the services the school has chosen, such as arranging and managing work placements.
- To sign people in and keep each school’s information separate and secure.
- To send service emails, such as sign-in links, signature requests and placement reminders.
- To give support, investigate problems and keep audit records.
- To meet our legal obligations.
We do not:
- sell personal information;
- use it for advertising, marketing to students, or profiling;
- use it to train artificial-intelligence models. The Work Placements app has no AI features;
- sell, publish or share de-identified or aggregated data derived from school data. We may count things like the number of placements to run and plan the service, but those figures stay with us and with the school.
If we ever add an AI feature, it will be off by default, the school will choose whether to turn it on, and we will update this policy first.
If information is not provided, some features may not work. For example, a placement cannot be approved without the required consents.
8. Service providers
Service providers and overseas disclosure.
| Provider | What it does | Information involved | Student data? | Location |
|---|---|---|---|---|
| Supabase (on Amazon Web Services) | Database, file storage and sign-in | All service data | Yes | Sydney, Australia |
| Vercel | Runs the applications | Data passes through while a page is used | Yes, in transit | Sydney, Australia |
| Resend | Sends service emails | Recipient name and email, and the email's content | Yes (names, emails and placement details) | United States |
| Sentry | Error reporting | Technical error details, which may include the signed-in user's ID or email. Session recording is switched off | Possibly (user ID or email) | European Union |
| OpenStreetMap | Turns workplace addresses into map locations for coordinators | Employer business addresses only | No | United States / Europe |
| Stripe | Card payment of invoices, if the school chooses it | Billing contact and payment details | No | United States |
We will tell schools at least 30 days before we add or replace a provider that handles student data, so a school can raise concerns or object.
So some information may be handled in the United States and the European Union. Before we use an overseas provider we take reasonable steps, including contractual terms, to make sure it handles the information consistently with the APPs. All databases and file storage are in Australia.
9. Security
How it is protected.
- Information is encrypted in transit (HTTPS) and at rest.
- Each school’s information is kept separate by database rules that refuse access when a user’s school cannot be confirmed.
- Staff access is limited to what each role needs. Students and parents see only their own placements.
- Sign-in uses single-use, time-limited email links, rate limits and hashed passwords.
- Actions are recorded in an audit log.
- Backups are encrypted, stored in Sydney, and expire within 90 days.
Data breaches
No system is perfectly secure. If we become aware of a breach affecting a school’s information, we will:
- tell the school within 72 hours, whether or not the breach is likely to cause serious harm;
- say what happened, whose information is involved, the likely impact and what we are doing about it;
- contain the breach and assess it, and keep the school updated; and
- notify the Office of the Australian Information Commissioner (OAIC) and affected people where the Notifiable Data Breaches scheme requires, working with the school.
10. How long we keep it
Retention and deletion.
- We keep school data while the school uses the service.
- When the school’s agreement ends, the school can download an export for 30 days. We then delete the school’s data from the live service within a further 30 days, and it drops out of backups within 90 days after that. We confirm the deletion in writing on request.
- We delete it sooner if the school asks, and keep it longer only where the law requires.
- Billing records are kept for 7 years, as tax law requires.
12. Your rights
Access, correction and deletion.
You can ask to see, correct or delete personal information we hold about you. This is free.
- For information held for a school, we will usually work with the school, because the school controls that information. You can also ask your school directly.
- Students and their parents or guardians can ask us to delete a student’s information. We will do so unless the school or the law requires it to be kept, and we will explain why if we cannot.
We aim to respond within 30 days.
13. Complaints
If something is wrong.
Contact our Privacy Officer at hello@sproutos.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
14. Changes
Changes to this policy.
We review this policy at least once a year. We will tell schools about important changes at least 30 days before they take effect, and show the version and date at the top of the policy.
If Sprout OS changes hands: Sprout OS may move from Salesian College Sunbury to a separate company. If that, or any sale or transfer of the business, happens, we will tell schools at least 30 days beforehand. The new operator must keep to this policy, and a school can take its data and leave before the change.
15. For students
The short version, for students.
We handle children’s information in their best interests, in line with the Children’s Online Privacy Code being developed by the OAIC. We will follow the Code once it is registered.
- Your school uses Sprout OS to organise things like your work placement.
- We keep the information needed for that: your name, school details, placement, forms and contacts. If you or your parent add health information, an employer only sees the part they need to keep you safe, and only if you and your parent say yes.
- We never sell your information, show you ads, or use it to train AI.
- Your information is stored in Australia. A few helpers we use to send emails and fix errors are overseas.
- You can ask to see your information, fix it, or have it deleted. Ask your teacher or coordinator, or email hello@sproutos.com.au.
- If you’re worried about how your information is used, tell a teacher, your parent, or us.
16. Contact
Contact.
Privacy Officer, Sprout OS (Salesian College Sunbury)
1 Macedon Street, Sunbury VIC 3429
hello@sproutos.com.au