Privacy Policy

For VCE Practice (practice.yochen.com.au) · Effective 13 July 2026 · Last updated 15 August 2026

This policy explains how Yochen Pty Ltd(“we”, “us”, “our”), an Australian company (ABN 71 696 997 994), handles personal information in VCE Practice, our online study service for VCE students. It is specific to VCE Practice and, for this product, replaces the general “we collect no data” statement on yochen.com.au/privacy. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

VCE Practice is for students aged 15 and over (typically Years 11–12). A student can create their own account and practise the free sample — the first few questions in each subject. A parent or guardian is always the account holder and payer for a paid subscription, and students never enter payment details. If you are under 15, please ask a parent or guardian to contact us before signing up.

What we collect

Account details. When you sign in with Google, we receive your name and email address from your Google account. We use this as your identity in VCE Practice. We do not receive your Google password.
Role and status. Whether an account is a student, parent, or administrator, and whether it is pending, approved, or suspended.
Parent–student links. The email a parent uses to invite a student, and the resulting link between a parent account and their student account(s). We use that address to send one invitation email, telling the student that a parent has added them and to sign in with it. It names the parent only by the display name on their account, asks for no personal information, and contains no password or code.
Learning activity. Questions attempted, answers submitted, correctness, per-skill mastery estimates, weekly plans, and the amount of active time spent in the app.
Questions opened. Which questions an account has opened, and when it first opened each one. We keep this for two reasons: it is how we apply fair-use limits, and it is how we detect an account being used to copy the question bank in bulk (our terms prohibit that). It is not used to profile you or to advertise.
AI tutor conversations. The messages you send to, and receive from, the AI tutor.
Payment information. Subscriptions are processed by Stripe. Stripe collects and stores the parent’s payment details; we do not receive or store full card numbers. We keep a record of subscription status and billing history.
Technical logs. Standard server and security logs (such as IP address and request details) processed by our hosting providers to deliver and protect the service.

Why we collect it

We use this information to provide and improve VCE Practice: to authenticate you, run the approval process, track mastery and build personalised study plans, operate the AI tutor, enforce fair-use limits, take payment, send a parent the weekly progress summary for their linked student(s), email a student the invitation when a parent adds them, provide support, keep the service secure, and meet our legal obligations. A parent can turn the weekly email off at any time — from a link in the email or from the parent dashboard — and still see the same progress on the dashboard. We do not sell your personal information, and we do not use it for third-party advertising.

Young people, consent, and parents

VCE Practice is intended for VCE students, typically Years 11–12 and aged 15–18. Consistent with the OAIC’s Australian Privacy Principles guidelines, where it is not practicable to assess capacity individually we presume a person aged 15 or over has the capacity to consent to us collecting and handling their own personal information. So a student aged 15 or over can create an account themselves and consent to the collection described in this policy. We tell them what we collect at the point they sign in.

Paying is different. A parent or guardian must hold the paying account and add their student, so a paid subscription always involves a parent or guardian. Students never enter payment details.

Under 15. VCE Practice is not intended for people under 15. If you are under 15, ask a parent or guardian to contact us before signing up. If we become aware that we hold the personal information of someone under 15 without appropriate consent, we will delete it.

A parent or guardian may request access to, correction of, or deletion of their linked student’s information at any time by contacting us. A student may make the same requests about their own information.

Cookies and tracking

We use no tracking pixels and no advertising, and we do not profile you. There is no Google Analytics and no Meta Pixel on this service.

We do measure aggregate page views — how many people visit each page — using Vercel Web Analytics, so we can see which parts of the service are useful. It is cookieless: it sets no cookie, does not follow you across other websites, and does not build a profile of you or link page views to your account. Because it uses no tracking cookies and collects no personal profile, there is nothing here for you to consent to and no consent banner.

How you found us. If you arrive from an ad or a link that carries campaign tags (for example utm_source), or from another website, we record that first-touch source in a first-party cookie and — only if you go on to create an account — store it with your account. This lets us understand which channels bring students to the service. It is a plain label (such as a campaign name or the website you came from); it is first-party, is never shared or sold, and is not used to track you across other websites.

The first-party cookies we set are:

Sign-in session. When you sign in, we set a secure, HTTP-only session cookie so the service knows it is you on each request. Without it you cannot stay signed in.
Language.A functional cookie that remembers the language you choose. It stores a language code (for example “en”) and nothing that identifies you.
How you found us. If your visit carries a campaign tag or an external referrer, a cookie records that first-touch source (as described above) so it can be attached to your account if you sign up. It is not required to use the service.

Fonts are self-hosted, so the service does not call out to Google Fonts or any third-party CDN as you use it. We do not sell your personal information and we do not use it for third-party advertising.

Who we share it with (our processors)

We use trusted third parties to run the service. They process personal information only on our behalf and only as needed:

Google — sign-in (authentication) and our email.
OpenAI— powers the AI tutor. The content of your tutor messages is sent to OpenAI to generate replies. Under OpenAI’s API terms, this data is not used to train their models.
Neon — database hosting (stores your account and learning data).
Stripe — payment processing.
Resend— sends the emails we send you: the parent’s weekly progress summary, account emails, and the invitation sent to a student a parent adds. Resend receives the recipient’s email address and the contents of that email.
Vercel and Cloudflare — application hosting, delivery, and security. Vercel also provides the cookieless, aggregate page-view analytics described above.

We may also disclose information if required by law, or to protect our rights, users, or the security of the service.

Overseas processing

Some of these providers store or process data outside Australia, including in the United States. By using VCE Practice you acknowledge that your information may be processed overseas. We take reasonable steps to use providers that maintain appropriate security and privacy standards.

How long we keep it

We keep personal information for as long as the account is active and as needed to provide the service, then for any period required to meet legal, tax, or accounting obligations. You can ask us to delete an account and its associated learning data; we will do so unless we are required to retain some records by law (for example, billing records).

Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access — including access controls, encryption in transit, and reputable infrastructure providers. No online service can be completely secure, but we work to protect your information and to respond promptly to any issue.

Your rights

Under the Australian Privacy Principles you may request access to the personal information we hold about you (or, as a parent, about your linked student), ask us to correct it, or ask us to delete it. Email us and we will respond within a reasonable time. If you are concerned about how we have handled your information, you can contact us first and, if still unsatisfied, complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

If we change this policy we will update the “Last updated” date above and post the new version at this URL. We will notify account holders of material changes before they take effect.

Contact

Questions, requests, or privacy concerns? Email support@yochen.com.au.

Yochen Pty Ltd · ABN 71 696 997 994 · Australia · Terms of Service