Privacy Policy

This policy explains how Visible Education (“Visible”, “we”, “us”) handles personal information when schools use Insight and Growth. It is written for New Zealand schools under the Privacy Act 2020. It is not legal advice.

Operational detail for Board and privacy-officer review (field schedules, AI processing boundary, retention clocks, and security measures) sits in each school’s MoU / data-assurance pack, not on this public page.

1. Who we are

Visible provides cloud software for secondary schools. Insight supports academic analytics for authorised staff. Growth supports teacher professional learning. The school remains the agency responsible for student and staff personal information; Visible processes that information to deliver the licensed service.

Privacy contact: privacy@visible.education

2. What we collect and why

Depending on the products a school licenses, we process personal information only for delivering that service. Typical categories:

• Insight: student and staff information needed for school analytics (for example identity, grouping, demographics, attendance, engagement, subjects, and achievement), supplied via the school’s SMS integration where licensed.
• Growth: teacher-authored professional growth content that staff choose to store in the product.
• Account & operations: sign-in identity and limited operational records needed to run, secure, and support the service.

We do not seek pastoral, medical, or learning-support case files through the school SMS integration. We collect only what is needed for the agreed purpose. Senior leaders on each school’s Visible site can open a school-specific “What we hold” summary; the signed MoU carries the full schedule.

3. How we use information

• To provide the Insight and Growth features the school has licensed.
• To secure, support, and operate the service.

We do not sell personal information, use it for advertising, or use identified school records to train public foundation models.

4. Where information is stored and processed

Core school data is hosted on Google Cloud in Australia. Sign-in and application delivery use Google services. AI features that are part of the licensed service use Google Vertex AI, which may process prompts outside Australia. Transactional email may use Google Workspace and/or another mail provider. See Subprocessors.

Overseas processing (including AI) requires school agreement under Privacy Act Principle 12. The MoU schedule sets out the AI processing boundary in full for Board review.

5. Who can access information

• Authorised school staff, for their own school only.
• Visible operators, only as needed to support, onboard, and secure the service.
• Subprocessors listed on the Subprocessors page, only to run the service.

6. Retention and deletion

We retain school personal information for the life of the school’s agreement. On confirmed offboarding we cut access promptly, delete school personal information from active systems within the timeframe in the MoU, and confirm in writing, except limited records we are legally required to keep, or anonymised operational metrics that cannot reasonably identify individuals.

7. Security

We take reasonable safeguards appropriate to the sensitivity of school information, including encryption in transit and at rest on our cloud platform, and school-scoped access controls. Google Cloud maintains certifications including ISO 27001 and SOC 2 for its infrastructure (see Google Cloud compliance). Visible Education is a customer of that platform and does not currently hold its own ISO 27001 or SOC 2 certification. Further security detail is in the school MoU.

Breach handling is summarised in our Incident response page.

8. Your rights and school requests

Individuals should usually contact their school first (the school is the agency). Schools may direct access, correction, or deletion requests to us at privacy@visible.education. We will cooperate as processor within the MoU / agreement.

9. Changes

We may update this page as the product evolves. Material changes affecting school data handling will be communicated to school contacts.