Privacy Policy

This Privacy Policy applies to all users of the ISMGenius platform, accessible at www.ismgenius.com and through our Android app. ISMGenius is operated by JJcoded ("we", "us", "our") in Queensland, Australia, and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For any privacy-related enquiries, you may contact us at support@ismgenius.com.

By accessing or using ISMGenius, you acknowledge that you have read and understood this Privacy Policy.

We collect the following categories of information:

• Account information: email address, authentication identifiers, your name (if provided by you or your sign-in provider), an optional profile photo, and your school or institution if you choose to set one.
• User content: assignment files, rubric documents, task sheets, pasted text, personal notes, AI-generated feedback history, and AI detection and plagiarism scan results.
• Payment information: billing details and subscription records processed through Stripe. We do not store your full credit card number.
• Usage data: device and browser type, IP address (kept only in short-lived security and operational logs), the pages you visit, interaction timestamps, upload counts, and roughly when you were last active. Our analytics records cover how the service is used, not what you write in it.
• Referral and campaign data: if you arrive through a referral, share, or campaign-tagged link, we record the basic campaign details of that link (such as the source, medium, campaign name, and referral code) so we can credit referrers and understand which campaigns work.
• Consent information: your cookie preference, the time it was recorded, the applicable consent-policy version, and whether you confirmed that you were 18 or older by selecting Accept all.
• Feedback you give us: ratings of AI feedback, survey responses (including optional year level and how you discovered us), and messages you send to our support team.

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies (such as your browser's local storage) to keep ISMGenius working, to keep your account secure, and — only if you agree — to understand how the site is used. With your consent, we use analytics and advertising technologies to measure campaign performance, understand how visitors interact with ISMGenius, create advertising audiences, and personalise ISMGenius ads you may see on Google services. We do not display third-party advertising within ISMGenius.

We use three categories of cookies:

• Strictly necessary cookies. These are required for the platform to work and cannot be switched off. They keep you signed in, protect against fraud and abuse, apply fair-use limits on free uploads, and remember your cookie choice so we do not ask you again on every page.
• Functional cookies. These remember choices you make so the service behaves the way you expect — for example your theme and accessibility preferences, and, if you arrive through a referral or share link, the details needed to credit the person who referred you. They are removed once they are no longer needed.
• Analytics cookies (optional). With your consent, we use our own analytics and Google Analytics 4 to measure visits across our marketing, pricing, and signed-in product pages, basic campaign attribution, and limited outcomes such as account creation, educator applications, checkout, and subscription payments. These cookies are only set after you accept them, and declining does not limit your access to any feature.
• Advertising cookies (optional). If you select Accept all, you confirm that you are 18 or older and consent to Google receiving limited website activity and campaign information for advertising measurement, audience creation, remarketing, and personalised ISMGenius advertising. These cookies are not required to use ISMGenius.

Google Analytics loads only after you accept analytics cookies. Google advertising features load only after you select Accept all. Google Analytics loads on our marketing, pricing, authentication, and signed-in product pages, so we can see how features such as feedback generation are used. It never loads on our internal admin tools or on password-reset and sign-in-callback links. It receives a query-free page path with identifiers such as project, class, and assignment codes replaced by a placeholder, plus the page title, a pseudonymous browser and session identifier, basic campaign information, and the limited event names and non-identifying parameters described above. For a paid subscription event, it also receives the currency, amount, plan type, and a transaction identifier used to prevent duplicate counting. We do not send Google Analytics your email, name, school, account ID, assignment or rubric content, feedback report, file name, auth token, or payment-card details. Analytics cookies generally last up to 12 months, and Google's own cookies may last up to 2 years. We also use privacy-friendly, cookieless measurement (Vercel Analytics and Axiom) to monitor traffic volumes, reliability, and performance.

Managing cookies. You can accept all optional cookies, accept analytics cookies only, or reject all optional cookies when you first visit. You can change your decision at any time using Cookie settings in the footer. Withdrawing your consent stops the affected analytics and advertising cookies from being used and deletes the cookies we are able to access. You can also delete or block cookies in your browser settings, and you can install the Google Analytics opt-out browser add-on. Blocking strictly necessary cookies will prevent sign-in and other core features from working.

We use the information we collect to:

• Provide, operate, and maintain the ISMGenius platform.
• Authenticate your identity and manage your account.
• Generate rubric-aligned feedback on your uploaded assignments.
• Perform AI content detection and plagiarism scanning on submitted text when you request a scan.
• Process payments and manage subscriptions.
• Detect and prevent fraud, abuse, and security incidents, including rate limiting.
• Attribute referrals and measure which campaigns and features work.
• Calculate product funnels, completion rates, retention cohorts, and experiment results from classified events, using aggregate reports for product decisions.
• Respond to support requests and communicate service updates.
• Send optional product update emails — only if you have opted in, and you can opt out at any time in Settings.
• Comply with legal obligations.

We do not sell your personal information. We do not use your uploaded assignment content for advertising purposes, and we do not use it to train our own or third parties' AI models.

Where required by applicable privacy law (for example, if you access the service from a jurisdiction such as the European Union), we process your personal information on the following legal bases:

• Contract performance: processing necessary to provide you with the ISMGenius service.
• Legitimate interests: keeping the service secure and reliable, preventing fraud and abuse, and understanding how the platform is used so we can improve it.
• Legal obligations: compliance with applicable laws and regulations.
• Consent: optional analytics cookies, optional advertising cookies and personalised advertising, and optional marketing emails. You can withdraw analytics and advertising consent at any time from Cookie settings in the footer, and email consent from Settings.

We share data with the following service providers, solely to operate the platform:

• Supabase — authentication, database hosting, and storage of uploaded files and profile photos.
• Google (Gemini API) — AI-powered feedback generation. Assignment, rubric, and task sheet content is sent to Google's Gemini API to generate feedback and is handled under Google's Gemini API terms of service, which govern whether Google may retain or use submissions to improve its services depending on the service tier.
• Google Analytics and Google Ads — optional website analytics, campaign attribution, conversion measurement, advertising audience creation, remarketing, and personalised ISMGenius advertising. Google receives only the limited website, device, campaign and event information described in Section 3. Advertising features are enabled only when you select Accept all.
• OpenAI (API) — AI-powered feedback generation when an OpenAI model is selected. Assignment, rubric, and task sheet content is sent through the OpenAI Responses API with response storage disabled. OpenAI's handling and retention controls are described in its API data controls documentation.
• OpenRouter — an alternate AI routing provider used only when an OpenRouter model is selected. Assignment, rubric, and task sheet content passes through OpenRouter to the selected model provider. Depending on the internal PDF setting, OpenRouter may first parse PDF content using its Cloudflare AI or Mistral OCR file-processing engine. ISMGenius requests only endpoints that deny data collection and enforce zero data retention; OpenRouter still records non-content request metadata such as token counts, latency, and cost. OpenRouter explains these controls and the separate policies of routed model providers in its data collection documentation.
• Winston AI — AI content detection and plagiarism scanning. When you request a detection scan, your submitted text is sent to Winston AI's API for analysis.
• Stripe — payment processing, subscription billing, and fraud prevention on payments. When analytics consent is active at checkout, the Stripe subscription metadata also carries pseudonymous Google Analytics browser/session identifiers so a confirmed payment can be counted without sharing your account identity with Google Analytics.
• Vercel — application hosting, content delivery, temporary file storage for processing, and privacy-friendly cookieless analytics.
• Upstash — rate limiting and short-lived job/result storage while your feedback is generated and retained.
• Axiom — operational logging and performance monitoring so we can detect errors and abuse. Logs can include IP addresses, user identifiers, and request metadata, but not your assignment content.
• Google Fonts — web font delivery; your browser requests fonts from Google's servers, which receive your IP address.
• Trustpilot — if you choose to leave a review, you interact with Trustpilot under its own privacy policy.

These providers are bound by their service agreements with us and may only use your data to perform services on our behalf. We do not permit them to use your content for their own advertising.

Your data may be processed in jurisdictions outside of Australia, including the United States, where our service providers operate. Where we disclose personal information overseas, we take reasonable steps as required by Australian Privacy Principle 8 — including contractual safeguards with our providers — to ensure your information is handled consistently with Australian privacy law.

We keep personal information only as long as needed for the purposes described in this policy:

• Free accounts: assignments, uploaded files, and feedback reports are automatically deleted approximately 30 days after creation.
• Anonymous (signed-out) reports: automatically deleted within hours unless you create an account and claim them.
• Pro and Educator accounts: assignments and feedback are retained while your account remains active so your history stays available, until you delete them or your account.
• Detection scan results: retained with the linked assignment, or until you delete them from your scan history.
• Account records: retained while your account is active.
• Analytics and usage data: individual analytics events are deleted after about 13 months. Consent records, referral events, ratings, and survey responses are deleted after about 24 months. Aggregated statistics that no longer identify you may be kept for longer.
• Google Analytics: Google Analytics cookies may last up to 2 years unless you withdraw consent or clear them. We set Google Analytics to the shortest practical data retention period.
• Billing records: retained as required by Australian tax, accounting, and fraud-prevention obligations, even after account deletion.

You may delete individual projects and feedback versions from your dashboard at any time. To request full account deletion, use our Account Deletion Request page or contact us at support@ismgenius.com. We aim to complete account deletion requests within 30 days.

Subject to applicable law, you may have the right to:

• Access the personal information we hold about you — you can download a copy of your data anytime from Settings → Privacy & data → Download my data.
• Request correction of inaccurate information — your name, photo, and school can be edited in Settings.
• Request deletion of your personal information.
• Opt out of product update emails — toggle Settings → Privacy & data → Product updates by email, or use the unsubscribe link in any marketing email.
• Decline or withdraw optional analytics and advertising cookies at any time using Cookie settings in the footer, without losing access to the service.
• Object to or restrict certain processing activities.
• Request data portability.
• Lodge a complaint with a data protection authority (see Section 14).

To exercise any right that is not self-service, contact us at support@ismgenius.com. We will verify your identity before processing any request and respond within a reasonable period (and within any timeframe required by law).

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. These include encryption of data in transit (TLS), encryption at rest with our hosting providers, row-level access controls on our database, private storage for uploaded files, secure authentication, rate limiting, and least-privilege access for administrators. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

If a data breach occurs that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), and will take prompt steps to contain and remediate the breach.

ISMGenius is designed for use by students, including secondary school students. If you are under the age of 16 (or the minimum age required by applicable law in your jurisdiction), you should only use the platform with the knowledge and consent of a parent, guardian, or authorised school representative. We collect only the information needed to provide and improve the service, optional cookies stay switched off unless they are accepted, we do not sell students' personal information, we do not use student work to train AI models, and we do not show third-party advertising within ISMGenius. Personalised advertising features are intended only for people who confirm that they are 18 or older by selecting Accept all.

Parents and guardians may contact us at support@ismgenius.com to access, correct, or delete their child's information. If we become aware that we have collected personal information from a child without appropriate consent, we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective" date at the top of this page and, where the changes significantly affect how we handle your personal information, notify you in the app or by email. Your continued use of ISMGenius after any changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or wish to exercise your data rights, contact us:

• Email: support@ismgenius.com
• Phone: +61 485 708 166

If you are not satisfied with our response to a privacy complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.