XScrubs privacy policy

1. Who we are

XScrubs is run by The Trustee for TDBM, ABN 60 368 962 309. In this policy "we" means that company. XScrubs is part of the XTutio family of products.

Privacy questions and requests go to hello@xtutio.com.

2. What we collect

• From the parent or account holder: name, email address and a password (stored only in a scrambled form).
• From the child: first name, year level, a login name, the answers they give, their marks and how long a paper took. We do not ask for a child's surname, address, school or date of birth.
• Payment: our payment provider takes your card details. We keep your customer number with them and the status of your subscription, not your card number.
• Support: what you tell us when you ask for help.
• Technical: your device and browser type, and which pages and buttons are used, counted by an analytics service after you accept analytics cookies.

3. Children's and students' information

XScrubs is used by students preparing for the UCAT ANZ. We build to the principles of the Privacy Commissioner's draft Children's Online Privacy Code, which is still being developed.

• A student under 18 uses XScrubs through an account held by a parent or guardian.
• We collect only what we need to run the practice.
• A child or student's use is never sent to our analytics service, and they are never identified in it.
• We do not advertise to children or send them marketing, and we do not sell personal information.
• A child's information is private to the family. We never show a child's name to other families.
• You can ask us to delete a child's information at any time.

4. How we use it

• To run your account and the practice, mark answers and show results.
• To take payment and manage your subscription.
• To keep the service safe and fix faults.
• To improve the product, using counts that do not identify a child.
• To send you emails about your account and subscription. If we email you about another of our products, such as the code for 20% off, that is marketing: you can say no or unsubscribe in one click, and we never send marketing to a child.

5. AI

XScrubs uses no AI to mark or read your answers. Its practice tests are marked by rules.

6. Who we share it with

We use these services to run XScrubs. They handle information for us and only as we direct. We do not sell personal information.

7. Where it is stored

Your account and your children's results are stored in Sydney, Australia (AWS ap-southeast-2). Some of the services above process information elsewhere, as their region says.

8. How long we keep it

We keep information while your account is open. If you ask us to delete your account or a child's information we will delete or de-identify it within 30 days, except what the law requires us to keep, such as billing records for seven years.

9. Your rights

You can ask to see, correct or delete the information we hold about you and your children. Write to us at the privacy address above.

If you have a complaint, contact us first at the address above and we will reply in writing. If you are not happy with the answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Security

Information is encrypted on its way to and from the service. Passwords are stored in a scrambled form. Access to the database is limited to the people who need it.

11. Cookie notice

We use the cookies and similar storage that sign-in, security and your cookie choice need. These are essential and are always on.

If you accept analytics cookies, we use PostHog to count visits and the steps from our site to a purchase. If you are signed in, we count you by an account number only, never your name or email. We never identify or track children: a child's pages do not start analytics at all. If you accepted analytics and your payment provider tells us you have started a 7-day free trial, subscribed, paused or cancelled, we record that event against your account number, with no amounts.

If you accept analytics cookies, we also note which page or link first brought you to the site, so we can see which of our pages and guides help parents. We record it against your account number once you sign up, never your name or email, and we do not record it if you have not accepted analytics cookies.

We do not use advertising cookies and we do not share your information with advertisers. You can change your cookie choice at any time from the link at the foot of the page, or by clearing this site's data in your browser.

12. Changes

If we change this policy in a way that matters, we will tell you before it applies.