Alto Privacy Policy
Effective date: 7 August 2026
Alto ("we", "our", or "us") operates the Alto learning platform available at alto.guru.
This Privacy Policy explains how we collect, use, store, and protect personal information, particularly information relating to students.
We are committed to protecting the privacy and security of all users, especially children.
APP Compliance Statement
Alto Guru Pty Ltd (ACN: 673 683 522) is bound by the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). This Privacy Policy sets out how we manage personal information in accordance with the APPs.
Our APP Privacy Policy is available at alto.guru/privacy and our contact details for privacy enquiries are provided below.
1. Our approach to student privacy
Alto is designed for use by schools and families. We follow these principles:
- We collect only the minimum data required to provide learning services.
- We do not sell or rent student data.
- We do not show advertising to students.
- Student accounts are controlled by schools or parents.
- Schools or parents can request data deletion at any time.
2. What information we collect
We collect this information with the consent of schools (acting on behalf of parents/guardians) or parents directly, and only where it is reasonably necessary to provide our educational services.
Student information
We may collect limited student information, such as:
- First name or pseudonym
- Class or year level
- School name (if applicable)
- Learning activity data (e.g. answers, progress, results)
School-managed student accounts do not require student email addresses. Where a student account is registered directly (for example by a parent or family), an email address may be collected and used for sign-in.
Schools may choose to use de-identified or pseudonymous student names.
Teacher and parent information
We may collect:
- Name
- Email address
- School or organisation
- Account login details
Technical information
When users access Alto, we may collect:
- Device type
- Browser type
- IP address
- Usage and performance data
This information helps us maintain and improve the service.
3. How we use information
We use personal information to:
- Provide learning sessions and track progress
- Allow teachers and parents to monitor students
- Provide support and respond to enquiries
- Maintain the security and reliability of the platform
- Improve the learning experience
We do not use student data for advertising or marketing.
4. Data storage and hosting
Alto's Australian service is hosted on Amazon Web Services (AWS) infrastructure located in Sydney, Australia, and student and school personal information is stored in Australia.
One specialised service provider processes limited personal information outside Australia: payment processing for optional parent subscriptions is performed in the United States. The providers we use, the data they handle and the countries in which they operate are listed in Section 6. All third-party providers are bound by data processing agreements consistent with the Australian Privacy Principles.
Where Alto operates regional services (for example, a European pilot), data for customers in that region may be hosted on infrastructure located in that region. Australian customer data remains hosted in Australia.
Data is stored securely using industry-standard security controls.
5. How we protect information
We implement comprehensive security measures including:
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
- Role-based access controls limiting staff access to personal information
- Multi-factor authentication for all Alto staff and administrative accounts
- Independent external penetration testing, commencing June 2026 and conducted at least annually thereafter
- Secure software development practices
- Centralised logging and monitoring of production systems
All staff with access to personal information receive privacy and security training.
While no system is completely secure, we take reasonable steps to protect all information in accordance with APP 11.
6. Third-party service providers (sub-processors)
We use a small number of trusted third-party providers (sub-processors) to operate Alto. For each, the table below sets out the provider, its purpose, the data types it processes, and the country in which that processing or storage takes place.
| Sub-processor | Purpose | Data types processed | Location of processing / storage |
|---|---|---|---|
| Amazon Web Services (AWS) aws.amazon.com | Cloud hosting of the platform and database; transactional email delivery (Amazon SES) | All platform data: student first name or pseudonym, class/year level, school, learning activity data; teacher and parent name, email and account login details; technical data (IP address, device and browser type, usage data); transactional email content and recipient address | Sydney, Australia (data stored in Australia) |
| Stripe stripe.com | Payment processing for optional parent subscriptions | Payer name, email address and payment card details. Alto does not store payment card information; student data is never shared with Stripe | United States |
| Google Workspace (Google LLC) workspace.google.com | Internal business operations — staff email, documents and school correspondence | Business correspondence and school contact details. Student platform data is not stored in Google Workspace | United States |
| GoDaddy godaddy.com | Domain registration and DNS | Domain registration records only. Does not store or process platform user data | United States |
Alto is evaluating Cloudflare for content delivery and edge protection; it is not currently used in production. This table and this policy will be updated to add it, with data types and location, before any such service is used in production.
This table is the authoritative, current list of Alto's sub-processors and is kept up to date as providers change. We update it, and give schools at least 30 days' notice, before any change to where data is processed or stored.
The lawful basis for this processing is the performance of our service to schools and families under the Australian Privacy Principles; each sub-processor acts only on Alto's instructions under data-processing terms consistent with the APPs.
These providers:
- Only process data on our behalf
- Are required to maintain confidentiality and security
- Do not use student data for their own purposes
- Are bound by data processing agreements consistent with the Australian Privacy Principles
7. Data retention and deletion
We retain student learning data for 3 years after last account activity to allow students to return to their learning journey, unless earlier deletion is requested.
Upon a deletion request, personal information is removed from active systems within 30 days and from backup systems within 90 days.
De-identified, aggregated data used for platform improvement may be retained indefinitely but cannot be re-identified.
Schools or parents may request the deletion of student data at any time.
To request deletion, contact privacy@alto.guru with the student name or ID and school name.
8. School and parent control
For school-managed accounts:
- Schools control the creation and management of student accounts.
- Schools may request data export or deletion at any time.
For parent-managed accounts:
- Parents control their child's account.
- Parents may request changes or deletion.
9. Cookies and analytics
Alto uses essential cookies to maintain user sessions and ensure platform functionality.
We may use analytics tools to collect de-identified, aggregated usage data to improve the platform. We do not use third-party advertising cookies or tracking technologies.
Users can manage cookie preferences through their browser settings, though disabling essential cookies may affect platform functionality.
10. Data breach response
If we become aware of a data breach that is likely to result in serious harm to individuals, we will:
- Notify affected schools or parents within 72 hours of becoming aware
- Notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme
- Provide details of the breach, affected data, likely consequences, and steps being taken
- Take immediate action to contain, investigate, and remediate the breach
11. Access and correction
Schools and parents may request access to personal information by contacting privacy@alto.guru. We will provide access within 14 days in CSV or JSON format. We will verify the identity of the requester before providing access.
If you believe personal information we hold is inaccurate, incomplete, or out-of-date, you may request correction. We will respond to correction requests within 14 days.
If we refuse access or correction, we will provide written reasons and information about complaint mechanisms.
There is no fee for access or correction requests.
12. Parental consent for minors
For students under 18, we rely on schools or parents to provide appropriate consent for the collection and use of personal information.
Schools are responsible for obtaining parental consent where required.
Parents may withdraw consent at any time by contacting privacy@alto.guru or through their school.
13. De-identification and aggregation
We may de-identify and aggregate personal information for research, analytics, and platform improvement.
De-identified information is modified so that individuals cannot reasonably be re-identified. Aggregated data combines information from multiple users so no individual can be identified.
De-identified and aggregated data is not subject to this Privacy Policy.
14. Automated decision making
Alto uses algorithms to adapt learning content to student performance levels. These automated decisions are made solely to enhance the educational experience and are always subject to teacher and parent oversight.
No automated decisions are made about student evaluation, promotion, or placement without human review.
15. Changes to this policy
We may update this Privacy Policy from time to time.
For material changes affecting how we handle personal information, we will notify schools and parents at least 30 days in advance via email or through the platform.
The latest version will always be available at: alto.guru/privacy
16. Contact us
If you have any questions about this Privacy Policy or our data practices, please contact:
Alto Guru Pty Ltd
ACN: 673 683 522
Email: privacy@alto.guru
Website: alto.guru
If you have a privacy complaint, please contact us at privacy@alto.guru. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.