Privacy Policy

• Studio hides family names and contact details in your browser before anything is sent for AI drafting.
• We do not keep the emails you paste or the drafts Studio writes.
• Drafts are written by OpenAI's models, which do not train on this content. Neither do we.
• We keep only light usage records (counts, dates, country), never message content.
• We never sell personal information or use it for advertising.

Studio opens from a private link given to your school. There is no sign-in.

Hidden before sending. Before anything leaves your browser, Studio detects names, email addresses, phone numbers and ID numbers and swaps them for stand-ins. Real names are put back into the draft on your screen only. Detection is automatic and can miss things, especially names in other writing systems, so check the privacy review panel and hide anything it missed. A name you choose to keep is sent as written.

Processed, then discarded. The text, with those details hidden, goes over an encrypted connection to our server and on to OpenAI, to suggest a writing style that suits the family and to write the draft. We do not store it. OpenAI does not use it to train its models, and keeps it for up to 30 days only to check for misuse before deleting it.

Voice input. If you dictate instead of typing, the recording is turned into text by Google Cloud in Singapore and then discarded. We keep only how many seconds were used.

Your school's information. Studio drafts from information your school gives us, such as programmes, fees and admissions steps. We keep this so Studio can use it, and delete it on request.

To see whether Studio is used and to keep it running fairly, we record:

• how many drafts each school's link generates each day;
• visit statistics: date, country (worked out from your IP address), the website or campaign link you came from, device type, and which Studio steps were used and how long they took. Visitors are counted with a scrambled code that changes every day, so we can count visits without knowing who made them. Step records are deleted after 90 days; visit counts after 12 months.

We do not keep your IP address in these records. Google Cloud's standard security logs hold it for 30 days.

In your browser, Studio saves your school's access key so the link keeps working, plus a random tab ID that clears when you close the tab. Pasted emails and drafts are not saved.

When you contact us, we keep your name, organisation and email so we can reply. Our website uses Google Analytics cookies only if you click "Accept" on the cookie banner.

The school decides what family information to use and remains responsible for it; Eplex processes it only to produce the draft. Parents and guardians should contact the school first.

Our server and records sit on Google Cloud in Singapore. Drafting is done by OpenAI in the United States. Google is bound by the Google Cloud Data Processing Addendum, including EU Standard Contractual Clauses for data leaving the EU or UK. Data is encrypted in transit and at rest, and each school can see only its own data.

Eplex is for school staff, not children, and we do not collect information directly from children.

You can ask to see, correct or delete personal information we hold about you by emailing privacy@eplex.ai. We will reply within 30 days. In the EU or UK you also have GDPR rights, including to object to or restrict processing. Every draft is reviewed and sent by a person; nothing is sent automatically.

If you are unhappy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the EU or UK, your local data protection authority.

Schools that connect Eplex to email or their CRM also get the following. These integrations read only the email thread or CRM record you have open, and only when you click an Eplex button. Unlike Studio, they do not hide names, because the reply needs the family's details. Content is processed and discarded as above. The Gmail add-on can also save a tour brief as a Google Doc in your own Drive. HubSpot and Salesforce access is read-only. Nothing is ever sent or written back for you.

We keep a basic account record (email, name, role, school) and, for each draft, a content-free record (language, enquiry type, word count) that is deleted after 30 days. Sign-in uses Google Firebase Authentication in the US. Where your school has a subscription agreement with us, it takes priority.

Eplex's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We will post updates here and change the date above, and tell schools about significant changes.

privacy@eplex.ai · Eplex AI Pty Ltd, Level 1, 63-73 Ann Street, Surry Hills NSW 2010, Australia