Who this policy covers
This policy explains how we handle information about school staff, company teams, presenters and students who join a live session.
What we collect
Adult accounts may include a name, work email, organisation, role, location, verification status, booking activity and operational communications. Passwordless sign-in uses short-lived, single-use email links and a secure browser cookie. Presenter records may also include training, rehearsal and child-safety clearance information.
Students do not create accounts. For one supervised session we process the classroom alias they enter, admission and participation events, room messages, reactions, poll and activity answers, reflections, and safety or moderation signals. Join security uses a short-lived cookie and a hashed technical identifier to limit misuse.
We do not enable student cameras or microphones, and we ask everyone not to submit full names, contact details or other sensitive information.
Why we use it
- to authenticate adults, manage organisations and confirm bookings;
- to operate the live room, admit students and synchronise activities;
- to moderate contributions, respond to safety concerns and maintain an accountable audit trail;
- to send service emails and produce privacy-protected class and programme outcomes; and
- to secure, troubleshoot and improve the service.
Moderation and human review
Student messages and written reflections may be checked by automated rules and an AI moderation service before they are shared. A message may be approved, safely reworded, held, blocked or escalated. Authorised school hosts can manage the live room; restricted Recess safeguarding staff can review a safety disclosure when necessary.
Students can tell their teacher if a decision seems wrong. Adults can request review through Help and complaints.
Who receives information
Schools can access information needed to run their booking and privacy-protected class reporting. Presenters see only what they need to deliver the session. Funding companies receive aggregated or de-identified programme impact information—not student identities, raw messages or individual reflections. We do not sell personal information or build advertising profiles about students.
We use service providers for hosting and security, live video, email delivery and message moderation, including Cloudflare/OpenAI Sites, Agora, Resend and OpenAI services. Depending on how those providers operate, information may be processed outside Australia. We assess access and keep provider permissions limited to the service being delivered.
How long we keep it
Adult sign-in codes expire after about 15 minutes and adult browser sessions after about seven days. The student session cookie expires after about six hours. Student aliases, messages, reactions, activity answers and reflections are normally removed within about 30 days. Anti-abuse join checks are normally removed within 24 hours and room audit events within about 90 days. Aggregated session outcomes can be retained without identifying a student.
Safeguarding case metadata may be retained longer where it is needed to protect a child, investigate a concern or meet legal obligations. The source disclosure is kept only for its short review period and is not copied into long-term reports. Adult account, contract, booking and compliance records are retained only for operational, legal and security needs.
Your choices and contact
Adults may ask to access or correct their personal information, close an account, or make a privacy complaint. A student or family can ask the school host to contact us about information from a session. Some records may need to be retained for safety or legal reasons.
Email hello@recess.education and address the request to the Privacy Contact at Recess Pty Ltd (ABN 46 674 209 100, ACN 674 209 100). We will verify the request and explain the outcome. If a privacy complaint is not resolved, you may review the Office of the Australian Information Commissioner complaint process.