rubric+ Privacy Policy

Last updated: January 2026

Rubric Plus Pty Ltd (ABN 17 674 730 253) (“rubric+”, “we”, “our”, “us”) provides an academic performance tracking and analytics platform used by schools, educators, students, and guardians.

We are committed to protecting personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and, where applicable, State and Territory education requirements.

We acknowledge that children’s data and their unique identifiers is sensitive information and we ensure all processing of information is in the best interests of the child.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use rubric+.

1. What this policy covers

This Privacy Policy applies to:

the rubric+ SaaS platform
API integrations with school systems
our handling of personal information about students, parents/guardians, teachers, and school administrators
technical and analytics data generated through use of rubric+
sharing with authorised 3rd parties

It does not apply to the privacy practices of schools. Schools remain the primary collectors and controllers of student, parent and teacher information.

2. What information we collect

2.1 Student Information (synced from school systems)

We do not collect personal information directly from students or their guardians. All student data is synchronised from the school’s Student Information System (SIS), Learning Management System (LMS), or both.

This may include:

Full name
Date of birth
Student school email address
Learner Unique Identifier (LUI)
Aboriginal / Torres Strait Islander status
Language
Academic information
Attendance information
Any other data provided by the school’s SIS or LMS configuration required for the use of rubric +

2.2 Educator / Staff Information

Teacher ID
First name, last name, preferred name
School email address
Academic functions provided

2.3 Parents / Guardians

rubric+ does not collect parent or guardian data directly.
Parent/Guardian information includes name, relationship to student, contact details and IP address
Guardians’ data is used to confirm consent for using their children’s data, to access the solution and to provide system generated reports .

2.4 Technical & Log Information

When users log in or interact with the platform, we automatically record:

IP address
Browser type and version
Devices and operating system details
Login timestamps
Session events
Data access logs
Data change logs (audit logs)

This information is used to maintain security, audit usage, and support investigations.

2.5 Use of Analytics and Performance Monitoring Tools

rubric+ may use third-party analytics tools for:

The analytics information collected by the third-party applications may include technical data such as device type, browser type, operating system, pages accessed, session duration, and anonymised or truncated IP address information.

3. How information is collected

3.1 Data provided by schools

All student and teacher data is collected originally by schools in their own systems.
rubric+ receives this data via secure API synchronisation.

3.2 User actions on the platform

Teachers, students, and authorised school users may interact with assessments, targets, and performance analytics.

3.3 Technical and security logging

Automatically generated for audit and incident response purposes.

3.4 Third-party analytics tools

We use Google Analytics to measure the rubric+ website activity. We may use Microsoft PowerBi for data visualisation and reporting.

4. Why we collect and use personal information

rubric+ processes personal information for the following purposes:

For students

Tracking academic results
Providing personalised study insights and guidance
Supporting goal-setting and progress monitoring
Generating performance analytics and semester reports
Allowing schools to meet curriculum and reporting obligations

For teachers and faculty

Creating assessments
Recording and reviewing marks
Accessing performance dashboards
Analysing class, cohort, and subject trends
Supporting student guidance and interventions

Regulatory compliance

We share prescribed student performance information with the relevant State Education Authorities (as required by the school’s reporting obligations).

Analytics

rubric+ does not use third-party analytics tools to:

Track individual students or users for profiling or advertising purposes.
Engage in behavioural advertising or commercial targeting.
Selling or monetizing student data.

Analytics data is used solely for internal operational and improvement purposes.

AI ethics

rubric+ uses artificial intelligence strictly for:

converting PDF documents to text
generating study guidance based on results and curriculum
no personal information is retained or used to train AI systems
AI is not used to communicate with students directly
Appropriate testing is in place to ensure that the data, training and deployment of the AI module meet ethical standards

5. Who can access the information

5.1 User Roles Within the School: rubric+ provides five role-based access levels:

Student: may view only their own data
Teacher: access to their classes, assessments, and analytics
Head of Faculty: access to all classes in their faculty
Leader: access to all faculties
School Admin: view-only access to courses, enrolments, and assignments

6. Data sharing

We may share personal information only in the following circumstances:

With State Education Authorities to meet mandatory reporting requirements (e.g., assessment data). This includes name, LUI, date of birth, and prescribed performance data.
With the School to support internal reporting, analytics, and guardian notifications.
With authorised service providers.
We host platform and Student Data in secure databases with vendors based solely in Australia. We do not transfer or store personal information outside Australia. rubric+ systems and backups are hosted in Australia.
Limited analytics data may be handled offshore by analytics providers.
We do not sell or trade personal information.

7. Security

We use administrative, technical, and organisational safeguards to protect personal information, including but not limited to:

Role-based access control (RBAC) and MFA for internal systems
Secure software development lifecycle (SSDLC)
Data encryption at rest and in transit
Incident response and data breach notification processes
Business continuity and disaster recovery planning
Secure third-party vendor management
Network security monitoring
Audit logging and event tracking
Secure cloud hosting
Regular vulnerability assessments

If a concern or potential breach arises, users or schools may notify us at privacy@rubricplus.com

8. Retention & deletion

Master data is managed by the school automatically synchronised to rubric+.

When a school’s subscription ends:

The school may request an extract of all academic records (CSV format).
rubric+ will delete all school data within 60 days of contract termination.
Backup data containing the school’s records will be destroyed within 30 days after deletion.
Written confirmation of deletion is provided.

9. Access, correction & complaints

9.1 Access or correction requests

Students or guardians wanting access to or corrections of personal information should contact their school, as the school is responsible for Student Data.

9.2 Privacy complaints

The school directly
rubric+ at privacy@rubricplus.com
The Office of the Australian Information Commissioner (OAIC[).

10. Changes to this privacy policy

We may update this policy periodically. The “Last Updated” date will reflect the most recent version.