1. What this policy covers

Sorsa is an online learning platform for Western Australian families. This policy explains, in plain English, what personal information we collect, why we collect it, where it is kept and what you can ask us to do with it. It is written for parents and guardians, and for students who are old enough to hold their own account.

Nothing in this policy contradicts the short consent notice you tick during signup. If you ever spot a difference, treat the signup notice as the promise and tell us, because it means we have made a mistake here.

2. Parents and guardians own the account

For families, the parent or guardian is the account holder. About you we store:

• your first name
• your email address
• your password, held in encrypted form by our authentication provider, Supabase. Nobody at Sorsa can read it.

We do not ask for your surname, your address, your phone number or any payment details.

3. What we store about a child under 16

Children under 16 do not sign themselves up. A parent or guardian creates the child's login as part of their own account setup. About each child we store only:

• their first name
• their year level
• a login: a username we generate for them, plus a PIN held in encrypted form by Supabase. The PIN is shown to the parent once at setup and we do not keep a readable copy of it.

That is the complete list. We never collect a child's surname, date of birth, school, address, phone number or email address. A child's login is identified internally by a synthetic address on our own domain. It is an internal identifier only, it belongs to no mailbox, and it cannot send or receive email.

4. Students aged 16 and over

A student who is 16 or older may hold their own account rather than being set up by a parent. On that pathway we store:

• first name
• year level
• email address
• password, held in encrypted form by Supabase
• date of birth, kept as the record that the student was old enough to consent for themselves

Date of birth is collected on this pathway only. It is never collected for a child set up by a parent.

5. Learning records

As a student works through Sorsa we store the lessons they complete, the answers they give and their progress records. This is what lets a student pick up where they left off, and lets a parent see how their child is going.

6. Consent records

When you tick a consent box we record who consented, what they consented to, the version of the notice they were shown and the date and time. The current notice version is 2026-07-v1, which is the version of this page and of the data notice. Keeping this record is how we can show, later, exactly what you agreed to.

7. Where your information is stored

All account, consent and learning data is stored in Supabase, our database and authentication provider, on servers located in Sydney, Australia. Sorsa itself is hosted by Vercel.

8. What we never do with it

• we never sell your family's information
• we never use it for advertising
• we do not build advertising or marketing profiles of students
• we run no third-party advertising trackers on the platform
• we do not share student information with anyone outside the services needed to run Sorsa

9. Analytics

We use Vercel Analytics to understand which pages people visit, so we can improve the site. It is privacy-friendly by design: it sets no cookies and collects no personal information. It does not follow anyone across other websites.

10. Who can see your family's information

A parent or guardian can see their own account and the records of the children they set up. A student can see their own work and progress. A small number of Sorsa administrators can access data where it is genuinely needed to run, support and secure the platform, for example to fix a fault or restore an account.

Access is limited in the database itself using row level security, so an account can only reach its own family's rows.

11. Keeping information safe

We take reasonable steps to protect personal information from loss, misuse and unauthorised access. Those steps include encrypted passwords and PINs, row level database security, limited administrator access, secure hosting and encrypted connections.

No online platform can promise perfect security. We keep reviewing and improving ours as Sorsa grows.

12. How long we keep it

We keep account and learning records for as long as the account is in use, so a student's progress is still there next term. If you ask us to delete your family's data, we delete the guardian account and the student records attached to it. Consent records may be kept for a period afterwards as the evidence of what was agreed and when.

13. Your rights

At any time you can ask us to:

• show you the personal information we hold about your family
• correct anything that is wrong or out of date
• delete your family's data

Get in touch through the Sorsa website and tell us enough for us to recognise the account. We will not charge you for asking.

14. If something goes wrong

If we become aware of a data breach involving personal information, we will investigate, act to contain it, and tell affected families and the relevant authorities where we are required to.

15. Sorsa has not launched yet

Sorsa is pre-launch. Accounts created now are trial and test accounts, set up so we can check that everything works properly before real families arrive. Your information is handled exactly as described on this page while we are in that phase.

16. Changes to this policy

If we change what we collect or how we use it, we will update this page, change the notice version at the top, and ask for fresh consent where the change is significant.

17. Contact us

For any privacy question, access request, correction or deletion request, contact Sorsa through this website. We would rather hear from you early than have you wondering.