Privacy Policy

This Privacy Policy explains how Design Industries Pty Ltd (ABN 98 111 471 179, "we", "us", "our") collects and uses your information when you use the learn.diya.au learning platform (the "Platform").

1. What we collect

• Google sign-in data — your name, email address and profile picture from your Google account. We never receive your Google password.
• Learning progress — session and lesson completion, quiz scores, and gamification data (XP, badges, streak days), stored against your account so your progress follows you across devices.
• AI tutor interactions — when you use the in-course AI tutor, your prompts and the responses are logged, together with the model used, for safety, provenance and (in institutional programmes) educator visibility.
• Technical data — standard server logs (IP address, user agent, timestamps) used for security and troubleshooting.
• Enquiries — if you use the enquiry form on our home page, we store the name, email address, organisation, audience and message you provide, together with your browser's user-agent string, so we can reply. This is submitted to our own Australian server, not to a third-party form service.

2. Cookies and local storage

• A single httpOnly session cookie keeps you signed in. It contains a signed session token, not your personal details, and is strictly necessary to operate the Platform.
• Browser local storage holds a local mirror of your progress so pages load instantly; it syncs to your account when you sign in.

We do not use advertising or cross-site tracking cookies.

3. Where your data lives

Learner data and AI inference are hosted in Australia (AWS, Sydney region). We do not transfer learner data offshore in the ordinary course of operating the Platform.

4. How we use it and who we share it with

• To operate your account, save your progress, and provide the AI tutor.
• To protect the Platform against unauthorised access and abuse, and to respond to support requests.
• Google provides sign-in (Google Privacy Policy); Amazon Web Services (Sydney) hosts the Platform. These providers act on our instructions.
• Deepgram synthesises the spoken narration for our video lessons, on their Australian service hosted in the same AWS Sydney region as the rest of the Platform. We send them course text only — the lesson script we wrote — and they return the audio. No learner information is involved: not your name, not your account, not your IP address, and not which lesson you are listening to. The audio is generated once and then served from learn.diya.au, so playing a lesson sends nothing to Deepgram at all. We set their model-improvement opt-out on every request. Deepgram processes their own billing and operational records (request counts and identifiers, containing no learner data) in the United States.
• If you ask the AI tutor a question by voice, the recording is sent to Deepgram's Australian service to be turned into text, and is then discarded — we do not store it. The text appears in the message box for you to read and correct before you send it; nothing is submitted to the tutor until you press Send. Voice is always optional: you can type every question instead, and the microphone is only ever active while you have switched it on. We set Deepgram's model-improvement opt-out on these requests too, so your voice is not used to train anything.

We never sell your personal information and we do not share it with advertisers.

Third-party requests from your browser. Apart from the Google sign-in widget, which loads on the sign-in page only, the Platform's pages and our home page make no requests to any third-party origin: fonts, icons, images and scripts are all served from learn.diya.au itself. No content delivery network, font service or analytics provider observes your reading. Your Google profile picture is not loaded — your initials are drawn locally instead — so no image host is told which pages you visit. This is about what your browser connects to, and it stays true when you use voice: your recording is posted to learn.diya.au, and our server — not your browser — passes it to Deepgram. That is a real difference, because it means no third party learns your IP address or which page you were on. It is not a claim that no third party ever sees anything: what each one receives is listed above.

5. Retention and your rights

Your account and progress are retained while you hold an account; server logs for up to 90 days; enquiry-form submissions for up to 24 months, or until you ask us to delete them. Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you may request access to, correction of, or deletion of your personal data — write to hello@di.net.au.

6. Changes

We may update this policy; the current version is always at this URL with the effective date above.

7. Contact