Privacy notice

Version 2026-11-23.1 · in effect from 23 November 2026 (its AI parts apply to you from when you accept our AI Use Policy, if that's sooner)

Learn It With Me is a teaching resource site run by Learn It With Me Limited (NZBN 9429054012622), Auckland, New Zealand, which holds the information described here. Everything on the site can be used without an account. If you do create one, this notice explains what we keep, why, where, and what you can do about it. We follow the New Zealand Privacy Act 2020 and its information privacy principles, and we design the site to the standard of the EU's General Data Protection Regulation as well.

In short

• There are no adverts, and we never sell personal information. We email you about new resources and features only if you choose to (on your profile), and every one of those emails has a link to stop them.
• We collect only what's needed to run accounts, classes and subscriptions. We don't ask for a date of birth, address, phone number or photo.
• Names, email addresses and IP addresses are encrypted before they're stored.
• We count page views ourselves, without cookies, and your browser only ever talks to this site: no analytics or advertising company sees you.
• You can download or delete everything about you from your account page.
• If you use AI essay assessment, your essay is read and marked by an AI model on Amazon's servers in Australia or New Zealand. Your name and contact details are taken out first, the essay is stored only in New Zealand, and nothing is used to train AI. How we use AI.

If you don't have an account

We don't know who you are. To show prices in your currency (and greet you in your language), we look up which country your IP address is in, in our own copy of DB-IP's country list on our own server: the address isn't stored for this, or sent anywhere. If you choose a different country on the pricing page, that choice is kept in a cookie in your browser for a year.

We count the pages people look at ourselves, to see which resources are used: for each page, its address (never the part after a "?"), the page you came from, whether you're on a computer, tablet or phone, the country your IP address is in (looked up in our own copy of a country list; the address itself isn't kept), and whether the visit looks automated: a search engine's crawler, a script, or a cloud server, VPN or Tor network (worked out from your browser's name and from our own copies of public lists of networks; again, the address isn't kept). To tell how many people visit, your browser is given a code made from its IP address and browser name with a secret key that changes every day and is then deleted: we can count you for that day, but never recognise you on another day or work out your address from it. We don't use cookies for this, and don't use Google Analytics or any other outside service. Games with a high-score table keep the initials you type, your score, and a record of the game used to check the score is genuine, with your IP address for 30 days (to stop cheating).

If you use the site without signing in, the time counter in the footer is kept only in your own browser and is never sent to us. The home page sets one small cookie, liwm-clip, holding a random number, so you keep seeing the same video on each subject card until you close your browser. It says nothing about you and isn't used for anything else.

What we keep when you create an account

• Your email address and name: to sign you in and to show your name to you (and to your teacher, if you join their class). A first name or nickname is fine.
• Whether you are a student or a teacher, and for teachers, whether you're one of your school's admins.
• A three-letter leaderboard code (by default the first three letters of your family name, which you can change). It is what appears on the leaderboards; only people in your own school can also see your name.
• Your school and classes: which school and classes you belong to. For a school, its name, website, Ministry of Education number, and the email domains its teachers and students use.
• Your scores in the games, saved automatically under your leaderboard code.
• The pages you look at while signed in, as above but with your account, its type and your school, so we can see how the site is used and which resources lead people to sign up or subscribe. Only our site administrator sees it, in totals, never your teachers.
• What you use while signed in: which interactives and games you open, how long you spend on each (counted only while the page is open and in use, in total and day by day), how many times you play each game, a dated trail of these activities, and some of what you do inside them: for example each transmission you complete in Bits on the Wire, or whether you got each challenge question right first time.
• How you sign in: a password (stored only as a one-way Argon2id hash, which even we can't reverse), the public half of any passkey, and the account id of any Google or Microsoft account you link. If you sign in with Google, also the web address of your Google profile picture, so it can be your picture in the site's header. Only you see it, the picture itself stays with Google, and the address is removed when you unlink Google or delete your account.
• Your settings, such as which languages the Key Terms lists show, and your country (you choose it when you sign up), so we show prices in your currency.
• A security log of sign-ins and changes to your account, with the device type (for example "Chrome on Windows") and IP address.
• What you agreed to: the version of this notice you accepted, and for students, the age or permission confirmation.
• If you subscribe: your plan, the amount and currency, the country your card is from (international prices differ), Stripe's references for you and your subscription, when it renews or ends, and a copy of each invoice (encrypted). Never your card details.
• For a school that pays: the billing details its admins give (who invoices go to, the accounts email address, the postal address, its GST number and any purchase order number), encrypted, and the invoices sent to it to pay by bank transfer.
• If you contact us through the support page: your name, email address and message (encrypted), and your school if you're signed in.

We use this information only to provide the site to you and your school: to sign you in, run classes, assignments, gradebooks and leaderboards, take payments, answer you, and keep the site secure. We don't profile students, make automated decisions about anyone, or use what students do for anything but their own learning and their teachers' view of it.

Students and schools

The site is made for school students, so we keep what we collect about them to a minimum. Students under 13 confirm, when they create an account, that a parent, caregiver or teacher has said they can. When a school uses the site with its classes, the school decides how its students use it, and we look after their information on the school's behalf, as set out in our school data agreement.

Before students can join a school's classes, we check the school: that the person registering uses the school's own email domain, that its website is real, and for New Zealand schools, its entry in the Ministry of Education's public Schools Directory. A site administrator then approves it. When a teacher asks to join a school that is already registered, we email the school's admins to confirm they teach there, and tell them the teacher's name and email address.

If you leave a class, or its teacher removes you, the class's teachers no longer see your information; your account and its history stay yours. A school that stops using the site can ask us to delete its students' and teachers' accounts: we do it within 30 days of the school confirming the request.

Who can see it

Only you, and our site administrator where needed to run and support the site, with these exceptions:

• Your teachers see your name, email address and leaderboard code in their class list, and your name and email address next to your code on the leaderboards (see below).
• Your teachers also see what you do on their class's subjects, from when you joined the class: your time on each of those subjects' resources and how many times you played each game, and for work they set you, how far along you are and your grade. They don't see what you do on other subjects, or anything from before you joined.
• Everyone in your school (its teachers and students) can see your name by pointing at, or tapping, your leaderboard code on any leaderboard: the public, class and school ones; its teachers also see your email address. If a score of yours is rejected (it failed the checks), its teachers can see your name on the list of rejected scores. Our site administrators who handle support also see which school you are in, and who sent each rejected score and why it failed.
• Everyone else (people in other schools, or not in a school) sees only leaderboard codes and scores on the public leaderboards, and whether a score is from a visitor, a user not in a school, or someone in another school: never your name, email address or which school.
• Your school's admins see its teachers' names and email addresses, its classes, and its subscription and invoices.

How we use AI

One part of the site uses artificial intelligence (AI): Essay Assessment, which reads a handwritten or typed essay and suggests marks and feedback. It uses AI credits (bought, or given by your school or teacher), and you accept our AI Use Policy before you first use it. Nothing else on the site uses AI, and we never use AI to make decisions about you. You only use it if you choose to upload an essay (or your teacher uploads one for you), and your school can switch it off.

What the AI is given. The pages of the essay (photos, a PDF or a Word document), the question it answers, and the guidance for marking it: the published mark scheme's guidance when it's a past exam question, and any marking guidance written by the teacher who set it (never anything about you). Before anything is sent:

• The top of every handwritten page, where an exam script has your name and candidate number, is covered, and you cover anything else on the page that says who you are. Covered areas are blacked out of every image the AI sees.
• Your name, the name of whoever uploaded the essay for you, your school's name, email addresses, phone numbers, and student or candidate numbers are taken out of the text and replaced with a placeholder such as [name].
• The AI is never told who you are, which school or class you're in, or anything else from your account. Please don't write personal details in an essay you upload.
• So its feedback can say which of your skills have changed (for example "your graph is drawn more accurately" or "your evaluation has moved up a level"), the AI is also given your last three grade reports in the subject (on a teacher's essay, only those the teacher chooses): for each, its date and level, the marks for each skill (not the total or grade), what it said you did well, got wrong or missed, what it said about your diagrams, and its advice. Never the essays themselves.

What it's used for. Only to do what was asked, for that one essay:

• to read the handwriting and the diagrams, so you can check the text and descriptions it produces;
• to mark the essay and write feedback. For work your teacher set or uploaded, it's a suggestion your teacher reviews and releases to you. On your own practice essays (with credits you bought or were given), you see its marks straight away, as a practice estimate, not an assessment;
• to check the essay for safeguarding concerns (for example, signs that someone may be at risk of harm). If the check finds a possible concern, the AI does nothing more with the essay, and your school's safeguarding contacts are told so that a person can look. If you're not in a school, our support team is told.

AI can be wrong or unfair. Everything it produces is labelled as AI. We don't use what you upload for anything else: not to build a profile of you, not to personalise the site, not for analytics about what students write, and never to train AI models, ours or anyone else's.

Where it happens. Your essay, its page images, the text and descriptions read from it, and the AI's answers are stored only in New Zealand (Amazon Web Services, Auckland). The AI runs on Amazon Bedrock, using Anthropic's Claude models hosted by Amazon. For each request, Amazon's Australian routing sends the work to its data centres in Sydney or Melbourne, Australia, or Auckland, New Zealand, whichever has capacity. The work travels inside Amazon's own network, is processed there and isn't kept there: the answer comes straight back to New Zealand. Our Amazon accounts are set up so that AI requests can't go anywhere outside Australia and New Zealand. Anthropic, the company that makes Claude, doesn't receive your essay: Amazon runs the models in its own accounts, which Anthropic can't access.

We'll tell you before this changes. We'll tell schools at least 30 days before we change the country where AI processing happens, or add one, by email to each school's admins and on this page, so a school can raise a concern or switch the AI off first. A change like that applies to you 30 days after we tell you, or from when you accept our updated AI Use Policy, if that's sooner: until one of those, your essays are processed as before, or not at all.

Who it's shared with. Only Amazon Web Services, as our processor, to run the AI for us under its data processing terms. Amazon doesn't use it to train models and doesn't share it with the model makers. On the site, an essay is seen by you, whoever uploaded it, the teachers of the class it was uploaded for (and, if you're at a school, your own practice essays by your teachers there and its admins, who can release their marking), your school's safeguarding contacts if the check finds a concern, and our support staff where needed to look into a problem you report.

Your rights and choices. You can see your essay, its pages and everything the AI produced from it on the Essay Assessment page. You check and correct every line the AI read, and every diagram description, before anything else is done with it; your teacher sees what you changed. If you think a mark or feedback is wrong, tell your teacher, or use Report a problem on the essay. You never have to use AI essay assessment, and your school's admins can switch it off for the whole school at any time. To have an essay deleted, or for anything else about it, write to our privacy officer through the support page.

The companies that help us run the site

These companies process information for us, only to provide their service, under their own security and privacy commitments. We don't share information with anyone else, unless the law requires it.

• Amazon Web Services (Auckland, New Zealand) hosts the website, its database and our backups, all in New Zealand: everything described here, with names, email addresses and IP addresses encrypted.
• Google Workspace (United States and elsewhere) sends the site's emails (sign-in codes, notices, receipts): your email address and the email's content.
• Stripe (United States and elsewhere) takes card payments and runs subscriptions and invoices: your name, email address, card details (entered on Stripe's own page) and payments.
• Google and Microsoft (United States and elsewhere), if you choose to sign in with their accounts: they know you signed in here.
• Amazon Web Services: Amazon Bedrock (Sydney and Melbourne, Australia; and Auckland, New Zealand), only for AI essay assessment: runs the AI that reads and marks an essay, with names and contact details taken out first. Nothing is kept there or used for training. More.

Outside data some resources show (World Bank figures, flags, exchange rates, maps) and the site's fonts are fetched by our server, so those services never see you.

Where your information is kept. The site, its database and every backup are in New Zealand (Amazon Web Services' Auckland region), and our AWS accounts are set up so nothing can be stored outside it. Until our move in 2026 the site was hosted by DreamHost in the United States: its copy of the site and database is securely deleted two weeks after the move, and one encrypted copy of the database is kept offline, in New Zealand, for 90 days in case it's needed, then destroyed.

Using the site from another country. Your information is shown to you wherever you are, so it travels over the internet to the computer or device you're using, in whatever country that is: if a student or teacher signs in from Singapore, their information goes to Singapore. It's encrypted on the way (HTTPS), and only the device you've signed in on, which is authorised to see it, can read it. It isn't stored anywhere new by this: it's still kept only in New Zealand.

Sending information overseas. Emails, card payments, the optional Google and Microsoft sign-in, and AI essay assessment (above) use services outside New Zealand, which the Privacy Act counts as sending information overseas. We do it because the site needs these services to run, we choose providers that protect information to a standard comparable to New Zealand's, and we send them only what each needs. For the AI, only the essay goes, without your name or contact details, to Amazon's data centres in Australia, a country whose privacy law gives comparable protection, and it isn't stored there.

How it is protected

• Every connection to the site uses HTTPS, and the connection between the website and its database is encrypted too.
• Your email address, name, linked-account ids, IP addresses, support messages and invoice copies are encrypted (AES-256-GCM) before they are stored, so a copy of the database on its own would not reveal them.
• Sign-in codes, links and session cookies are stored only as keyed hashes, and codes and links work once, for a few minutes.
• Repeated wrong passwords or codes are slowed down and then blocked for a while.
• Site and school admins must sign in with a passkey (two factors) to use their admin powers.
• The site's pages may only load code from the site itself (a strict Content Security Policy), and they don't use outside analytics or advertising services.
• Database backups are kept for 35 days and stay encrypted the same way.

If information we hold is ever lost, seen or changed by someone who shouldn't have it, and it's likely to cause serious harm, we'll tell the people affected (and their school) and the Office of the Privacy Commissioner as soon as we practicably can, as the Privacy Act requires. More on how we look after security is on our security page.

How long we keep it

• Unused sign-in codes and links: deleted within a day of expiring.
• IP addresses (including those recorded with game scores): erased after 30 days.
• The activity trail: 24 months. Your totals (time on each resource, games played) are kept while your account exists.
• The security log: 12 months.
• Support messages: 24 months after they're answered.
• Payments and invoice copies: 7 years, as New Zealand tax law requires, even if the account is deleted (without the link to it).
• Page counts: 13 months.
• Game scores that were rejected (they failed the checks): 12 months. Accepted scores are kept on the leaderboards.
• Essays for AI assessment, their pages and what the AI produced: until you delete your account, and never more than three years.
• Our record of each request to the AI (what was sent, with names already taken out, and what came back; never the page images): 30 days, so we can look into a problem you report.
• The cost record of AI work (the model and its size, never the essay): 24 months.
• Backups: 35 days.
• Your account: until you delete it. An account nobody has signed in to or used for two years is deleted: we email a week before, and signing in keeps it. An account holding AI credits of its own is kept for three years, with a month's email warning.
• When you delete your account, everything connected to it is deleted straight away, apart from payment records (above) and security-log entries, which lose any link to you. It leaves our backups within 35 days.

Your choices and rights

From your account page you can download everything we hold about you, correct your name, remove sign-in methods, sign out other devices, or delete your account. You can also ask us to see or correct anything we hold, or to explain how it's used: write to our privacy officer through the support page (choose "Privacy"). We'll answer within 20 working days. A parent or caregiver can ask on behalf of their child.

If you're in the European Union or the United Kingdom, you have the same rights under the GDPR, including to have your information deleted, to take a copy with you, and to object to how it's used. We use your information to provide the service you or your school asked for, and for its security.

If you're not happy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner.

Changes to this notice

If we change what we collect or how we use it, we'll update this notice and its version, and tell account holders by email before a significant change takes effect. The terms of use cover the rest of the rules for using the site.