Who we are
Polarbear AI Pty Ltd (ABN 29 691 267 768), trading as Polarbear ("Polarbear", "we", "our" or "us"), provides the Polarbear learning platform and related services (the "Platform"). Our registered address is 470 St Kilda Rd, Melbourne VIC 3004.
This Privacy Policy explains how we manage personal information when you visit or use the Platform, communicate with us, or otherwise interact with our services.
Kinds of personal information we collect and hold
Depending on how you use the Platform, we may collect and hold:
- account and contact information, including your name, email address, login provider details and account identifiers;
- profile and education information, including your school, year level, subjects, learning preferences and country or education system;
- learning content and activity, including essays, documents, images, audio, prompts, chat messages, feedback, progress and performance information;
- subscription and transaction information, including plan, payment status and transaction identifiers (payment card details are handled by Stripe and are not stored by Polarbear);
- technical and usage information, including IP address, approximate location, device and browser information, cookies, logs, feature interactions and analytics events;
- communications with us, including support enquiries, privacy requests, survey responses and feedback; and
- legal and consent records, including the version of a policy you accepted, when and where acceptance occurred, and related audit information.
User-provided learning content may contain personal or sensitive information. Please avoid including information that is not necessary for the learning service.
How we collect and hold personal information
We collect personal information:
- directly from you when you create or update an account, upload content, use a learning feature, make a payment, or contact us;
- automatically when you use the Platform, through application logs, cookies and analytics technologies;
- from authentication, payment and communications providers when they deliver services you request; and
- from a parent, guardian, school, tutor or other person where they are authorised to provide information about you.
We hold information in cloud-hosted databases, object storage, application systems, logs and backups. Access is limited according to role and operational need.
Why we collect, hold, use and disclose personal information
We use personal information to:
- create, secure and administer accounts;
- provide AI tutoring, essay marking, learning, collaboration and content features;
- personalise learning experiences and retain learning history;
- process subscriptions and payments;
- communicate about accounts, support, security and mandatory legal or service notices;
- operate, troubleshoot, analyse and improve the Platform;
- prevent fraud, misuse and security incidents;
- comply with law, respond to lawful requests and establish or defend legal claims; and
- complete a corporate transaction, subject to appropriate safeguards.
We do not sell or rent personal information.
When we disclose personal information
We may disclose personal information:
- to service providers that host, secure, analyse, support or deliver the Platform;
- to AI providers when a feature requires content to be processed to generate a response;
- to payment and email providers to complete transactions or deliver communications;
- to another user, school, tutor or the public when you direct us to share or publish content;
- with your consent or at your direction;
- where required or authorised by law, court order or a government authority;
- where reasonably necessary to protect a person, the Platform, or Polarbear's legal rights; and
- as part of a merger, financing, acquisition, reorganisation or sale of assets.
Overseas disclosures and service providers
Some service providers are located overseas or use overseas personnel and infrastructure. The countries and regions below are the locations in which recipients are likely to be located or information is likely to be processed. Provider locations can change as their infrastructure and subprocessor lists change.
| Provider | Purpose | Likely locations |
|---|---|---|
| Supabase and Amazon Web Services (AWS) | Authentication, databases, storage and infrastructure | Australia, United States and Singapore |
| Google Cloud and Google AI | Application hosting, storage, logging and AI processing | Australia; overseas processing may occur in the United States, Canada, United Kingdom, European Economic Area, India, Japan and Singapore |
| OpenAI | AI model processing | Australia, United States, Canada, United Kingdom, European Economic Area, India, Japan and Singapore, as applicable to the service configuration |
| Anthropic | AI model processing | United States; processing may also occur in Europe, Asia and Australia |
| Nebius | AI model processing for short-answer marking and learning-content generation | European Union, including Finland and France; United States or Israel, depending on the selected model or service configuration |
| PostHog | Product analytics, feature flags and error diagnostics | United States |
| Vercel | Frontend hosting and content delivery | United States and globally distributed content-delivery locations |
| Resend | Transactional and mandatory legal email delivery | United States and Ireland |
| Stripe | Subscription and payment processing | Australia, United States and other jurisdictions used by Stripe and its service providers |
| Mailchimp | Marketing-list management and email campaigns | United States and other locations where Mailchimp, its affiliates or subprocessors operate |
| Twilio | Phone and lesson-notification SMS delivery | United States, Australia and other telecommunications routing locations applicable to the recipient |
| Prelude | Phone verification and transactional messaging | European Union and telecommunications-provider locations in countries where messages are delivered |
| ElevenLabs | Audio transcription and voice-AI processing | United States by default; European Union, India or Singapore where configured |
| Slack | Internal support, safety, fraud and dispute alerts | United States by default and other configured data-residency or edge locations |
Before disclosing personal information overseas, we take reasonable steps required by applicable law and use contractual, technical and organisational safeguards appropriate to the service. Overseas recipients may be subject to different privacy laws.
Changes to hosting locations
If we plan to relocate our cloud infrastructure, data hosting, the AI models we use, or personnel with access to unencrypted personal information to a country other than those listed above, we will notify affected customers in advance — on average at least 30 days before the change takes effect — and update the table above. Where a provider relocates processing within the locations already listed for it, the table above continues to govern and no separate notice is given.
Accessing and correcting your information
You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below and describe the information concerned. We may need to verify your identity before acting on a request.
In some circumstances the law permits or requires us to refuse access or correction. If that happens, we will explain the reason and available complaint options where required.
You may also ask us to delete or de-identify personal information. We will assess the request against the purposes for which the information is still needed and any legal, security, fraud-prevention, accounting or dispute-resolution requirements.
Retention and deletion
Polarbear does not currently apply fixed automatic deletion periods. Retention depends on the type of information and why it is still needed:
- Account and profile information: retained while the account is active and afterwards while needed to administer the service, respond to requests, prevent fraud or resolve disputes.
- Learning content and activity: retained to provide learning history and requested features, and while needed to operate, secure and improve those services.
- Legal acceptance and consent records: retained while needed to demonstrate which legal terms applied and to meet audit, dispute and legal requirements.
- Support, privacy and safety communications: retained while the request or issue is handled and afterwards while needed for follow-up, accountability or dispute resolution.
- Technical, analytics and security logs: retained while needed to operate, diagnose, protect and improve the Platform.
- Backups: retained until overwritten or removed through the relevant backup lifecycle.
- Subscription and transaction records: retained while needed for billing, accounting, fraud prevention, tax and other legal obligations.
When personal information is no longer needed for a permitted purpose and is not required to be retained by law, we take reasonable steps to destroy it or ensure it is de-identified.
Security
We use technical and organisational safeguards designed to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These include access controls, encryption, monitoring, backups and supplier security requirements where appropriate. No internet transmission or storage system is completely secure.
Cookies, analytics and marketing
The Platform may use cookies and similar technologies for authentication, security, preferences, analytics and feature operation. You can control some technologies through browser or product settings, although blocking essential storage may prevent parts of the Platform from working.
You may opt out of marketing communications using the unsubscribe option provided. Mandatory account, security, service and legal notices are not marketing communications and are not controlled by marketing unsubscribe preferences.
Children's privacy
Polarbear is designed for secondary-school students. We do not currently verify age or collect parental consent through the Platform. If we learn that we collected personal information from a child under 13 without appropriate authorisation, we will take reasonable steps to delete or de-identify it.
Privacy complaints
To make a privacy complaint, email privacy@trypolarbear.com with your contact details, a description of the issue and the outcome you are seeking. We aim to acknowledge your complaint and provide an initial response within 2–3 business days. We will investigate the matter and communicate the outcome as soon as reasonably practicable.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).
Changes to this policy
We may update this Privacy Policy to reflect changes to the Platform, our practices or the law. We will publish the current version and effective date and provide a mandatory email or in-platform notice of material changes. We may require you to accept a material change before continuing to use authenticated parts of the Platform.
Contact us
- Polarbear AI Pty Ltd
- ABN 29 691 267 768
- 470 St Kilda Rd, Melbourne VIC 3004
- Email: privacy@trypolarbear.com