Children's Data Collection Statement

Gabuu — Children's Data Collection Statement

Effective Date: 27 February 2026

Last Updated: 27 February 2026

This Statement supplements the Gabuu Privacy Policy and specifically addresses how Gabuu collects, uses and protects information relating to children and young people under the age of 18.

Gabuu is operated by Geoff Mallinson as an unincorporated entity based in New South Wales, Australia. The Platform is accessible at gabuu.app.

1. Our Commitment

Gabuu is designed for use by students, including children under 18, in school and institutional settings. We recognise that the handling of children's personal information requires heightened care and transparency, consistent with the guidance issued by the Office of the Australian Information Commissioner (OAIC) and the principles of the Privacy Act 1988 (Cth).

We are committed to:

• Collecting only the minimum personal information necessary
• Being transparent about what we collect and why
• Ensuring children are not exposed to unnecessary risk through the Platform
• Supporting schools and parents in understanding how children's data is handled

2. How Children Access the Platform

Access to Gabuu for children under 18 is typically mediated through their school or educational institution. In practice, this means:

• A teacher or school administrator creates or authorises student accounts
• The school is responsible for obtaining any necessary parental or guardian consent before a student's information is provided to Gabuu
• Where a student signs up directly, they are asked to provide their school or institution name

Gabuu does not independently verify the age of users. We rely on schools and educators to manage the appropriateness of student access.

3. What Information We Collect About Children

We collect the following personal information about student users:

What we do not collect from children

• Date of birth or age
• Government identifiers (e.g. student numbers issued by government)
• Home address or phone number
• Sensitive information (as defined under the Privacy Act)
• Photos, videos, or biometric data
• Location data (beyond country/region level via analytics)

4. How We Use Children's Information

Children's personal information is used solely to:

1. Provide the learning experience — manage accounts, deliver content, and operate adaptive study features
2. Support educators — provide authorised teachers and administrators with aggregated engagement and performance data
3. Improve the Platform — through de-identified, aggregated analytics (Vercel Analytics, which does not use cookies or collect PII)

We do not use children's information for:

• Marketing or advertising
• Profiling for commercial purposes
• Sale or trade to third parties
• AI model training

5. Artificial Intelligence and Children's Data

Gabuu uses AI models (Claude by Anthropic, OpenAI) to assist with flashcard generation and content creation.

No user-identifiable information — including children's personal information — is ever sent to any AI model. Only de-identified subject matter content is transmitted for the purpose of generating learning materials.

There is no open chat interface to AI on the Platform. AI functionality is limited to specific, educator-directed content creation tasks.

6. Safety by Design

The Platform incorporates the following design choices to protect children:

• No social features — there is no user-to-user messaging, commenting, or social interaction
• No open AI chat — students cannot freely interact with AI models
• Educator-controlled content — the primary content source is material created and curated by teachers, reducing exposure to inappropriate material
• No advertising — there are no ads, sponsored content, or commercial tracking
• No gamification mechanics designed to create dependency — the Platform uses streaks and spaced repetition scheduling grounded in cognitive science, not engagement manipulation

7. Disclosure of Children's Information

Children's personal information may be disclosed to:

• Authorised educators and school administrators — engagement and performance data necessary for teaching and learning
• Service providers — Supabase (database, Sydney AU) and Vercel (hosting and analytics, Sydney AU) process data on our behalf under appropriate contractual safeguards
• Legal authorities — only where required by law, court order, or to comply with the Notifiable Data Breaches scheme

We do not sell, rent, or trade children's personal information.

8. Data Storage and Security

• All personal information is stored in Australia (Supabase, Sydney region)
• Infrastructure is SOC 2 compliant (Vercel)
• Data is encrypted in transit (TLS) and at rest
• Access to personal information is restricted to authorised personnel only
• A minimum 14-character password is required for all accounts

9. Parental and Guardian Rights

Parents and guardians have the right to:

• Request access to the personal information Gabuu holds about their child
• Request correction of inaccurate or outdated information
• Request deletion of their child's account and personal information
• Withdraw consent for their child's use of the Platform (noting that this may need to be coordinated with the relevant school)

To exercise any of these rights, please contact:

• Your child's school in the first instance (as the school typically manages student access), or
• Gabuu directly at contact@gabuu.app

We will respond to requests within 30 days.

10. Data Retention

• Student account data is retained for the duration of the account
• Upon request from a parent, guardian, or school, we will delete or de-identify a student's personal information within 30 days
• De-identified usage analytics are retained in aggregated form
• User-generated content may be retained in de-identified form to support institutional content libraries, unless deletion is specifically requested

11. Changes to This Statement

We may update this Statement from time to time. Material changes will be reflected in the “Last Updated” date and, where practicable, communicated to schools and users via the Platform.

12. Contact

For questions or concerns about how we handle children's personal information:

Email: contact@gabuu.app

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.