1. Who we are
MyLantite (ABN 70 829 483 156) is a business based in Australia. We provide an online platform that helps individual learners prepare for the Literacy and Numeracy Test for Initial Teacher Education (LANTITE) and similar standardised exams.
We are an APP entity for the purposes of the Privacy Act 1988 (Cth) and we are bound by the Australian Privacy Principles (APPs). If you have any questions about this policy, you can contact us at [email protected].
2. What we collect
We collect only the personal information that we need to provide the service. Specifically:
- Account details
- Your first and last name, email address, date of birth, and a hashed password. We never store your password in a form we can read.
- Profile preferences
- An optional avatar and your communication preferences.
- Study activity
- The practice questions you attempt, the answers you give, the lessons you complete, and the progress and mastery scores we calculate from that activity.
- Payment and billing
- If you subscribe, our secure payment processing gateway collects your card details directly - we never see or store your card number. We do receive and store billing metadata such as your subscription plan, the amount charged, the invoice line items, and the last four digits of the card so that we can show you which card was used.
- Sign-in via a third-party provider
- If you choose to sign in with a third-party sign-in provider (the options are shown on the sign-in screen), we receive your name, email address, and (where the provider supplies it) avatar URL and date of birth. We never receive your password from these providers.
- Signing in with Google
- If you sign in with Google, we receive from your Google account only your name, email address, profile picture and Google account ID. We use them only to create your MyLantite account, sign you in, and show your name and picture in the app. We do not keep any access to your Google account after sign-in, we do not use Google user data for advertising, and we do not sell it or share it with anyone. It is deleted when you close your account (section 9.3). You can disconnect MyLantite from your Google account at any time at myaccount.google.com/permissions.
- Device and session data
- For each device you sign in from, we keep the IP address, browser/user-agent string, and the time it was last used, so you can see where you are signed in and end a session you don't recognise.
- Communications history
- A record of the emails we have sent you, the link you clicked to verify your email, and whether each email was delivered or failed to send. We do not track whether you open an email.
- Support correspondence
- If you email us at [email protected], we keep that correspondence so we can follow up.
We do not ask for or store: your home address, phone number, government identification number, tax file number, health information, or financial-institution account details.
3. Why we collect it
We collect the information above for these purposes (APP 5):
- To provide the service - creating your account, delivering practice questions, scoring attempts, and producing the analytics that tell you where to focus.
- To verify your age - we require users to be at least 16 years old, and your date of birth is how we confirm that.
- To charge for paid subscriptions - through our payment processing gateway, and to issue invoices and receipts.
- To communicate with you - transactional emails such as email verification, password reset, payment receipts, trial-ending notices, and security alerts. If you opt in, occasional product or marketing emails.
- To improve the product - we look at aggregate, de-identified usage patterns to understand which content is hardest, where users get stuck, and what to build next.
- To protect the service - to detect abuse, prevent fraud, and meet our legal obligations under Australian law.
We do not need your personal information for any other purpose. If we ever decide to use it for something not listed above, we will update this policy and, where the law requires, ask for your consent before doing so.
Providing your information is voluntary, but most of it is required for the service to work - we cannot create an account, charge a subscription, or deliver content without it. If you choose not to provide it, we will not be able to provide the service to you.
4. How we use your information
Under APP 6 we only use your personal information for the purposes for which it was collected (the primary purposes listed above) or for closely related secondary purposes that you would reasonably expect.
We do not:
- Sell your personal information to any third party.
- Rent, trade, or otherwise commercially exploit your personal information.
- Share your personal information with advertisers or advertising networks.
- Use third-party analytics SDKs - we do not run any third-party tracking on the site or in the app.
- Use your personal information to train or improve AI models.
5. When we share your information
We share personal information only with the small set of service providers we rely on to operate MyLantite. Each provider is listed below with the data category we send them and the country in which their primary infrastructure sits. See section 6 for the APP 8 cross-border framework that applies to providers located outside Australia.
- Our payment processing gateway - payment processing, including invoice generation. It receives your name, email, card details (directly from your browser; we never see the card number), and the line items on your invoice.
- Our cloud infrastructure and database hosting provider - hosting infrastructure for the database, application servers, file storage, and outbound email (a transactional email delivery service). That provider receives whatever data we store with them, including all of the categories listed in section 2 above.
- Authentication utility services (third-party sign-in providers) - only if you choose to sign in via one of them. The provider receives the fact that you signed in, and we receive the limited profile data described in section 2.
- Content delivery and edge security network - sits in front of our servers, terminates your encrypted connection, and sees your IP address and the pages you request. It also filters abusive traffic.
- Your payment receipts - we do not share these with anyone other than you and our payment processing gateway. We do not provide your invoices to the ATO unless legally compelled to do so.
We may also disclose your personal information without your consent if we are required or authorised to do so by law - for example, in response to a valid court order, subpoena, or lawful request from an Australian regulator.
6. Overseas disclosures (APP 8)
Our primary database, application servers, file storage, and outbound email are all hosted with our cloud infrastructure provider in its Australian region. That means almost all of your personal information stays in Australia.
Payment processing is the one service that genuinely sends your personal information overseas. Two further services touch your data as part of their worldwide operation rather than storing it in a specific country we can name. APP 8 requires us to disclose all three clearly:
6.1 Payment processing - United States
Our secure payment processing gateway is headquartered in the United States. When you subscribe or update your payment method, your name, email, card details, and billing line items are processed by that provider's US-based infrastructure. Its Data Processing Agreement and Standard Contractual Clauses provide the safeguards required under APP 8. For full detail on how it handles data, see its own privacy policy and Data Processing Agreement.
6.2 Authentication utility services
If you choose to sign in with a third-party sign-in provider, you are exchanging sign-in data directly with that provider. These are large, multinational services, and we do not control - and cannot confirm - exactly where they process or store it. We only ever receive back the limited profile they return to us (name, email, and, where supplied, an avatar URL and date of birth). Your interaction with the provider is also subject to its own privacy policy. You can avoid this exchange entirely by signing up with an email and password instead.
6.3 Content delivery and edge security network - worldwide
Requests to MyLantite pass through an edge network with servers in many countries before reaching our Australian infrastructure, so your IP address and requested page transit whichever edge location is nearest you at the time. This is how the service stays fast and protected from abusive traffic; it does not change where your account data is stored.
7. Security (APP 11)
We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. The measures we currently rely on include:
- Passwords are stored using a strong one-way hash - never in clear text - designed to make brute-force attempts computationally expensive.
- Passkeys are available as a passwordless sign-in option - see the FIDO Alliance's overview of passkeys for how they work.
- OAuth sign-in flows use signed state tokens to prevent cross-site request forgery.
- All traffic between your browser and our servers is encrypted via TLS.
- An immutable audit log records sign-ins, admin actions, billing changes, and other security-relevant events. Administrators cannot delete audit entries.
- Administrator access is restricted to a small set of authorised operators.
- We run automated vulnerability scans across our software dependencies and address advisories on a defined schedule.
- Database backups are stored encrypted at rest and retention is limited to what we need to recover from a failure.
No system can be guaranteed completely secure. If we become aware of an actual or suspected breach, we follow the process described in section 12.
9. Your rights - access, correction, export
9.1 Accessing your information (APP 12)
You can view and edit most of your account details from inside the app at Settings → Profile - including your name, email address, date of birth, and avatar - and Settings → Security - including your password and passkeys. Your subscription, invoices, and payment history are visible at Settings → Billing.
If you want a full copy of the personal information we hold about you - including your practice attempts, lesson progress, communications log, and audit-log entries - email us at [email protected] with the subject line "APP 12 data access request". We will provide your data in a machine-readable format within 30 days, in line with OAIC guidance. There is no fee for this.
9.2 Correcting your information (APP 13)
Every profile field can be corrected at Settings → Profile. If something cannot be changed from the app, email us at [email protected] and we will update the record. If we disagree that a correction is required, we will tell you why and note your request in our records.
9.3 Deleting your account
You can close your account at any time by emailing [email protected] from the address on your account. We action closures within 7 business days. When you close your account we deactivate it and stop using your personal information, and we remove it from our system except where we are required by law to retain it - for example, tax invoices, which we must keep for five years under Australian Taxation Office record-keeping rules. We will not use the retained records for any purpose other than meeting that obligation.
We also keep a security record of activity on a closed account - things like sign-ins and account changes - with your name and other identifying details removed rather than the record itself deleted. We only use this de-identified record to detect and investigate misuse; we do not use it to re-identify you or to contact you.
10. Marketing and opt-out (APP 7 + Spam Act)
We only send you marketing emails (such as feature announcements, study tips, or promotional offers) if you have opted in. You can change this preference at any time from Settings → Notification preferences, or by clicking the "Unsubscribe" link at the bottom of any marketing email - that link works without you needing to sign in first, in line with section 18 of the Spam Act 2003 (Cth).
Even if you have opted out of marketing, we will still send you essential transactional emails - payment receipts, payment-failure notifications, password resets, security alerts, email-verification links, and any communications we are legally required to send. There is no way to opt out of those without closing your account.
11. Children
MyLantite is intended for users who are at least 16 years old. When you sign up using an email and password we ask for your date of birth and refuse the account if it indicates you are under 16. When you sign up via a social provider we ask for your date of birth in an interstitial step and apply the same check.
If you believe we hold information about a child under 16, contact us at [email protected] and we will delete the account and all associated personal information.
12. Data breaches (NDB scheme)
We are subject to the Notifiable Data Breaches scheme set out in Part IIIC of the Privacy Act 1988 (Cth). If we become aware of an eligible data breach - that is, unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to an affected individual - we will:
- Contain the breach and investigate the cause.
- Assess whether the breach is "eligible" within the meaning of the NDB scheme.
- If it is, notify the Office of the Australian Information Commissioner (OAIC) and each affected individual as soon as practicable and in any case within 30 days of forming a reasonable belief that an eligible breach has occurred.
- Tell you what was accessed, what we are doing about it, and the steps you can take to protect yourself.
13. Complaints
If you have a privacy complaint, please contact us first at [email protected] with the subject line "Privacy complaint". We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
- Web: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
14. Updates to this policy
We may update this policy from time to time. If we make material changes - for example, introducing a new category of data we collect, adding a new overseas service provider, or changing how we use your information - we will:
- Email all signed-up users in advance.
- Show an in-app banner pointing to the updated policy for at least 30 days.
- Update the "Last reviewed" date at the top of this page.
Minor edits (typos, restructuring, clearer phrasing without changing meaning) may be applied without notification.
15. Contact us
For any privacy question, access request, correction request, complaint, or breach report, email [email protected]. We aim to respond within 7 business days.