ReviZi logo revizi

ReviZi — Privacy Policy

Last Updated: 2 October 2026

Effective Date: 16 October 2026

ReviZi ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you use the ReviZi application and related services (the "Service").

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) and applicable state and territory privacy legislation.

1. Who We Are

ReviZi is an AI-powered study platform operated in Australia. Our database, file storage and server functions are hosted by Google Cloud (Firebase) in the australia-southeast1 (Sydney) region. Some of the service providers we rely on process data outside Australia, including in the United States. Section 7 lists each of them and Section 11 explains these overseas disclosures.

Privacy Contact:

Email: support@revizi.com.au

Website: [www.revizi.com.au]

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, and password when you create an account. If you sign in via Google or Apple, we receive your name and email from those providers.
  • Profile Information: Year level, curriculum (e.g., HSC, VCE, QCE), and subject preferences you provide during onboarding.
  • Uploaded Content: Documents (PDF, DOCX, PPTX) and images you upload for flashcard generation, and the answers, essays and photos of written work you submit for marking or feedback.
  • Payment Information: Paid plans are not yet on sale. When they are, payment will be processed by Stripe, and we will not store your card details ourselves.
  • Communications: Messages you send to us via email or in-app support.

2.2 Information We Collect Automatically

  • Usage Data: Features used, flashcards studied, quiz scores, study streaks, session durations, and generation counts.
  • Device and Technical Data: Device type, operating system, browser type, screen resolution, app version, and general location (derived from IP address, at the city/state level only — not precise GPS).
  • Error and Performance Data: Crash reports, error logs, and performance metrics to help us improve the Service.
  • Analytics: We use Google Analytics 4 to measure which pages are visited and how the Service is used (pages viewed, referring site, device and browser type, and city-level location). Google Analytics 4 does not log or store IP addresses. We use this data in aggregate to improve the Service, not for advertising.

2.3 Information We Do NOT Collect

  • We do not collect precise geolocation (GPS) data.
  • We do not collect biometric data.
  • We do not collect data from your device's contacts, camera, or microphone (except when you voluntarily upload an image for processing).
  • We do not use tracking cookies for advertising purposes.

3. How We Use Your Information

We use your information for the following purposes:

  • Providing the Service: Processing your uploaded documents, generating flashcards and quizzes, tracking your study progress, and managing your account.
  • AI Processing: Your uploaded content and submitted answers are sent to third-party AI providers (currently Google Gemini and OpenAI) solely to generate study materials and to mark or give feedback on your work. See Section 6 for details.
  • Service Improvement: Analysing aggregated, de-identified usage patterns to improve features, fix bugs, and optimise performance. De-identified data does not identify you and cannot reasonably be re-identified.
  • Communications: Sending you service-related messages (account verification, password resets, subscription confirmations, important updates). We do not send marketing emails without your explicit consent.
  • Security and Fraud Prevention: Detecting and preventing abuse, unauthorised access, and violations of our Terms of Service.
  • Legal Compliance: Complying with applicable laws, regulations, legal processes, or enforceable government requests.

4. How We Store and Protect Your Information

4.1 Storage Location

Your study data, uploaded documents and generated study materials are stored on Google Cloud Platform (Firebase) servers in the australia-southeast1 (Sydney) region. Your sign-in account record (name, email address and sign-in details) is held by Firebase Authentication, which Google operates on global infrastructure that may include the United States. Copies of content sent to the providers listed in Section 7 are processed where those providers operate.

4.2 Security Measures

We implement reasonable technical and organisational measures to protect your information, including:

  • Encryption of data in transit (TLS/HTTPS) and at rest.
  • Firebase Authentication for secure account management.
  • Firestore security rules restricting data access to authenticated account holders.
  • Server-side validation and rate limiting to prevent abuse.
  • Regular security reviews and dependency monitoring.

4.3 No Absolute Security

We take reasonable steps to protect your information. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

5. Retention and Deletion

5.1 Account Data

We retain your account information and study data for as long as your account is active. If you delete your account, we will delete or de-identify your personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, enforcing our Terms).

5.2 Uploaded Documents

Uploaded documents are stored for the purpose of content generation and are associated with your account. You may delete individual uploads through the app. When you delete your account, all associated uploads are deleted within 30 days.

5.3 AI Processing

We do not keep the copy of your content that we send to an AI provider beyond what is needed to complete the request. The AI providers may keep it for a limited period under their own terms, for example to detect abuse. See Section 6.

5.4 Temporary Files

Temporary files created during document processing (e.g., extracted text, OCR results) are automatically deleted within 7 days via automated lifecycle policies.

6. Third-Party AI Processing

6.1 How AI Processing Works

When you generate flashcards, quizzes, notes or summaries, or ask for your answers or essays to be marked, the content needed for that request is sent to a third-party AI provider through its API. The provider processes it and returns the generated study content or feedback. We currently use:

  • Google Gemini API (Google LLC): our main AI provider, for reading uploaded documents and images, generating study materials, and marking answers and essays. Processed in the United States and other countries where Google operates.
  • OpenAI API (OpenAI, L.L.C.): a backup provider, also used for reading some images and documents and for some generation and marking tasks. Processed in the United States.

6.2 What We Send

We send the content of your documents (as text, images or the file itself), the answers, essays or photos of written work you submit, and the instructions we write for the AI. We do not intentionally send your name, email address or account details. However, your uploads may contain personal information (for example, your name on an assignment or a school letterhead), and that information will be sent with them.

6.3 AI Provider Policies

We use the paid, business API services of these providers. Under their API terms as at the date of this policy, Google and OpenAI do not use content submitted through these paid APIs to train their models, but they may keep it for a limited time, for example to monitor for abuse. We do not control these providers' policies, and they may change. We encourage you to read Google's and OpenAI's privacy and API data-use policies directly.

6.4 No AI Training on Your Content

ReviZi does not use your uploaded content or generated materials to train any AI models, and we do not permit third-party providers to do so on our behalf through our API usage.

7. Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

  • Service Providers: With the third-party providers that help us run the Service, listed in Section 7.1. They are bound by their terms with us to protect your data and to use it only to provide their services to us.
  • Legal Requirements: Where required by law, regulation, legal process, or enforceable government request.
  • Safety and Rights Protection: Where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud or security issues.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
  • With Your Consent: In any other circumstance where you have given explicit consent.

We do not share your data with advertisers or ad networks.

7.1 Our Service Providers

  • Google Cloud and Firebase (Google LLC): hosting, database, file storage, server functions and sign-in (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Firebase Hosting). Data: your account, study data and uploads. Location: Sydney (australia-southeast1) for the database, storage and functions; sign-in records and the website delivery network run on Google's global infrastructure, which may include the United States.
  • Google Sign-In and Sign in with Apple (Google LLC, Apple Inc.): only if you choose to sign in with them. Data: your name and email address. Location: United States.
  • Firebase App Check with Google reCAPTCHA (Google LLC): protects our servers from bots and abuse. Data: technical information about your browser and device and how you interact with the page. Location: United States and other countries where Google operates.
  • Google Gemini API (Google LLC): AI processing, see Section 6. Data: uploaded documents and images, submitted answers and essays. Location: United States and other countries where Google operates.
  • OpenAI API (OpenAI, L.L.C.): AI processing, see Section 6. Data: uploaded documents and images, submitted answers and essays. Location: United States.
  • Resend (Resend, Inc.): sends our emails, such as sign-up verification codes, password resets, account notices and study reminders. Data: your email address, your name and the content of the email. Location: United States.
  • Sentry (Functional Software, Inc.): error and crash reporting. Data: error details, a random account identifier, device, browser and app version information, and technical request information. We remove email addresses before reports are sent. Location: United States.
  • Google Analytics 4 (Google LLC): usage measurement, see Section 2.2. Location: United States and other countries where Google operates.
  • Stripe (Stripe, Inc.): payments, once paid plans go on sale. Data: your email address, your plan, and the payment details you enter directly with Stripe. Location: United States and other countries where Stripe operates.

8. Children and Young People

8.1 Our Approach

ReviZi is designed for ATAR students, who are typically aged 15 to 18. We recognise that many of our users are minors and take additional care with their data.

8.2 Consent

In accordance with guidance from the Office of the Australian Information Commissioner (OAIC), we generally assume that individuals aged 15 and over have the capacity to consent to the collection and use of their personal information for the purposes described in this policy. If you are under 15, a parent or guardian must give permission before you create an account. When you sign up, you confirm that you are 15 or older, or that you have a parent's or guardian's permission.

8.3 Protections for Minors

  • We collect only the minimum information necessary to provide the Service.
  • We do not serve targeted advertising to any users, including minors.
  • We do not sell or share minor users' data with third parties for marketing purposes.
  • We do not use manipulative design patterns to encourage data sharing.
  • Parents or guardians may contact us at support@revizi.com.au to review, correct, or request deletion of their child's personal information.

8.4 Evolving Regulations

Australia's Children's Online Privacy Code is currently being developed by the OAIC. We are committed to complying with the Code when it comes into effect and will update this policy accordingly.

9. Cookies and Local Storage

9.1 What We Use

ReviZi is a Progressive Web App (PWA) and uses the following browser technologies:

  • Session Storage: For temporary data during your active session (e.g., navigation state, generation progress). Cleared when you close the browser tab.
  • Firebase Authentication Tokens: Stored securely by Firebase to maintain your login session.
  • Service Worker Cache: For offline functionality and faster loading of the app.
  • Analytics Cookies: Google Analytics 4 sets first-party cookies (names beginning with _ga) so repeat visits can be told apart. They hold a random identifier, not your name or email, and are not used for advertising.

9.2 What We Don't Use

  • We do not use third-party advertising cookies.
  • We do not use cross-site tracking technologies.
  • We do not participate in ad networks or retargeting platforms.

10. Your Rights

Under the Australian Privacy Principles, you have the right to:

  • Access: Request access to the personal information we hold about you.
  • Correction: Request correction of inaccurate, incomplete, or out-of-date personal information.
  • Deletion: Request deletion of your personal information (subject to legal retention requirements).
  • Complaint: Lodge a complaint with us if you believe we have mishandled your personal information.
  • Opt-Out: Opt out of non-essential communications at any time.

How to Exercise Your Rights

Contact us at support@revizi.com.au. We will respond to your request within 30 days. We may request documentation to verify your identity before processing your request. If we are unable to reasonably verify your identity, we may refuse the request to protect your account security.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

11. International Data Transfers

11.1 Where Your Information Goes

While your study data and uploads are stored in Australia, some of your personal information is disclosed to, and processed by, the service providers listed in Section 7.1 outside Australia, mainly in the United States. In particular:

  • AI processing: the content of your uploads and the answers and essays you submit are sent to Google (Gemini API) and OpenAI, and processed in the United States and other countries where they operate.
  • Sign-in: your account record is held by Firebase Authentication on Google's global infrastructure.
  • Email, error reporting, analytics, bot protection and payments: handled by Resend, Sentry, Google Analytics, Google reCAPTCHA and (once paid plans go on sale) Stripe, in the United States.

11.2 How We Protect It

Data is sent to these providers over encrypted connections (TLS). We take reasonable steps, including relying on each provider's data-protection terms, to ensure your information receives a level of protection comparable to that required under Australian law.

11.3 Your Consent to Overseas Disclosure

By using the Service, you consent to the disclosure of personal information to overseas recipients as described in this policy. You acknowledge that overseas recipients may be subject to privacy laws that differ from Australian law, and that Australian Privacy Principle 8.1 may not apply to the extent permitted by your consent.

12. Data Breach Notification

If we experience an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth) that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with our legal obligations under the Notifiable Data Breaches (NDB) scheme.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. If we make material changes, we will notify you via email or in-app notification at least 14 days before the changes take effect.

We encourage you to review this policy periodically. Your continued use of the Service after changes are notified constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, please contact us:

Email: support@revizi.com.au

Website: [www.revizi.com.au]

Complaints to the OAIC:

Office of the Australian Information Commissioner

Website: www.oaic.gov.au

Phone: 1300 363 992

*This Privacy Policy was last reviewed on 2 October 2026.*

Questions about this document? Email support@revizi.com.au. See also our Terms of Service.