Privacy Policy

Last updated: 17 October 2026

Vertex Academy ("we", "us") provides tutoring, olympiad entries, holiday programmes, university tours, study tours and help with studying in New Zealand, from our centre in Avondale, Auckland, our website, our parent and student portal, and our mobile app. This policy explains what personal information we collect, why, who else handles it and where, how long we keep it, and what you can ask us to do with it, in line with the New Zealand Privacy Act 2020.

Questions, or a request to see, correct or delete your information: email hello@vertexacademy.co.nz.

What we collect, form by form

Every form on our site that asks for personal details has a short note under it linking here. Most of what we hold about a family who is not yet a member comes from one of these:

• Free assessment form (Tutoring page): your child's name, year level and subjects, the centre and assessment time you prefer, your name, email and phone, how you heard about us, a referrer's name or promo code if you give one, and any message. We use it to arrange and confirm the assessment and to follow up.
• English waitlist: your email address, only to tell you when English tutoring opens.
• Free placement test: your child's first name, year level, subject, their answers and the result, so we can work out and show the result. If you ask for the report by email we also take your email and, if you add them, your name and phone. If you ask for an NCEA assessment instead, we take your name, phone, email and preferred time.
• Free maths practice: your name, email and the practice result, if you ask us to email you the plan.
• Programme forms (NextGen, Infomatrix and GENIUS olympiads, EduVentures, University Tours) and the Study in New Zealand enquiry form (in six languages): the student's or group's name, year level or age, your name, email, phone if you give it, and your message. We use it to answer your enquiry.
• Holiday programme booking: your child's name and year level, your name, email and phone, and any notes, to arrange the booking.
• Free NCEA practice marking: first name, email, school, a parent or caregiver's name and email if the student is under 18, photos of the answers and the marks. That page explains how marking works.
• Free NCEA study coach: nothing, unless you choose to save. The standards you type in stay in your browser. If you sign in and save, we keep your email address and the plan you entered (year, the level and goals you chose, and your standards and results), only so you can open it again. We do not use it to contact you, and we do not share it with anyone, including our tutors.
• Job applications (Careers page): your name, contact details, subjects, qualifications, experience, availability and referees, to assess your application.

With an enquiry we also store which campaign link, landing page and referring website brought you to us, so we know which of our outreach works. We do not store this if your browser sends Do Not Track or Global Privacy Control.

Once a child becomes a member we also hold:

• Learning records: placement and practice test results, curriculum progress, attendance, and tutor notes about learning, to teach and to report progress to you.
• Payment records: membership and payment status. Card details are handled by Stripe and never reach our systems.
• Notifications: if you turn on app notifications, the technical subscription your device gives us, so we can send session reminders. You can turn this off in the app at any time.

Website statistics. We count page views ourselves: the page, the referring site, the device type and a rough country. We store no name, cookie or IP address with it, and nothing at all if your browser sends Do Not Track or Global Privacy Control. Our public pages also use Google Analytics, which sets cookies and receives the address of each page you view, the referring site, your device and browser, and an approximate location worked out from your IP address. It does not receive the details you type into a form, and it is not used on the unsubscribe page, the parent portal, the student portal or the staff admin. You can block it with your browser's cookie settings or Google's opt-out add-on.

Children's information

Our forms are for parents and caregivers, who give us their child's details. We collect student information from and with the consent of a parent or caregiver, except NCEA practice marking, where a student under 18 must give a parent or caregiver's name and email and confirm their consent, and the NCEA study coach, which asks a student under 16 to have a parent or caregiver sign in to save a plan. Student portal logins are only created at a parent's or our centre's instigation, and student accounts see their own timetable, worksheets and progress, never billing or payment information.

How we use it

We use personal information only to run our services: replying to enquiries, arranging assessments and bookings, placing students at the right level, running sessions, tracking and reporting progress, processing payments, and sending service messages (confirmations, reminders, progress reports and announcements).

• Follow-up emails. After an enquiry about tutoring (including from the placement test or maths practice) we may send up to two short follow-up emails in the following weeks, unless we have already been in touch. Each has a one-click unsubscribe link. Using it stops all follow-up emails to that address, for this enquiry and any later one, and we keep a record of the opt-out (the email address and the date) so that we keep honouring it. You can also reply and ask us to stop.
• Spotting repeat enquiries. Our staff screens show when the same email address or phone number has made more than one enquiry, so a family is not contacted twice or treated as a stranger.
• AI-assisted writing. We use Claude, an AI model made by Anthropic, to help write some emails (details below). A member of staff reads and approves every reply to an enquiry before it is sent.

We do not sell personal information, and we do not use it for third-party advertising.

Who else handles it, and where

We use these service providers. Each receives only what it needs for its job:

• Supabase: our database, sign-in, file storage and server functions. It holds everything described above. Data centre in Singapore.
• Railway: hosts the website itself. It sees the address of each page requested and your IP address, as any web host does, but not what you type into a form (forms go straight to Supabase). United States.
• Resend: sends our emails (acknowledgements, confirmations, follow-ups, reports, staff notifications), so it handles the recipient's address and the email's contents, which include names and enquiry details. United States.
• ImprovMX: forwards email sent to hello@vertexacademy.co.nz to our staff inboxes. United States.
• Anthropic (Claude AI): receives the child's name, year level and placement test scores to write the short note in an emailed placement report; an enquiry's student and contact names, year level, subjects, preferred time and message (not the email address or phone number) when staff ask for a draft reply; a member's name, year level, attendance, test results and tutor notes for the monthly progress report; and NCEA practice marking photos. Under its commercial terms Anthropic does not train its models on this data. United States.
• Telegram: the owners of Vertex Academy get a message in a private Telegram group for each new enquiry, so whoever is free can call the family. It contains the child's name, the parent's name, phone and email, year level, subjects, preferred centre and time, how you heard about us, which form was used, and any message; and later, the child's first name with the confirmed assessment time. Telegram's servers are outside New Zealand.
• Stripe: processes card payments for memberships and programme fees. It receives payment details directly from you, and the payer's name, email and what is being paid for from us. United States and other countries.
• Google: Google Analytics, as described above, and the fonts our pages use, which your browser downloads from Google (Google sees your IP address and browser, as with any download). Our maths video lessons play from youtube-nocookie.com only when you press play. United States.

Cloudflare runs our domain's DNS (the internet's address book for vertexacademy.co.nz); no form data passes through it.

Information sent overseas

Apart from our staff in Auckland, everyone above is outside New Zealand, so your information is stored and processed in Singapore, the United States and other countries whose privacy laws are not the same as ours and may not protect it in the same way. These providers handle it on our behalf to deliver our services; we do not give it to them to use for their own purposes, and we remain responsible for it under the Privacy Act. We choose established providers with strong security, and we send each one only what its job needs. If you would rather your details did not leave New Zealand, contact us before you send a form and we will talk about alternatives (for example, by phone).

How we protect it

All data is encrypted in transit (HTTPS). Access is restricted by role: parents and students see only their own family's records, staff access is limited, and we keep a log of who views student performance data. Our forms are protected against automated abuse; for that we keep short-lived counters keyed to a scrambled (keyed hash) version of your IP address, never the address itself.

How long we keep it

An automatic job runs every night and applies these rules:

• Enquiries that do not lead to membership: 12 months after the last contact with that family (the enquiry, an email from us, a booking or a test), we remove the names, email address, phone number, message and referral details. What is left cannot identify anyone (dates, which form was used, the outcome, year level and subjects) and is kept for our own statistics, such as how quickly we reply.
• Emails we sent about such an enquiry: deleted at the same time.
• Placement test results: if no enquiry or membership is linked to a result, it is deleted after 90 days. If it is linked to an enquiry, it is anonymised along with that enquiry.
• Unsubscribe records: kept for as long as we need to honour the opt-out, holding only the email address and the date.
• Saved NCEA study coach plans: deleted 2 years after you last saved, or straight away when you press "Delete saved plan". The sign-in account (your email address) stays until you ask us to delete it.
• Abuse-prevention records: the scrambled IP counters are deleted after 2 days, and the record of which addresses got an acknowledgement email (used to stop repeat emails) after 7 days.

Some things the nightly job cannot reach:

• Telegram messages and staff inboxes. Copies of new-enquiry notifications stay in the owners' Telegram group and in our staff email until someone deletes them by hand. We delete them when you ask us to delete your information, but we cannot control any copies Telegram or an email provider keeps on its own systems.
• Emails already sent stay in your inbox, and in the email provider's logs for its own retention period.
• Google Analytics keeps its statistics for the period set in our Google account, at most 14 months.

Other records: NCEA practice marking submissions and photos are deleted by 31 March 2027, as that page promises. Learning records are kept while a student is enrolled and for a reasonable period afterwards, so a returning student can pick up where they left off. Payment records are kept as New Zealand tax law requires (typically 7 years). Holiday programme bookings and job applications are kept while they are relevant to the booking or the role; ask us and we will delete yours sooner.

Your rights, and deleting your account or data

Under the Privacy Act 2020 you may ask for a copy of the personal information we hold about you or your child, ask us to correct it, or ask us to delete it, whether or not you are a member.

To ask, email hello@vertexacademy.co.nz, ideally from the address you gave us, saying what you want: a copy, a correction, your whole account deleted, or only specific data removed. We confirm your identity and respond within 20 working days.

What's deleted: your contact details, your child's details, enquiry records, test results, learning records, tutor notes and progress history, and the copies in our Telegram group and staff inboxes.
What's kept, and for how long: payment and membership records, which New Zealand tax law requires us to retain (typically 7 years); an unsubscribe record, if you asked to stop follow-up emails, so we keep honouring it; and the minimum needed to comply with other legal obligations.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner.

Contact

Vertex Academy Avondale
2163 Great North Road, Avondale, Auckland 0600
hello@vertexacademy.co.nz

If we make material changes to this policy, we will update this page and note the new date above.