Policies & Compliance
Published: August 2026
Review Due: September 2028
1. Introduction
Progressify Limited ("Progressify") develops SchoolTalk, a platform used by schools in New Zealand and Australia to track and report on learner progress. This AI Policy explains how and why SchoolTalk uses artificial intelligence (AI), what data is involved, the safeguards we apply, and the rights schools have over this processing.
This policy applies to all current and future AI-powered features within SchoolTalk, for schools in both New Zealand and Australia. Where a new AI feature represents a material change to how student data is handled, schools will always be notified separately and asked for consent before that feature is activated. For New Zealand schools, this is consistent with our obligations as an ST4S-certified provider and the New Zealand Privacy Act 2020. For Australian schools, the applicable privacy obligations depend on whether the school is a government or non-government school — see Section 4.2.
2. Our Principles for AI Use
Progressify applies the following principles to any AI feature introduced into SchoolTalk:
Data minimisation — AI features are designed to operate on the minimum data necessary, and wherever possible use anonymised or de-identified data rather than personally identifiable information.
No automated decisions about learners — AI is used to support and summarise information for teachers and school leaders. It does not make decisions about a learner's progression, placement, or outcomes, and does not evaluate or judge individual learners.
Human oversight — AI-generated content is a tool for teachers and leaders, not a replacement for their professional judgement. Teachers and leaders retain full visibility and control over how AI-generated content is used and communicated.
Transparency — Schools are told which AI service is used, what data is shared with it, and why, in plain language.
Consent before activation — No AI feature that processes school data is switched on for a school without that school's informed consent.
Vendor accountability — We only use AI service providers that offer contractual data protection commitments consistent with applicable privacy requirements in New Zealand and Australia, and we review these commitments as part of our ST4S certification obligations.
3. Current AI Feature: AI-Generated Progress Summaries
SchoolTalk's Progress Summary page includes an AI-generated narrative summary for each learner, per tracked subject (Reading, Writing, and Maths). Summaries are short (maximum 1,000 characters), descriptive paragraphs available in English or Te Reo Māori, and are visible only to teachers and school leaders.
What this feature does
Produces a plain-language description of a learner's current progress in a subject, generated weekly and refreshed when progress data changes.
What this feature does not do
It does not evaluate or make judgements about individual learners.
It does not make predictions about future performance.
It does not store information that could identify a learner.
It does not share data with any third party beyond the AI service described below.
3.1 What data is processed
Only anonymised academic data is sent to the AI service to generate a summary:
Sent to the AI service
Year level (e.g. "Year 4")
Subject name and progress relative to curriculum level
Sub-area scores within a subject
Current and recently achieved learning goals
Recent assessment scores and progress bands
Anonymised teacher/learner comment evidence (no names)
Never sent to the AI service
Learner name
Student ID or school-assigned identifier
Date of birth
School name or school identifier
Any other information capable of identifying a learner
Because no personal identifiers are included in any request sent to the AI service, no individual learner can reasonably be identified from that data.
3.2 Which AI service is used
SchoolTalk uses Microsoft Azure OpenAI Service (the GPT-4o-mini model) to generate progress summaries. This service was selected for its performance on structured, education-specific summarisation tasks, and because it operates within the Microsoft Azure environment SchoolTalk already relies on for hosting.
Data location: [Progressify to confirm and insert before publishing — see note below]
Contractual protections: Microsoft contractually commits that customer data submitted to Azure OpenAI is not used to train or improve Microsoft's foundation models. Data in transit is encrypted, and Progressify's use of the service operates under a separate commercial agreement between Progressify and Microsoft — independent of, and outside, any Ministry of Education-funded Google Workspace or Microsoft 365 agreement a school may hold for its own accounts.
4. Compliance Framework
4.1 New Zealand
This policy, and Progressify's use of AI within SchoolTalk generally, is governed by:
The New Zealand Privacy Act 2020 — which requires notification and, for material changes to data processing, consent from schools before processing begins.
ST4S (Safer Technologies for Schools) certification — under which Progressify is independently assessed on privacy and security practices, and is obliged to notify schools of material changes to certified products.
Because no personal identifiers are included in any request sent to the AI service, no individual learner can reasonably be identified from that data.
4.2 Australia
Australia does not have a single, uniform privacy regime for schools — the applicable law depends on the type of school:
Non-government schools (independent, Catholic, and other private schools) are generally covered by the Privacy Act 1988 (Cth) and must comply with the 13 Australian Privacy Principles (APPs), which govern how personal information is collected, used, disclosed, and stored.
Government schools are instead governed by state and territory information privacy legislation, which is not uniform across jurisdictions. Some states (e.g. New South Wales, Victoria) have dedicated privacy Acts; others (e.g. Western Australia) have no comprehensive public-sector privacy legislation, and South Australia relies on an administrative instruction rather than an Act.
Progressify, as the AI Progress Summary service provider, may itself be subject to the Privacy Act 1988 (Cth) and the APPs as an "APP entity" (for example, based on annual turnover, or where personal information is collected or disclosed for payment), independently of which privacy regime applies to a given school.
The Notifiable Data Breaches (NDB) scheme under the Privacy Act requires notification to the Office of the Australian Information Commissioner (OAIC) and affected individuals where an eligible data breach is likely to result in serious harm.
The Australian Framework for Generative AI in Schools, approved by Australian Education Ministers in 2023 and updated following a 2024 review endorsed in June 2025, sets out six national principles for the ethical and responsible use of generative AI in schools: teaching and learning, human and social wellbeing, transparency, fairness, accountability, and privacy, security and safety. This Framework is guidance rather than legislation, though some state education departments have adopted elements of it as mandatory policy for their schools.
The Office of the Australian Information Commissioner (OAIC) is developing a Children's Online Privacy Code, expected by the end of 2026, which may impose additional, more specific obligations on services (including ed-tech providers) handling children's personal information. Progressify will review this policy once the Code is finalised.
Because of this jurisdictional variation, Australian schools using SchoolTalk should confirm which privacy regime applies to their school (state/territory legislation for government schools, or the Privacy Act 1988 (Cth) for non-government schools) and raise any jurisdiction-specific questions with Progressify before consenting to the AI Progress Summary feature.
4.3 Raising a Concern
New Zealand schools may contact the Office of the Privacy Commissioner if a concern cannot be resolved directly with Progressify.
Australian schools may contact the Office of the Australian Information Commissioner (OAIC) if a concern cannot be resolved directly with Progressify.
5. School Rights and Choices
Schools using SchoolTalk have the following rights in relation to any AI feature:
Right to be informed before a new AI feature that processes school data is activated.
Right to withhold or withdraw consent at any time. Withdrawing consent disables the relevant AI feature for that school, and no further data is sent to the AI service for that school.
Right to ask questions about any AI feature, the data it processes, or the compliance assessment behind it, before or after consenting.
Right to access information about how their school's data is handled, on request.
6. How We Notify Schools of Changes
When Progressify introduces a new AI feature, or materially changes how an existing AI feature processes data, we will:
1. Issue a written notice to the school's principal or designated privacy officer, describing the feature, the data involved, and the AI service used.
2. Request explicit consent before enabling the feature for that school.
3. Continue to make the feature optional — schools may request it be disabled at any time, even after consenting.
7. Contact Us
Privacy enquiries: support@progressify.io
General enquiries: support@progressify.io
Company: Progressify Limited
This policy is reviewed periodically and updated as new AI features are introduced or existing ones change materially. Schools will always be notified separately of any material change requiring fresh consent, consistent with the New Zealand Privacy Act 2020 and Progressify's ST4S certification obligations.