Sandbox Sim Privacy Policy

Effective date: 14 November 2026  |  Version: 2.0

1. Who we are

ClickOracle Pty Ltd ("we", "us", "our") of Brisbane, Queensland operates the Sandbox Sim platform and related services (the "Service"). This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use the Service. It forms part of, and should be read together with, our Terms and Conditions. Capitalised words that are defined in those Terms have the same meaning here. In this Policy a creator is anyone who authors Simulations on the Service: a Subscription Owner, or an Instructor authoring on a Subscription Owner's Account. Royalties are paid to the Subscription Owner only (1.2).

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where another privacy or data protection law applies to our handling of personal information, we also comply with the obligations that apply to that handling.

1.1 Our role. When you register an Account yourself, subscribe, author Simulations on your own Account or contact us, we decide how and why your personal information is handled: we are the controller of that information. When you use the Service as an End User or Student enrolled by a Subscription Owner such as a school, university or employer, or work on a Subscription Owner's Account as an Instructor it invited, that Subscription Owner decides why personal information is processed in connection with your use of its Account and how it is used for its own purposes. We handle that information on the Subscription Owner's behalf as its processor (for enrolled users, see clause 5.2 of our Terms). An Instructor's own account details are not part of this: they are the Instructor's own, and we are their controller (1.2). The Subscription Owner's own privacy notices apply to that processing alongside this Policy, and where the law requires it we may refer a request about that information to the Subscription Owner rather than act on it ourselves.

The protection of content and accounts described in 2.21 is different: we carry it out for our own purposes, so we are its controller for every user, including Instructors and enrolled Students. So are the records we keep to run, secure, meter and account for the Service itself, such as security logs, Token usage, billing and royalty records, and aggregate statistics (2.3, 2.7, 2.11).

1.2 How accounts are created, and what this Policy covers for each. There are four ways to hold an account, and the information we collect differs for each:

• Subscription Owners register themselves, verify their email address and choose a plan, or register through an invitation we email them for an invoice-billed plan (2.2). We hold their account, billing, payout and tax details, everything authored on the Account, and its usage and telemetry records. They are responsible for the users they invite or enrol, and we act on their behalf for those users' learning data (1.1).
• Instructors are invited by a Subscription Owner. We hold the invitation record (including the invitee's email address before acceptance), acceptance status and the permissions granted (2.6); their own account and profile data; and what they author on the Account, which belongs to the Subscription Owner. An Instructor's own account details are theirs; the work and learning records on the Account are the Subscription Owner's, and an Instructor does not hold a royalty balance or payout details for that work.
• Students and other enrolled users are enrolled by a Subscription Owner, by invitation or an enrolment token. We hold what is needed to run their learning: their account identity as the Subscription Owner provides it, their enrolment in classes, and their attempts, answers, scores and session transcripts (2.5). In some countries these accounts are created on a pseudonymous basis (2.20). We act as the Subscription Owner's processor for this data (1.1), and who can see it is described in Section 5.
• Affiliates are invited by us to take part in the Affiliate Program and register an account to use the affiliate portal. We hold the invitation record (including the invitee's email address before acceptance); their account details; the business, contact, payout and tax details recorded for the affiliate; and the referrals, commissions and payments attributed to them (2.19). We are the controller of this information.

2. Information we collect

In brief. Sections 2.1–2.2 and 2.19 cover your account, billing and payout details; 2.3–2.4 and 2.10–2.11 what your browser and our servers record to run and secure the site; 2.5–2.7 and 2.12 what the Service records when you learn, teach, author and publish; 2.8–2.9 and 2.13–2.18 the things you send us, the security features that may apply to your account, and the optional features you can switch on; 2.20 covers pseudonymous student accounts, 2.21 how we protect content and accounts against copying, and 2.22 your online status.

2.1 Account information

• Name, email address, organisation name, a profile picture if you add one, and your language and time-zone settings.
• Your password, kept only as a one-way hash (we never store it in plain text).
• Role assignments and team memberships.
• If you set up your creator profile: a name prefix (such as Dr or Prof), your profession, a link to your profile or biography page, and your institution's name and web address. These are shown in the credit on simulations you author only if you switch that credit on, and you can switch it off again at any time.

2.2 Billing and payment information

When you subscribe to a paid plan or buy a Token pack, payment is processed by our payment provider, PayPal. We do not collect or store your full card or bank-account numbers; those are handled by PayPal under its own terms and privacy policy. We receive and store the records we need to manage your subscription and meet our tax and accounting obligations, including:

• the PayPal subscription / billing-agreement identifier and transaction identifiers;
• the amount, currency, GST component and status of each payment, and the resulting tax invoice;
• the plan or Token pack purchased, who on the Account bought it, and the subscription lifecycle (start, renewals, plan changes, cancellation and expiry), including records of a pending or abandoned checkout where one occurs;
• the country determined for tax purposes (see 2.4).

Where your subscription is billed by invoice rather than through PayPal, we also hold the billing details recorded for your account — the contact name and email address the invoice is addressed to, and, for a business customer, the business name, address and phone number — together with your billing country, your tax-registration number (such as an ABN) and the date you accepted the tax declaration. For each invoice we raise we keep its number, the plan and billing period it covers, the period it relates to, any purchase-order reference recorded for the subscription, the amount, currency and tax component and the tax treatment applied, the billing details as they stood when it was issued, the due date and payment terms, the invoice document itself, and its lifecycle: when it was sent, whether an overdue reminder was sent, whether and when payment was recorded and the payment reference given, any refund or credit and its reference, and the reason recorded if an invoice is voided or written off.

If we invite you to register for an invoice-billed plan, we hold the invitation until it is deleted (Section 7): your name and email address, the plan and billing period, any purchase-order reference and message we add, the affiliate who referred you if there is one, and when it was sent and when it expires.

Where you take part as a creator or affiliate and we pay you, we also hold the payout and tax details described in 2.7 (creators) and 2.19 (affiliates).

2.3 Usage data

• IP address, browser type, device characteristics, and approximate geographic location (derived from IP).
• Pages visited, features used, and timing of interactions.
• Audit logs recording security-sensitive actions you take on your account (login, configuration changes, content creation and deletion).

2.4 Country of origin and localisation

We determine the country associated with your IP address to present the experience that is appropriate for your location, including the plans and content available to you and a suitable default language and currency, and — where a transaction occurs — to help determine the appropriate tax treatment under Australian tax law and equivalent obligations elsewhere.

This country-determination uses publicly available IP-to-country allocation data held within our own platform. The lookup happens between components we operate ourselves (see Section 4). For this lookup, your IP address is processed only to derive the country, is passed only between our own components for that purpose, and is not retained by it. The IP addresses we record for other purposes are described in 2.3, 2.8, 2.9, 2.11 and 2.21. We do not transmit your IP address to any third-party geolocation service, and the lookup is limited to country level — we do not use it to derive city, postcode, or other granular location.

You can change the language and currency at any time using the selectors on the page, and your manual choice always takes precedence over the value we derived. The country we derive is held only for the duration of your browsing session, on our own servers, so the lookup is not repeated on every page you view. Nothing about this is stored on your device.

2.5 Simulation and learning data

When you use the Sandbox Sim platform's interactive features we collect:

• Content you submit through interactive features and the responses returned to you.
• For learners: a record of each attempt — when it was started and finished, the turns taken and what was submitted and returned at each turn, per-turn and final scores, grades, the difficulty setting and how the attempt ended.
• For creators: content you generate while using authoring tools, including draft material that is never published, and the authoring conversation recorded for each simulation, together with a record of any other users you share an authoring conversation with.
• For creators: reference material you attach while authoring (documents and images). We keep the text extracted from documents and copies of the images, linked to the authoring session; we do not retain the original files. The extracted text — and, where image understanding is enabled for your Account, the images — is sent to the AI Provider as context for your authoring instructions (Section 4). You can remove an attachment before it is sent, and attachments are deleted with the authoring session.
• For instructors: records of which learners are enrolled in which classes, when they were enrolled, and their progress on assigned material.
• Where an instructor switches it on for a class, a summary of a learner's completed attempt — which may include the transcript, the score breakdown and per-turn scores — is emailed to that learner when the attempt ends.
• For learners in group simulations: the group and role you were given, the decisions you made in each round (including any you made for a teammate's role you were covering), the messages you sent in the simulation's chats (to your group and, where your instructor allows it, to everyone in the simulation or to another group), and when you were present or away during the run. Where a group simulation uses AI, the AI Provider is sent what it needs to run it, which may include the decisions made, your group's chat messages, the names of the groups and, in some simulations, the names of the students taking part (Section 4).
• For learners in simulations set up as assessments: where the Subscription Owner or an instructor it authorises asks for one, a review of your completed attempt written by AI from the attempt's record, which may include questions to check your understanding, a recommended result and notes for the marker about your answers. The recommended result is advice to the instructor, who decides your official result. The review is not shown to you in the Service, but it is included in a copy of your data provided under Section 8. If the simulation asks you short verification questions about your own answers before your results, your replies are kept with your attempt.
• Where the Subscription Owner of the Account switches on activity indicators: for attempts in its classes at simulations set up as assessments, how many times you copied text, pasted text and left the simulation window during the attempt. For this, only these three counts are kept — never the text you copy, paste or type — and a notice under the simulation tells you, before counting starts, that they are being counted. Where the protection described in 2.21 is on, copying may also be recorded as a detection under 2.21. The Subscription Owner and the instructors it authorises see the counts in the Service; you do not, but they are included in a copy of your data provided under Section 8.
• For marketplace publishers: usage statistics about your published simulations. Use is recorded per learner so that attempts and completions can be counted for billing and royalties; what is shown to you is aggregated and does not identify learners (Section 5).

Where a Simulation or the Authoring Studio uses AI features, those features are powered by third-party AI services as described in Section 4.

2.6 Profile and relationship data

• Instructor invitations and relationships: when you invite another user as an instructor for your account, we record the invitee's email address even before they accept, the permissions you grant them, and acceptance status.
• Simulation authoring and attribution: where an instructor has permission to author simulations on your account, the simulations they author belong to you as the Subscription Owner and the instructor is credited as the author, as described in our Terms; we keep the records needed to reflect this, including the instructor's acceptance of the invitation under which that authoring permission was granted.
• Marketplace listings: the simulations you publish to the marketplace and metadata about each listing, including — when a simulation is first listed on SimMarket — a record of the person's acknowledgement of the SimMarket terms (who acknowledged, when, and the version of the Terms then in force), kept as evidence for as long as the listing and the records in Section 7 require.

2.7 Usage telemetry and royalty records

• Monthly per-account consumption against your plan allowance, measured in Tokens.
• Billing-period usage snapshots and the financial records relating to creator royalties — balances, payment requests, payments and any amounts withheld, and the invoices that owners carrying on an enterprise in Australia upload with their payout requests — for Subscription Owners whose account participates in the Royalty Program.
• The payout and tax details a Subscription Owner gives us to be paid Royalties: the PayPal payout email, legal name and country of tax residence; the supplier declaration accepted and when it was accepted; for an Australian business, its ABN and GST-registration status; with the hobby declaration, the address given; any overseas tax identification number added; and whether we have verified these details.

2.8 Communications

• Contact and demo-request form submissions: your name, email address, organisation and area of interest (where you give them), message, and the IP address from which the submission originated.
• Email verification tokens, password reset tokens and invitation tokens — short-lived secrets used only for the relevant flow, which stop working once used or expired.
• If you supply your own AI provider credentials under the Bring-Your-Own-Key feature, we store the credential encrypted at rest and use it solely to issue calls to that provider on your behalf.

2.9 Two-factor authentication

Two-factor authentication may be required for your account. Where it applies, a second factor is sent to your email address or generated by an authenticator app, depending on how the platform is configured. For the authenticator-app method we store an encrypted seed used to verify your codes; it is generated by us, never leaves our infrastructure, and cannot be used to identify you to any third party. In either case we keep a record of recent authentication events sufficient to mitigate replay and brute-force attempts, and, where a device may be trusted, a record of that device, with its browser details and IP address, so the second factor can be skipped on it (see the cookie table in Section 9).

2.10 Cookies

We use first-party cookies for session management, CSRF protection, remembering your language and currency preferences (only if you accept functional cookies), recording your cookie choices, and — where two-factor authentication applies to your account and you choose to trust a device — remembering that device. The country we derive from your IP address is held only in our server-side session, as described in 2.4, and is not stored in a cookie. We do not use third-party analytics or marketing trackers unless you accept analytics or marketing cookies, in which case the cookies described in Section 9 may be set. See Section 9 for the full list.

2.11 Security logging and Content-Security-Policy (CSP) reports

To protect the Service against attacks such as cross-site scripting and code injection, the pages we serve enforce a Content-Security-Policy. When your browser loads one of our pages and encounters content that would breach this policy, the browser automatically sends us a short violation report. This is a standard browser security mechanism — we do not initiate the report, and it is not triggered by anything you deliberately do. Each report may contain:

• the IP address of the device that sent the report, and the browser details it sends;
• the web address (URL) of the resource that was blocked;
• the web address of the page on which the violation occurred;
• which security rule (directive) was triggered, and whether the content was blocked or only reported.

These reports set no cookie, are not linked to your account, and are never used for analytics, profiling, or advertising. We use them solely to detect and diagnose security issues and misconfigurations on our own infrastructure (legal basis: legitimate interest — see Section 3), and we retain them for 90 days (see Section 7).

2.12 Simulation provenance and copy protection

To protect the intellectual property of the creators who build simulations on the platform, and to detect and deter unauthorised copying, simulations we serve carry provenance information recording which simulation was served, the account and the individual user it was served to, and the time it was served. These are internal reference numbers that only we can read: the information does not contain your name, email address, or IP address, and it is not used for advertising, profiling, or tracking you across other websites. If a copy of a simulation later appears outside the platform, this lets us trace where it originated and support the affected creator's rights. We rely on our legitimate interest, and the legitimate interests of our creators, in protecting intellectual property as the legal basis for this processing (see Section 3). If someone pastes a simulation, or code copied from one, into the Authoring Studio to build a new simulation from it, the request is refused unless the pasted copy carries this information and the simulation is theirs; a refused attempt is recorded in our security records and, where the copy carries this information, reported to our administrators.

2.13 Feedback

We collect the feedback you choose to give us, including:

• bug reports, feature requests, survey responses, and other feedback you submit through the Service or by email, together with the contact details you send them with;
• any screenshots, recordings or descriptions you choose to attach — please avoid including other people's personal information in these unless it is necessary and you are permitted to share it;
• diagnostic information about how features are used, to help us identify and fix issues and prioritise improvements.

We use this to operate and improve Sandbox Sim (legal basis: legitimate interest; performance of contract). Feedback you give us is licensed to us as described in our Terms.

2.14 Documentation interaction telemetry

The platform records telemetry about how the in-product documentation and help materials are used — for example, which help articles or guides are opened, which tutorial videos are played and whether they are watched to completion, your progress through the onboarding tutorial paths, search terms entered within the documentation and which result you opened, the language and version of the documentation viewed, and whether an article was marked helpful. We use this to find gaps and errors in the documentation and to improve it. Where you are signed in, this telemetry is associated with your account, and it is processed by us over our secured internal interfaces between platform components (see Section 4). Legal basis: legitimate interest in maintaining and improving the documentation.

2.15 Support requests and bug tickets

Where the support feature is enabled for your account, eligible users can raise support requests and bug tickets. This section applies only if that feature is available to you; if it is not, no tickets are raised or held. When you raise a ticket we collect the information you provide and the context needed to act on it, which may include: your account identity and contact details; the subject and description of the issue; the area of the product affected; diagnostic context attached automatically (such as the page or feature involved and a technical reference); and any screenshots, files or steps-to-reproduce you choose to attach. Please avoid including other people's personal information in a ticket unless it is necessary to resolve the issue and you are permitted to share it. We use tickets to respond to you, diagnose and fix issues, and improve the Service. Tickets are handled between components we operate ourselves (see Section 4). Legal basis: performance of contract; legitimate interest in providing support and improving the Service.

2.16 Consent records and cookie preferences

We use a consent-management tool to present a cookie banner and a preferences control and to record your choices. Cookies and similar technologies are grouped into four categories: essential (always on), functional, analytics and marketing. Non-essential categories are off until you allow them, and you can change your choices at any time.

When you make a choice, we keep a timestamped consent record as evidence of it. Each record contains the time of the decision, the method (accept all, reject all, customise, withdraw, an automated Global Privacy Control signal, or via our API), the per-category choices, the version of the banner shown to you, a coarse region/jurisdiction indicator, a salted one-way hash of your IP address and a salted one-way hash of your browser's user-agent string. If you are signed in at the time, the record is also linked to your account. That hash is not reversible to your IP address or identity and is used only to distinguish records; we can rotate the salt, which severs any link between past records and future activity. We honour the Global Privacy Control (GPC) browser signal where you send it (analytics and marketing are auto-declined). Your current choices are also stored in a first-party cookie on your device so we do not have to ask again (see Section 9). Legal basis: legal obligation and legitimate interest in demonstrating valid consent.

2.17 Data rights requests

You can submit a privacy data-rights request (such as access, export or erasure) through a request form or by emailing us. To process a request we collect the email address and the request details you provide, send a verification email containing a short-lived link, and — where you ask for an export — make the result available through a time-limited download link. We apply rate limits to the form (including by a hashed IP address) to deter abuse, and we keep a record of completed requests for the period stated in Section 7. A request that touches data held in different parts of the platform is fulfilled using our secured internal interfaces (see Section 4).

2.18 Voice features (microphone)

Some simulations offer optional voice interaction. If you turn it on, the Service uses your browser's built-in speech recognition (speech-to-text) and speech synthesis (text-to-speech), and your browser will ask your permission to use your microphone. Your spoken audio is processed by the speech service built into your browser or device; in some browsers that service is provided by a third party (for example, the browser vendor) and is outside our control, so the acknowledgements about third-party processing in Section 4 apply. We do not record or store your microphone audio on our servers — we receive only the transcribed text needed to run the simulation. Voice is optional: you can decline microphone access or leave voice turned off, and the feature is hidden where your browser does not support it.

2.19 Affiliate and referral data

If you arrive through an affiliate's referral link, we record a short referral code (held in your session) so that, if you later create an account, that account can be attributed once to the referring affiliate. An account can also be attributed from a referral code entered when it is created, or by us where we record who referred it (for example on an invitation to register). If you take part as an affiliate, we also hold your name or business name, contact email address, phone number and address, and the payout and tax details needed to operate the program and to pay you — such as your payment details (stored encrypted), the payout currency, payment method and payment terms recorded for your affiliate account, your country, your ABN if you are an Australian business, your GST-registration status, your acceptance of your tax declaration, records of commissions accrued, paid and reversed, and your payment requests with the invoices you upload with them. How affiliate commissions are characterised and taxed is described in clauses 17 and 18 of our Terms.

2.20 Pseudonymous student accounts

Where a Subscription Owner operates in a country for which the Service creates student accounts on a pseudonymous basis, the Service holds a code for each student rather than their name or email address, together with the learning records described in 2.5. We do not hold the mapping between that code and a real student; it stays with the Subscription Owner, which is responsible for it and for any consents required. A request to us about such an account is referred to the Subscription Owner, because we cannot identify the student from the data we hold. A request about the protection of content and accounts (2.21 and 3.2), such as a request to review a suspension, is handled by us.

2.21 Protecting content and accounts

To protect the simulations and other content on the Service against unauthorised copying and extraction, we may check, while you are signed in, how the pages and files in the protected parts of the Service are used. The protected parts are the areas where simulations and other protected content are created, shown or played, and the checks cover every page in those areas, including their class, billing and settings pages. The checks look for actions commonly used to copy, capture or extract content — for example copying, printing or saving a page, or opening the browser's developer tools — and for signs of automated access, and some of these actions may be prevented on those pages. For each detection we record the kind of action, the time, your account, the part of the Service (and, while you play a simulation, which attempt), the address of the page or file involved, whether the action was prevented, how many such actions have been counted and any response taken, together with your IP address, the browser details your browser sends and a reference to your session. We do not record what you copy or type, or images of your screen.

Depending on how often such actions are detected, we may show you a notice, alert our administrators (in the Service and by email), sign you out or suspend your account, as described in 3.2. We carry out these checks for our own purposes and are the controller of this information for every user (1.1). We rely on our legitimate interest, and that of the creators whose content is on the Service, in protecting that content and the security of the Service, and on our Terms, which prohibit copying and extracting content (legal basis: legitimate interest; performance of contract). Section 7 says how long these records are kept, and Section 8 how you can object.

What these records are for. We use detection records only to protect content and accounts and to look into suspected misuse. In the Service they are visible to our administrators only, and we do not use them to score, grade or assess you. A detection is not, by itself, a finding that you did anything wrong, which is why a person reviews any step beyond an automatic sign-out or suspension (3.2). The activity counts that an Account may switch on for assessments are separate and are described in 2.5.

2.22 Online status

While you are signed in with the Service open, we record when you were last active, at most about once a minute, so that the people who run your classes and our administrators can see who is online now — for example when an instructor forms groups or follows a class. If you are a Student, your online status is visible to the Subscription Owner and the instructors of the Account whose classes you belong to. No IP address or browser details are stored for this. The record is deleted when you sign out or, if you do not, by a regular clean-up once you are no longer online (legal basis: performance of contract; legitimate interest).

3. How we use your information

Purpose	Basis
Providing and maintaining the Service, including the interactive features	Performance of contract
Creating and managing your account and roles	Performance of contract
Processing your subscription payments and managing billing, renewals, plan changes and refunds (through our payment provider)	Performance of contract; legal obligation
Sending essential service communications (account verification, invitations, billing and important service notices)	Performance of contract
Determining and briefly caching your country (from your IP) to present regionally-appropriate content, to pre-select a suitable language and currency, and to help determine the appropriate tax treatment	Legal obligation (for tax on transactions); performance of contract (strictly necessary). Remembering a language or currency you choose, for your next visits: consent (functional cookies)
Maintaining learning records and instructor-learner relationships	Performance of contract
Running group simulations, assessment reviews and activity indicators for the Account that gave you access to a simulation (2.5)	Performance of contract
Recording usage telemetry and calculating, paying and accounting for creator royalties for Subscription Owners whose account participates in the Royalty Program	Performance of contract; legitimate interest; legal obligation
Operating the Affiliate Program — attributing referrals and calculating, paying and accounting for affiliate commissions	Performance of contract; legitimate interest; legal obligation
Receiving and acting on your feedback and bug reports to improve the product	Legitimate interest; performance of contract
Recording how the in-product documentation is used, to maintain and improve it	Legitimate interest
Receiving and handling support requests and bug tickets raised in the support module	Performance of contract; legitimate interest
Recording and evidencing your cookie/consent choices, and honouring Global Privacy Control	Legal obligation; legitimate interest
Receiving, verifying and fulfilling privacy data-rights requests	Legal obligation
Providing optional voice interaction through your browser's speech services (only if you enable it)	Performance of contract
Reviewing Simulations, content and usage to enforce our terms and protect users and the Service (including automated checks)	Legitimate interest; legal obligation
Checking how pages and files in the protected parts of the Service are used, to protect content and accounts against copying and extraction, and responding automatically where needed (2.21 and 3.2)	Legitimate interest; performance of contract
Detecting fraud and securing our systems	Legitimate interest
Showing who is online now to the people who run your classes and to our administrators (2.22)	Performance of contract; legitimate interest
Receiving and analysing automated browser security-policy (CSP) violation reports to detect and diagnose attacks and misconfigurations	Legitimate interest
Measuring how the site is used, and which visits lead to purchases, via analytics	Consent (analytics cookies and purchase events are used only if you accept analytics cookies)
Complying with tax, accounting, and legal obligations	Legal obligation
Improving the Service through aggregate, de-identified analysis	Legitimate interest
Embedding a provenance marker in each served simulation to protect intellectual property and trace unauthorised copying	Legitimate interest

The basis given for each purpose, here and in Section 2, is our reason for handling the information. Which of these reasons a privacy law recognises, and what it calls them, depends on the law that applies to you.

3.1 AI processing and automated decisions. Many interactive features of the Service are powered by AI systems, although a Simulation need not use AI at all; where AI is used, the responses, scores and feedback it produces are machine-generated and may be inaccurate. Apart from the automatic security responses described in 3.2, the Service does not itself make decisions about you that produce legal or similarly significant effects: the scores, feedback and assessment reviews it records are made available to the Account that gave you access to the Simulation, for that Account's use, and a recommended result in an assessment review is advice to the instructor, who decides the official result. We do not use your personal information or your content to train artificial-intelligence models of our own, and our platform-managed AI Providers are contractually restricted from using it to train theirs (see Section 4).

3.2 Automatic security responses. The protection described in 2.21 can act automatically. When detections reach a limit we set (counted over a period we choose, or until we reset the count), the Service may sign you out or suspend your account without a person reviewing it first. These responses use the detection records described in 2.21 and your account details. Signing out ends your sessions on all your devices, and you can sign in again. Suspension stops you using your account — and with it your classes and any subscription the account holds — until it is restored. If you think a response was a mistake, contact us at privacy@sandboxsim.com: a person will review it, you can explain your side and contest it, and we will restore your account if the response was not justified. Any further step, such as closing an account or cancelling a subscription, is decided by one of our administrators (Terms clause 22.5).

3.3 Other automatic steps. The Service also applies some rules without a person deciding each case: it locks sign-in for a short time after repeated failed attempts; it pauses AI features when an Account's Token allowance is used up; it suspends or downgrades an Account whose renewal payment has failed, after the grace period (Terms clause 8.3); and it deletes unconfirmed sign-ups, expired records and student accounts as Section 7 describes. These steps use your sign-in, subscription, usage and enrolment records.

4. Information sharing

We do not sell your personal information. We share data only with:

• PayPal — our payment provider, which processes your subscription payments and to which we send payout instructions for creator royalties. Affiliate commissions are paid by us outside the Service, by the method recorded for the affiliate, and we keep the payment reference. PayPal handles your payment-method details under its own terms and privacy policy; we receive the transaction and subscription records described in Section 2.2.
• Our bank and our professional advisers — our bank, where we pay or are paid by bank transfer; and our accountants, auditors and legal advisers, where they need the information to keep our accounts, meet our tax obligations or advise us, under duties of confidentiality.
• Third-party AI service providers — where an interactive or authoring feature uses AI, it is powered by third-party large-language-model providers. To deliver these features, content you submit may be processed by the applicable provider. We may use one or more providers and may change the provider used over time to maintain service quality, availability, security or cost-effectiveness. For platform-managed AI services, our contractual arrangements with the applicable providers prohibit them from using Customer Content submitted through the Service to train or improve their general-purpose AI models. Retention periods and other processing arrangements vary by provider, model and feature: a provider may retain the content of a request for a limited period for trust-and-safety purposes before deleting it, and where a zero-retention or equivalent arrangement is available and applicable we may use it. If you configure a Bring-Your-Own-Key provider for your account, content from your account is processed by that provider under your own agreement and configuration with that provider.
• Google Analytics — only if you accept analytics cookies. Where enabled, Google receives usage and device information through the analytics cookies described in Section 9. In addition, when you purchase a plan, our server sends Google a purchase event so we can measure which visits lead to purchases; it contains a pseudonymous analytics identifier, a transaction reference, the plan purchased, and the amount and currency — never your name, email address or other contact details, and only if you have accepted analytics cookies. Withdrawing your consent stops both the cookies and these server-side events. We do not enable Google Analytics unless an administrator has configured it and you have consented.
• Hosting and infrastructure providers bound by data-processing agreements.
• The Australian Taxation Office and equivalent tax authorities — where we withhold tax from creator royalties paid to creators outside Australia, withholding amounts and the associated payee details are reported and remitted as tax law requires.
• Regulators and law-enforcement authorities, in Australia or elsewhere, where the law requires or authorises it.

Web search and third-party websites. Some AI-powered features may use web search to retrieve current information from external websites. Where web search is used, information necessary to perform the search may be processed by the applicable AI Provider and information may be retrieved from third-party websites. Those websites may receive information associated with the search request and may process or retain that information under their own terms and privacy policies. Data processed by third-party websites as part of web search may not be covered by the retention controls applicable to the underlying AI Provider service.

Internal processing within our own platform. The Service runs as several components that we operate, and information is exchanged between them over secured, authenticated internal interfaces to run the Service — for example country determination (Section 2.4), usage and royalty telemetry, support requests, the fulfilment of data-rights requests, and financial and transaction records used for billing, accounting and tax. All of these components are operated by us; exchanging data between them is internal processing by ClickOracle, not disclosure to a third party.

Email communications (verification, invitations, service notices, and marketing where you have consented) are sent directly from our own infrastructure. We do not currently use any third-party email delivery service.

5. Who can see your information inside the Service

Learning happens within an Account. If you are enrolled as a Student or other enrolled End User, your enrolment, progress, answers, decisions, scores, grades, the transcripts of your interactive sessions and the feedback you received are visible to the Subscription Owner of the Account that gave you access to the simulation and to the instructors that Subscription Owner authorises, and to no other Account; they can export their class results, and exported copies stay with them outside the Service (Section 7). Where a simulation was adopted from SimMarket, its owner sees aggregate usage figures that do not identify you. Creators' names and titles appear on the simulations they authored where they have chosen to be credited, together with the creator profile details they have set up (2.1). Where several people work on a simulation together, each of them may be credited on it, and each person's own attribution setting decides whether their name is shown. A credit recorded when a simulation is published is kept with that simulation: it remains if you later leave the account, and if you ask us to erase your data we keep the name and title already recorded on simulations you chose to be credited on, because that credit is part of the published work. If you had not chosen to be credited, no name is kept. Our staff can access data as needed to operate the Service, provide support and investigate misuse, under confidentiality obligations, and security-sensitive actions they take in the Service are recorded in audit logs (2.3).

Some of your information is also visible to other students. Where a class shows a leaderboard or live standings, the students who can see them — those in your class and, where the class shares its rankings with other classes, students in those classes of the same Account — see your name and profile picture (or initials) with your class, ranking, score, grade, number of turns and when you finished — or, in live standings, your progress as you play. Where groups compete with each other, students see each group's ranking and team score, and only their own score. They never see your answers. In a group simulation, the other members of your group see your name and role, whether you are present or away, whether you have made each round's decision, and the messages you send to the group; messages you send to everyone in the simulation or to another group are also seen by those students. The Subscription Owner and the instructors it authorises can read all of these messages, in the same way as your other simulation records.

Assessment reviews and activity indicators (2.5) are visible in the Service only to the Subscription Owner and the instructors it authorises, never to students. Who can see your online status is described in 2.22.

6. Data location and transfers

Primary platform data is stored on servers located in Australia. Some services used to operate the platform may involve processing or transfer of information outside Australia, including AI processing, analytics, payment processing, infrastructure and backup services.

For example, content may be processed by AI service providers in the United States or other countries in which those providers operate; analytics information may be processed by Google, and payment and payout information by PayPal, each in the United States and the other countries in which it operates. The countries and providers involved may change as we add, replace or update service providers.

Where we disclose personal information to a recipient overseas, we take the steps the applicable privacy law requires, such as those of Australian Privacy Principle 8: for example, binding the recipient by contract to protect the information and, where a law requires it, telling you about the transfer or asking for your consent.

Where web search or another third-party service causes information to be processed directly by an external website or service, that processing may be subject to the third party's own privacy policy, terms and international data-transfer arrangements.

7. Data retention and deletion

• Account data: retained while your account is active. When you close your account, your account and its associated content are removed from the Service, subject to the erasure treatments below and to the records we are required by law, or entitled, to retain. Every self-service sign-up must confirm its email address. A sign-up whose address is never confirmed is removed automatically 7 days after it was created, together with any class place it holds, provided it has no simulation activity and no subscription; paying customers are not removed on this ground.
• Invitations to register for an invoice-billed plan (2.2): deleted when the person registers with the invitation or when we withdraw it; one that expires unused is deleted when we clear out expired invitations.
• Simulation and learning records (attempts, answers, scores, grades, any AI interactions, assessment reviews, activity counts, and group decisions and chat messages): kept for the data-retention period of the subscription plan of the Account whose class they were made in, counted from when each attempt started, then deleted, whether or not the attempt was finished. Records made outside a class (for example previews and test plays), or in a class that has since been deleted, are deleted after 90 days. Where a plan keeps data indefinitely, the records are kept. The plan in force when the clean-up runs applies, including after a plan change. The shared record of a group simulation run (its chat, decisions and roles) is deleted once no member's attempt from it remains — for a run that has not ended, once it has also been inactive for 90 days — and trial and test runs of group simulations are deleted soon after everyone has left them. If a student's data is erased, the text of their chat messages and their decisions are removed from the group's record, which otherwise stays for the other students.
• Student accounts: a student account is deleted automatically once none of its classes keeps its data any longer — when each class it belongs to is past its plan’s retention period counted from the student’s enrolment and none of its simulation records remain. When a student is removed from a class, the records made in that class are kept for the plan’s period as described above. A student account that belongs to no class is deleted once it is 90 days old and none of its simulation records remain. Accounts that also hold another role, such as instructor, are not deleted this way.
• Billing, payment, tax and accounting records: retained for the period required by applicable tax, accounting and other laws, which may require retention for longer than the period applicable to ordinary account data.
• Creator royalty and affiliate commission records (including payout, withholding and tax records, and the invoices on which payments were made): retained for the period required by tax law (generally 7 years). An invoice uploaded for a request that is declined, or replaced by a corrected invoice, is deleted.
• Audit logs: retained per event type — 12 months by default, and between 90 days and 7 years for specific security, support and audit-integrity events. Entries placed under a legal hold are retained until the hold is released, including where a retention period has otherwise expired.
• Content-Security-Policy violation reports: 90 days.
• Content-protection records (2.21) are audit logs with their own periods: each detection is kept for up to 90 days, and the record of a sign-out or suspension for 12 months (longer only under a legal hold). The running count of a user's detections lasts for the counting period we set, or until we reset it, and is cleared if the user asks us to erase their data. Alerts to our administrators name the user concerned; those shown in the Service expire after 90 days and are not removed earlier on an erasure request.
• Online status (2.22): deleted when you sign out or, if you do not, by a regular clean-up once you are no longer online.
• AI request content: retained by the applicable AI provider for that provider's own limited trust-and-safety period, then deleted (see Section 4, Third-party AI service providers); we keep no separate copy beyond the simulation and authoring records described above.
• Feedback and bug reports: retained so we can act on them and improve the product.
• Support tickets: kept while the issue is being handled and for up to 12 months after the ticket is closed, then deleted with their attachments.
• Documentation interaction telemetry: kept for up to 90 days to diagnose and improve the documentation, then deleted.
• Consent records: 24 months from the decision, then deleted by a scheduled job.
• Completed data-rights requests: 24 months from completion.
• Google Analytics event data (including purchase events): retained by Google for 14 months under our configured setting.
• Aggregate, de-identified analytics: indefinitely.

When you exercise your right to erasure under Section 8, we apply one of the following treatments to each category of data we hold about you:

• Erased: your profile, the content of your interactive sessions, instructor-relationship records, the in-app notifications sent only to you, invitations you never used, and sign-ups and token purchases you never completed are permanently deleted; you are taken off notifications sent to several people.
• Anonymised: material you published which other users continue to rely on — for example, simulations you authored as the owner of your own account that are now in use by other users, or aggregate snapshots required for royalty calculation — is retained with your identifying link severed. Other users may continue to see this material attributed to an anonymous creator. This treatment is necessary to honour your erasure request without revoking ongoing access to other users.
• Retained by the Subscription Owner: simulations you authored as an instructor on another user's account are owned by that account's Subscription Owner and remain with them (whether published or still in draft), as described in our Terms — they are not yours to erase. Where you had chosen to be publicly credited as the author, that credit is retained; otherwise your authorship attribution is removed and your identifying link to the material is severed. As an instructor you do not hold a royalty balance for those simulations. If you separately hold a royalty balance as the owner of your own account, the part you have not requested is forfeited as described in our Terms (clause 15.10), because erasing your account removes the payout details needed to pay you; your Royalties page shows the amount, and you can request it first once it reaches the minimum payout. Affiliate commissions you have earned are not forfeited (see Retained under law).
• Retained under law: audit logs and tax, billing and payout records are retained for the periods listed above even after erasure, where the law requires it or they are needed for security, accounting or resolving disputes. Before we erase your data, we pay or decline any royalty payout or affiliate payment request still open. If you are an affiliate with commissions or payments, your affiliate record is kept for these records but deactivated, so your referral code stops working and no new commission accrues; commissions you have earned are still paid. An affiliate record with neither is deleted.
• Held outside the Service: copies that a Subscription Owner or the instructors it authorises have exported or downloaded from the Service, such as class results, learning analytics (with or without students' names), assessment reviews and the chat records of group simulations. We cannot delete or change these files, so they remain after the records in the Service are deleted or erased, including when a student account is deleted automatically. The Subscription Owner decides how long it keeps them and is responsible for them and for requests about them (1.1).

8. Your rights

You can:

• Access the personal information we hold about you.
• Request correction of inaccurate data.
• Request deletion, subject to the retention and anonymisation treatments described in Section 7, and noting that simulations you authored on another account are owned by that account's Subscription Owner and remain with them, as described in our Terms.
• Export your data in a portable format.
• Withdraw consent for processing where consent is the legal basis (including withdrawing consent to analytics or marketing cookies at any time via our cookie preferences control, which also stops the server-side purchase events described in Section 4).
• Object to processing we carry out on the basis of our legitimate interests, including the protection of content and accounts described in 2.21; we will stop unless we have compelling legitimate grounds, such as protecting creators' content and the security of the Service, that override your interests.
• Ask for a person to review an automatic sign-out or suspension (3.2), give your point of view and contest it.
• Complain to us and, if you are not satisfied with our response, to the Office of the Australian Information Commissioner (oaic.gov.au) or the privacy regulator where you live.
• Use a Global Privacy Control (GPC) browser signal, which we honour by auto-declining analytics and marketing.
• Submit access, export or erasure requests through our data-rights form; we verify your email address before acting on a request.

Where a privacy law that applies to you gives you further rights, or sets conditions on these, we act in line with it.

To exercise any of these rights, email privacy@sandboxsim.com or use our data-rights form. We will respond to your request within the period required by applicable privacy law and, where practicable, within 30 days.

9. Cookies in detail

The cookies below are grouped by category. Essential cookies are required for the site to function and are always set. Functional cookies remember your preferences for your next visits. Functional, analytics and marketing cookies are set only if you accept them. You can review and change your choices at any time through our cookie preferences control.

Cookie	Category	Purpose	Duration
clickoracle_admin (session)	Essential	Session management — identifies your browsing session on our servers so you stay signed in and so session-held values (such as the country derived in 2.4, the language and currency you pick during your visit, and any affiliate referral code in 2.19) can be kept for the session. It holds a random identifier only	Session only
visitor_lang	Functional	Remembers the language you chose on the public site, for your next visits	1 year
authuser_locale	Functional	Remembers your language, so the sign-in, sign-out and error pages show in it on your next visits	1 year
visitor_currency	Functional	Remembers the currency you chose for prices, for your next visits	1 year
co_pc_consent	Essential	Records your cookie-banner choices (per category) and the banner version, so we do not re-ask each visit	1 year
clickoracle_device_trust	Essential	Set only if two-factor authentication is enabled and you choose to trust a device, so you are not asked for a code on every sign-in from it	30 days, or as configured and stated on the sign-in screen
_ga	Analytics	Google Analytics — distinguishes individual visitors so we can measure how the site is used, and is read when you purchase a plan so the purchase can be attributed to your visit. Set only if you accept analytics cookies	2 years
_ga_ followed by our Analytics ID	Analytics	Google Analytics — keeps track of your current visit, so the pages you open count as one visit. Set only if you accept analytics cookies	2 years

10. Children

The Service is intended for adult account holders. Students under 18 may take part only where they are enrolled by a Subscription Owner that is responsible for them (such as an educational institution) and that has obtained any consents required by law, as described in our Terms. In some countries student accounts are created on a pseudonymous basis, so the Service holds a code rather than the student's name or email, and any mapping back to a real identity stays with the Subscription Owner (see 2.20). We do not knowingly collect personal information directly from a child other than through such an enrolment, and a Subscription Owner that enrols minors is responsible for the lawful basis and any parental or institutional consents required. If we become aware that a minor has provided us with personal information outside an authorised enrolment, we will delete it, except any record we are required by law to keep (Section 7).

11. Security

We protect your information using:

• Encryption in transit (TLS 1.2+) and at rest for sensitive fields.
• Strong, industry-standard password hashing.
• Two-factor authentication, which may be required for your account (2.9).
• Protection of content against copying and extraction, with automatic responses (2.21).
• Rate limiting on authentication, verification, and public endpoints.
• Content-Security-Policy (CSP) enforcement, with browser violation reporting to detect injection attempts and misconfigurations.
• Regular security review aligned with OWASP ASVS and NIST SP 800-53 controls.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected users and the relevant authorities of any eligible data breach in accordance with the Notifiable Data Breaches scheme and any other breach-notification law that applies.

12. Changes

We may update this Privacy Policy from time to time. Where an update materially changes how we handle your personal information, we will tell you at least 14 days before it takes effect, through a notification in the Service, by email or both, with a link to the updated version. Other updates take effect on the effective date shown at the top of them. The version in force, and any updated version we have announced, are available from the Privacy Policy link in the site footer on the homepage. Where the law requires us to ask for your consent to a change, we will do so. Where a change also alters our Terms and Conditions, clause 29 of those Terms applies.

13. Contact

Privacy enquiries, and our Privacy Officer: privacy@sandboxsim.com