Responsible AI at Academyship

#01Purpose, scope and authoritative documents

This statement explains, at a public level, how ACADEMYSHIP PTY LTD (ACN 698 283 448, ABN 89 698 283 448) governs the AI-assisted features ("AI Features") in its platform. It is informational and does not override the Terms of Service, Privacy Policy or Data Processing Addendum, which remain the authoritative documents. It describes the AI Features Academyship currently makes available. Not every AI Feature is available to every Institution: availability depends on the Institution’s plan, the modules it uses and its configuration, and each Institution can disable or restrict AI Features. This statement also explains how AI Features differ from rule-based processes in the platform and from speech recognition supplied by a User’s browser or device (section 3).

#02Our responsible AI commitments

Academyship's AI Features are built around the following commitments:

• we do not use Customer Data or Student Data to train general-purpose AI models;
• we do not sell Customer Data or use it for advertising;
• AI Features operate within an Institution's tenant and respect its role and permission boundaries;
• AI is decision support with human oversight, not a replacement for professional judgement;
• where an AI Feature proposes a change to a record, the change is applied only after a person confirms it;
• each Institution can enable, disable or restrict AI Features and how they are used;
• Academyship’s approved AI provider for Customer Data is Amazon Bedrock, which Academyship configures in the AWS Asia Pacific (Sydney) Region (ap-southeast-2), and no other AI provider is approved to process Customer Data unless it is listed in the Subprocessor Register and any notice required by the DPA has been given (section 5); and
• any customer-specific model customisation, if offered, is separately opt-in.

#03AI feature inventory

This section lists the AI Features Academyship currently makes available. They provide AI-assisted functionality within an Institution’s tenant and are subject to that Institution’s configuration, role permissions and the safeguards in this statement. A feature described as available “where made available to the Institution” depends on the Institution using the relevant module and on Academyship making that feature available to it. “Authorised staff roles” below means the Institution administrators, academic, operational or other staff roles to which the Institution grants the relevant feature and underlying-data permissions; Academyship does not publish a fixed cross-Institution role list.

Customer Data and Student Data are not used to train general-purpose models. We do not expose prompts, retrieval internals, attack strings, model configuration or security-sensitive architecture. For each feature listed, the inventory records the actor and role, inputs and source records, output, proposed action and confirmation, Institution control, provider, model family, configured region, fallback position, logging, retention and usage-charge position.

How certificate and card review and fix assistance works

Where this feature is made available to an Institution, it works in the following sequence:

1. A person working on a certificate or card generation run describes a problem they have noticed, such as text that does not fit, a value in the wrong place or an element that does not display correctly.
2. Academyship sends the AI provider that description, the elements of the template used for the run (such as text, layout and variable placeholders), learner-related context from the run (for example, values that appear on an affected certificate or card) and, where included, a rendered image of the affected certificate or card.
3. The AI Feature returns a proposed fix to the copy of the template held for that run. Nothing is changed at this stage.
4. A person reviews the proposal and decides whether to approve it. A proposal that is not approved is not applied.
5. If the person approves it, the fix is applied to the run’s template copy, and certificates or cards in that run may be regenerated using the changed template.
6. The Institution should check regenerated certificates or cards before issuing or relying on them. Where a record has already been issued, the Institution’s correction and reissue processes apply.

A person’s approval does not guarantee that a fix is accurate, complete or compliant with the requirements that apply to the Institution’s qualifications, statements or cards; the Institution remains responsible for what it issues. A rendered certificate or card can show everything its template prints, which may include a photograph, a student identifier, or emergency or health details where the template includes them. Such an image is used only to propose a fix to the document: Academyship does not use it to identify the person or to analyse their features (section 8). Institutions should take this into account when deciding whether to use the feature with templates that print sensitive details.

E-signature document composition

Where this feature is made available to an Institution, an authorised User preparing a document for electronic signature can ask the AI Feature to draft or revise document text. The User’s instructions and the content the User provides or selects are sent to the AI provider, and the response is placed in the draft as proposed text. The User must review and edit the draft. The AI Feature does not send a document or request a signature: a person must do that through the ordinary e-signature workflow. The Institution is responsible for the purpose and content of the documents it sends, and AI-drafted agreements need qualified review (section 12).

Rule-based processes are not AI Features

Many platform functions apply rules that the Institution configures or that are built into the software, rather than generative AI. Depending on the modules an Institution uses, examples include grading and result rules, payroll and tax calculations, behaviour points, thresholds and alerts, fee and fine calculations, waitlist order, booking eligibility and access gating. These rule-based processes are not AI Features, and the AI controls in this statement, such as the Institution’s AI enable and disable control, do not switch them off. They can still significantly affect people. The Institution decides how they are configured and applied and is responsible for the decisions it makes using them, and a person can ask the Institution to review or correct an outcome. Academyship remains responsible for its own obligations in providing the software that applies them. How personal information is handled in these processes is explained in the Privacy Policy.

Razi voice typing is separate from AI Features

Razi is a voice-typing input method, not an Amazon Bedrock feature and not part of Academyship’s generative-AI feature inventory. It uses speech-recognition capabilities supplied by the User’s browser, operating system or device to convert spoken words into text for supported Academyship fields and editors. Academyship does not receive or store raw audio through Razi. Academyship receives and handles only the resulting text after it is inserted into an Academyship field, in the same way as text manually entered into that field.

The browser or device provider may process speech under its own privacy terms and technical configuration. Depending on the browser and device, speech may be recognised on the device itself or sent to that provider’s online speech service, so Academyship does not describe Razi as on-device processing. Availability and accuracy depend on the User’s browser, device, language, permissions and network conditions. Users must review the transcription before saving or relying on it. Razi does not make decisions, analyse student behaviour or generate autonomous actions. An Institution can control whether Razi is available to Users where the relevant configuration exists.

#04How Academyship uses information for AI

AI Features may use the requesting user's authorised information within that Institution's tenant, together with the user's request, to produce an output. Some AI Features can also use an image: certificate and card review assistance can include a rendered image of the affected certificate or card. The inputs for each feature are listed in section 3. We apply data minimisation so that only information relevant to the task is used. Users must not include unnecessary Sensitive Information in prompts. Producing an output for the Service is different from training a model: Customer Data and Student Data are not used to train general-purpose models. AI usage, security and audit events follow the 30-day infrastructure and security-log retention position; saved outputs remain subject to the retention rules for the underlying Customer record.

#05Providers, models and processing locations

Amazon Bedrock is Academyship's approved AI provider for Customer Data. Amazon Web Services Australia Pty Ltd (ABN 63 605 345 891) is Academyship’s AWS contracting entity under the AWS Customer Agreement. Academyship configures Amazon Bedrock in the AWS Asia Pacific (Sydney) Region (ap-southeast-2) and uses a foundation-model family available through Amazon Bedrock that Academyship selects. Academyship will not enable Amazon Bedrock cross-region inference for Customer Data unless it has first updated the Subprocessor Register and given any notice the DPA requires.

Academyship’s software also contains support for other model providers, including a fallback path that can operate where configured. No other AI provider is approved to process Customer Data unless it is listed in the Subprocessor Register and any notice required by the DPA has been given. The Subprocessor Register is the current canonical register for Amazon Bedrock, any other approved AI provider and its processing locations, and Academyship’s other AWS services. A material change to a provider, model family, purpose, data use or action capability requires approval under Academyship's AI governance process.

Academyship hosts its core production platform and Customer Data in Sydney, Australia (ap-southeast-2). Limited processing outside Australia may occur through disclosed telecommunications delivery, Stripe-hosted payment services, Customer-selected Integrations or authorised access, subject to applicable privacy, contractual and security safeguards.

#06Tenant isolation and permissions

AI Features operate within an Institution's tenant and apply the requesting User's permissions. Each Institution can disable AI Features or restrict their use through administrative configuration and role permissions. Academyship makes an AI Feature available to an Institution only where the Institution can disable it and restrict who may use it through role permissions.

#07Human oversight and significant decisions

AI Features are decision support. Academyship does not use them as the sole basis for a decision that has a legal or similarly significant effect on a person — for example, admission, grading, discipline, employment, finance, wellbeing or safeguarding decisions. Those decisions are made by authorised people at the Institution, who remain accountable for them. AI outputs should be reviewed before they are relied on or acted upon.

#08Prohibited and restricted uses

Academyship does not design its AI Features to, and does not permit their use to:

• perform biometric identification or emotion inference;
• make automated decisions that unlawfully discriminate against a person;
• conduct covert surveillance of students or staff;
• take autonomous disciplinary action;
• build unauthorised profiles or infer sensitive information about individuals;
• exploit or endanger children, or generate harmful, illegal or abusive content;
• request or expose credentials or secrets; or
• access another tenant's data or evade platform permissions.

#09Institution controls and configuration

Academyship owns governance of the platform's AI service, including approval and incident containment. AI Features include Institution controls and role-permission implementation appropriate to the feature. Institutions remain responsible for role assignment, permitted use, staff training, user notices and review of outputs. Customer-specific customisation is separately opt-in.

#10AI-generated actions

There is a difference between an AI Feature that produces an answer or proposed text for a person to use, and one that could take an action with an effect (such as sending a message). Academyship does not enable AI to take significant actions autonomously without human approval. Action-capable features are subject to feature-specific review.

Some AI Features propose a change that is applied only if a person confirms it. For example, certificate and card review and fix assistance proposes a change to the template copy for a generation run; if a person approves it, the change is applied and certificates or cards in that run may be regenerated (section 3). In these features, AI does not change records without a person’s confirmation. A person’s confirmation does not make the result accurate, complete or legally compliant, so the Institution should check the outcome before relying on it.

#11Transparency to users

Where AI is used, Academyship aims to make that clear to the people using the feature, to indicate the limitations of AI output, and to seek confirmation before an action is taken. Users can challenge an output through the relevant Institution, which can correct the underlying record and seek support where needed. Institutions are responsible for any additional notices they need to give their users, and for communicating with children in an age-appropriate way where relevant (see the Student Privacy Guide).

#12Accuracy, quality and accessibility

AI outputs can be wrong or incomplete, and should be checked before being relied on. Where a result should be exact (for example, a calculation), Academyship uses deterministic methods rather than generative AI. We work to make AI Features accessible, consistent with our Accessibility Statement. We do not claim that our AI is unbiased, always accurate, fully explainable or free of error.

Agreements, payroll explanations and compliance documents

An AI Feature may be used to draft or revise an agreement or another document for signature, to explain payroll or tax information, or to prepare a document used for regulatory or compliance purposes. That output is a draft. It is not legal, tax, financial or compliance advice, and Academyship is not a law firm or a registered tax or BAS agent. Such output requires review by a person with the appropriate qualifications and authority before the Institution relies on it, sends it for signature, gives it to an employee or submits it to a regulator: for example, the Institution’s legal adviser for an agreement, its payroll officer or a registered tax or BAS agent for an explanation of pay or tax, and its compliance lead for a compliance document. The Institution is responsible for the purpose and content of the documents it issues. This does not reduce Academyship’s own obligations under the Terms, the DPA or the law, including any consumer guarantees that apply to the Services.

#13Risk assessment, testing and release governance

Academyship classifies AI changes by their purpose, data sensitivity, user population, action capability and potential effect on people. A feature requiring privacy, security or safety assessment is not approved for release until the applicable assessment and governance approval are complete. Material provider, model, purpose, data-use or action-capability changes require the same approval. We do not publish exploit methods, attack strings or the internal detail of assessments.

#14Logging, monitoring and retention

Infrastructure and security logs, including relevant AI usage, security and audit events, are retained for 30 days. An output that an authorised User saves into a Customer record is retained with that record under the Institution’s configuration, applicable law and the Terms. We do not publish prompts, detailed inference content, model configuration or a model's internal “reasoning”.

These periods apply only to the logs and records they name. A fix applied to the template copy for a certificate or card run, any certificate or card regenerated as a result, and text kept in an e-signature document become part of the Institution’s records for that module and follow the retention that applies to those records. The expiry of a log does not delete a record held elsewhere. Request content sent to an approved AI provider is handled under Academyship’s agreement with that provider and the DPA, and is not used to train general-purpose models.

#15AI incidents, harmful outputs and reporting

If an AI Feature produces a harmful output or behaves unexpectedly, you can report it through support at support@academyship.com.au, or through privacy@academyship.com.au or safety@academyship.com.au where privacy or safety is involved. We can contain an issue, disable a feature where necessary, investigate, and escalate where the law requires. A suspected security vulnerability should be reported through our security disclosure process.

#16Children, sensitive data and high-risk modules

Where children and young people are involved, Academyship applies stricter defaults and role restrictions, and Institutions remain responsible for their use of AI with students. Academyship does not use AI for wellbeing, health or behavioural scoring of children. Behaviour points, thresholds and alerts are rule-based processes, not AI Features (section 3). Our approach to children is described further in the Child Safety Statement.

The AI Features Academyship currently makes available are for use by authorised Institution personnel. Academyship does not currently make a generative-AI feature available for students to use, such as an AI chat, tutor or writing tool for learners. Before making such a feature available, Academyship will assess it for children’s privacy and safety and update this statement and the feature inventory in section 3.

#17Third-party and customer-selected AI integrations

This statement covers AI Features that Academyship provides. It does not cover an AI tool that an Institution chooses to connect as a Customer-selected Integration; those are selected and controlled by the Institution, which is responsible for the resulting data flows and for approving them. See the Subprocessor Register and DPA for how appointed providers and Integrations are distinguished.

#18Questions, complaints, changes and related documents

For questions about this statement, contact legal@academyship.com.au; for privacy matters, privacy@academyship.com.au; for security matters, security@academyship.com.au. We review this statement at least annually and may also review it following a material service change or a relevant legal or regulatory development. A change to a model, provider, feature, action capability or data use is treated as a material service change for this purpose.

Privacy Policy Terms of Service DPA Subprocessors Child Safety Security Disclosure