Kublio privacy statement

AirbourneIT means AirbourneIT Pty Ltd (ABN 68 641 157 191), Western Australia.

Kublio or the Platform means the Kublio software and service supplied by AirbourneIT, including OurSpace, its app for VR headsets.

School means a school or organisation that uses Kublio.

User Content means the worlds, code and recorded sound created by a person using Kublio, including what they build in a VR headset.

Optional Feature means a feature of Kublio that is off for every class until the School has confirmed parents' consent and a teacher turns it on for the class, as set out in section 15.

Kublio is a product of AirbourneIT Pty Ltd (ABN 68 641 157 191), Western Australia. Privacy enquiries may be directed to info@kublio.com.au.

AirbourneIT handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Where the School is a Western Australian public school, the School remains responsible for its students' information and Kublio acts on the School's instructions.

A person may deal with AirbourneIT anonymously or under a pseudonym when making a general enquiry, giving feedback, or reporting a fault, a security concern or a concern about the safety of a child. Nobody has to give their name to do any of those, and AirbourneIT acts on a report whether or not it is signed. The exception is a request for access to, correction of or deletion of personal information: AirbourneIT cannot act on one of those without knowing whose information is being asked about, and for a student that request is made through the School under clause 9.2. Where AirbourneIT cannot act without knowing who a person is, it says so and says why.

Kublio collects the following information:

A display name, so that a teacher and a class can distinguish one person from another.

A school email address for each person who uses Kublio hosted by AirbourneIT. It is how the person is recognised when they sign in, whether through the School's Microsoft 365 or Google account or with a password. On a School's own Kublio server an email address is optional, and that server sends no email at all.

On Kublio hosted by AirbourneIT, Kublio emails that address for one reason: so the person can set a password. When a teacher adds a person, the email is sent straight away, unless the School signs in with Microsoft 365 or Google. A member of staff invited from the Staff screen is sent one whichever way the School signs in, until they have signed in. The email can also be sent again later. Only the student, or a teacher who can change a class the student is in, can ask for it to be sent to a student again. It is never sent to a person who already signs in with the School's Microsoft 365 or Google account.

The email contains the person's name, the School's name, the address they sign in with, and a link to set a password. The link works once and stops working after seven days, and sending a new email stops the old link working.

When a School signs up for a trial, the address typed on the sign-up page is sent one email asking to confirm the request, with a link that works for 72 hours. The School's first teacher is then sent a welcome email, which also says how many students and teachers the trial covers and when it ends, and carries the same kind of set-password link.

Kublio sends no other email to any of these addresses, and never marketing. These emails are sent through Microsoft 365, from AirbourneIT's own mailbox hello@kublio.com.au, and Microsoft is listed as a sub-processor for this.

An opaque sign-in identifier issued by the School's Microsoft or Google directory. Kublio does not receive, see or store a password from those accounts.

Where a person signs in with a password, information derived from the password that cannot be turned back into the password. On a School's own Kublio server, the School may use a class code and PIN instead, and the PIN is held in the same derived form.

User Content, comprising the worlds and code a person creates and any sound a person records. Recording sound is off unless the School has confirmed parents' consent and a teacher turns it on for the class (section 15).

If the School uses VR headsets: a record of each headset, and, for a student invited into a classmate's world on a headset, the first name they type. Section 14 explains both.

Kublio collects this information only to sign a person in, show a teacher their own classes, keep each person's work associated with that person, let the people in a shared world see each other, and keep Kublio secure (section 16 says what the security records hold and how long they are kept). It is collected for no other purpose.

If information is not provided, the consequence is that part of Kublio cannot be used, and nothing else. A person cannot be added to a class without a display name and, on Kublio hosted by AirbourneIT, a school email address, so without them the person cannot use Kublio. User Content is created by choice, and a person who creates none simply has no saved work. AirbourneIT asks for nothing else, so there is nothing else to withhold.

Kublio does not require a person's real name. The display name is used only to tell one person from another, and nothing in Kublio checks it against a legal name or any other record, so a School may enrol a person under a pseudonym and every feature works the same way. On Kublio hosted by AirbourneIT, each person also needs a school email address to sign in with, which comes from the School.

Kublio does not collect a person's date of birth, home address, photograph, phone number, parent or guardian contact details, or where they are in the real world. It does not read any identifier built into a person's device. A School's VR headsets are each given their own Kublio number when they are connected (clause 14.2).

Kublio does not use advertising, third-party tracking, analytics on children or profiling.

Information is collected from the School when it imports or enters its roll, from the School's identity provider when a person signs in, and from the person through the User Content they create and, in a VR headset, the first name they type (clause 14.4).

AirbourneIT does not sell, rent, trade or share personal information and does not disclose it for advertising or marketing.

AirbourneIT uses a small number of sub-processors to operate Kublio hosted by AirbourneIT. Each one is named at kublio.com.au/sub-processors, together with what it does, what data it may handle, and the countries in which it may process that data. Those sub-processors process data on AirbourneIT's instructions. A School's own Kublio server uses no sub-processors: the School's own server runs everything.

AirbourneIT may disclose information where required by law. AirbourneIT will notify the School unless prohibited from doing so.

Kublio may be locally hosted or hosted by AirbourneIT. OurSpace works only with Kublio hosted by AirbourneIT.

For locally hosted Kublio, all information is held on the School's own server and network. Nothing leaves the School.

For Kublio hosted by AirbourneIT, each School's data is held in its own separate store and kept apart from every other School by design rather than by a setting.

Kublio hosted by AirbourneIT stores all School and student information in Australia, on dedicated servers in Sydney, New South Wales. Our nightly backups are encrypted and kept in Australia: one copy on storage AirbourneIT owns in Perth, Western Australia, and a second copy on a separate dedicated server in Sydney. Connections to Kublio go directly to our servers and do not pass through any overseas network. Voice between VR headsets is not yet available to any School (clause 14.7).

A small amount of technical information is handled outside Australia, or can be reached from outside it:

• Microsoft Corporation (United States). Security software on our servers reports technical details about the servers to Microsoft: file names, file fingerprints, the programs that run, and alerts. It is set never to send documents or students' work.
• Cloudflare, Inc. (United States, with a worldwide network). Cloudflare answers the address lookup that finds our servers. It never sees a sign-in or any content.
• OVH (our hosting provider). Under its contract, OVH may use companies in its group in the European Union, India, Canada, the United Kingdom and Singapore for hardware support and to deal with faults. Those staff can work on the server hardware and network, but cannot read School information: every disk holding it is encrypted, the keys are held on a separate server in Australia that OVH does not control, and OVH has no login to our systems.
• AirbourneIT's own staff (New Zealand). A member of AirbourneIT's technical staff works from New Zealand and may administer Kublio from there, for example to support a School. Information stays stored in Australia; administration is over an encrypted connection and nothing is copied out of Australia.

Our marketing website (kublio.com.au, which is not the Kublio app) loads fonts from Google (United States) and uses a Cloudflare check against bots.

If a School signs in with Microsoft 365 or Google, that sign-in is handled by the School's own account with that provider, under the School's own agreement. If a School uses VR headsets, the headsets are managed through Meta under the School's own agreement with Meta (clause 14.10).

When Kublio sends an email, such as an invitation to set a password, it is sent through AirbourneIT's own Microsoft 365 email service, whose data is held in Australia.

AirbourneIT will give each School at least 30 days' notice before any School or student information is stored outside Australia. The notice will name the country.

AirbourneIT treats the sending of personal information overseas as a disclosure under the Australian Privacy Principles.

Authentication is required before the Kublio software loads. A VR headset works only after a teacher or administrator has connected it to the School (clause 14.2).

Each School operates in its own process with its own store. A session for one School has no effect at another School.

Passwords and PINs are stored only in a derived form that cannot be turned back into them. Connections are encrypted in transit.

Access by AirbourneIT staff is limited to support requirements. Where the School requests support, AirbourneIT asks the School before looking at a child's work.

Kublio is used by children. It holds only the minimum information described in clause 3: a display name, a school email address already held by the School, User Content and, where the School uses VR headsets, the headset records and typed first names in clause 3.6A.

AirbourneIT does not contact children. The School has the relationship with the family, and requests concerning a child must be made through the School.

Features that let children see, hear or work with each other, and recording sound, are Optional Features. Each is off for every class until a School administrator has confirmed, once for the School, that the School has parents' or carers' consent, and a teacher then turns it on for the class (section 15).

In a VR headset, students in the same shared world can see each other move. They cannot hear each other: voice is not yet available to any School (clause 14.7). Section 14 explains what a teacher controls.

A person may request access to the information held about them, ask for it to be corrected, or ask for it to be deleted. The School can download or delete a person's information in Kublio itself, and AirbourneIT will make any correction the School asks for.

For a student, the request must be made through the School. AirbourneIT will assist the School to respond.

The School may request deletion of its data. AirbourneIT will delete that data and any copy it holds.

A request under this section is answered free of charge, and within 30 days of AirbourneIT or the School receiving it. Where a request is refused, or cannot be met in full, the reason is given in writing along with the complaint routes in section 12. There is no fee of any kind for making a request, for the record that answers it, or for having information deleted.

Deleting a student also deletes their VR shares, any first name typed in them and any voice mute on them. Removing a headset deletes its record. A copy of a world on a headset is deleted when the student leaves the world.

If an incident is likely to cause serious harm, AirbourneIT will notify the affected School promptly and notify the Office of the Australian Information Commissioner where required by the Notifiable Data Breaches scheme.

AirbourneIT will notify a School early where the severity of an incident remains uncertain.

Place packs are made with the communities whose country they represent, and never without them.

Where a community requires material to be withdrawn, it is removed from Kublio and from the worlds that used it. The request and the action taken are recorded.

Privacy complaints may be submitted to info@kublio.com.au. AirbourneIT will respond to the complaint.

If the complainant is not satisfied with AirbourneIT's response, the complainant may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

A concern about the safety or wellbeing of a child, including a concern about the conduct of an AirbourneIT person towards a child, may be raised at info@kublio.com.au. It may be raised by anybody: a student, a parent or carer, a School's staff, or a member of the public. The person raising it does not have to be a customer of AirbourneIT and does not have to give their name. AirbourneIT will acknowledge the concern, say who is handling it, and handle it under its child safety policy and its reportable conduct procedure.

Nobody needs to wait for AirbourneIT. If a child is in immediate danger, call 000. If an offence is suspected, contact WA Police on 131 444. A concern about something that happened at a school may also be raised with that school.

AirbourneIT will notify Schools before making a material change to this statement.

The version number and last-updated date will change when this statement changes.

AirbourneIT reviews this statement at least once every twelve months, and also whenever Kublio changes in a way that affects what information is collected, where it is held, or who may handle it. Each review is recorded with its date and what it found. Where a review finds this statement inaccurate, unclear or out of date, it is revised and the version number and last-updated date above are changed.

OurSpace is Kublio's app for VR headsets (Meta Quest). A student can open a world they made in Kublio on one of the School's headsets, walk around inside it and keep building. It is offered only with Kublio hosted by AirbourneIT, and only to Schools that set up headsets.

Nobody signs in on a headset. A teacher or administrator connects each headset to the School once, by typing a code it shows into their own Kublio. Kublio then keeps a record of the headset: a number Kublio gives it, a label such as "Headset 3", when it was connected and when it was last used. The record does not say who connected the headset or who has used it. The headset keeps a matching key, locked inside that headset, so it works only for that School. The School's administrator can remove a headset at any time, and it is taken out of any world it is in within a minute.

To open a world, a student shares it from Kublio and is given a code. The code works for no more than 8 hours, and only on the School's own headsets. The student types the code on the headset, or holds up its QR code: the headset reads the code and only its text reaches OurSpace. The headset remembers the last code for up to four hours, so a student who takes the headset off can get back in. It forgets the code sooner if the share ends.

Building together is an Optional Feature (section 15). If it is turned on for the class, a student can invite a classmate into their world. The classmate types their first name on the headset so the others know who they are. The name is checked against Kublio's word screen, shown above that person in the world and on the world owner's Kublio screen, and kept with the share until the share ends. It is not saved on the headset.

The headset is sent a copy of the world, prepared on our servers in Sydney, including any videos and sound recordings the student put in it. The copy is deleted from the headset when the student leaves the world, and again whenever OurSpace starts. Anything built in the headset is saved into the student's own world in Kublio, the same as work done on a computer. The copy on our servers, and any first name typed for the share, is deleted within about 10 minutes of the share ending or being switched off, and when the student is deleted.

While a world is open it runs on AirbourneIT's own room server in Sydney, so everyone in it sees the same thing. The room server receives the world's ground, where things stand and its program (including any words the student typed into it); the headset's number and label, or the first name typed on it; and, many times a second, where each person's head and hands are and how their fingers are bent, so the others can see them move. It does not receive a student's Kublio name, email address or class, the world's name, or any recordings. It holds all of this in memory only while the world is open, and writes none of it to disk. Its own technical log records events such as a headset number joining or leaving, never a name, and is kept for 7 days. As with every connection to Kublio hosted by AirbourneIT, the network address each connection comes from is logged for 7 days to protect the service from attack.

Voice in VR rooms is an Optional Feature (section 15), and it is off. It is not yet available to any School: no School can turn it on, and students in a shared world cannot hear each other. AirbourneIT will update this statement before voice is offered to any School, to say how it works and what it handles.

Some things stay on the headset. Hand tracking, the view of the room through the headset's cameras, and reading a QR code are done by the headset itself. OurSpace never receives a camera picture. Hand movements reach the room server only as the positions in clause 14.6.

OurSpace has no advertising, analytics or crash reporting, and does not check for updates by itself. Meta's developer data collection is switched off in every version we build, and OurSpace sends nothing about students to Meta.

The School's headsets are Meta Quest devices, managed by the School through Meta under the School's own agreement with Meta. Meta handles the headset's account, its system software and installing OurSpace. What Meta collects in doing that is covered by Meta's own terms and privacy policy, not this statement.

Requests to see, correct or delete information follow section 9. Clause 9.5 says what deleting a student or removing a headset deletes.

A student in a shared world can press Report on their wrist and choose what happened: someone was unkind, something they saw, or something else. The report is saved on that headset, and holds what kind of thing it was, the time, the School and room it happened in, and the first name (or headset label), seat and role of each person in the room. It never holds sound, pictures or where anyone stood. The headset then tells the student to tell their teacher. The report is not sent to AirbourneIT, Meta or anyone else. It stays on that headset until OurSpace is removed from the headset or the headset is reset. Sending a report to the teacher is planned, and this clause will be updated before that happens.

Some features of Kublio collect more information, or show one child's work or voice to other children. These are Optional Features, and every one is off for every class until the School has confirmed parents' consent and a teacher turns it on for the class. They are:

• Showcases: classmates seeing each other's worlds.
• Building together: a student inviting classmates to build in their world, on a computer or in a headset (clause 14.4).
• Recording sound with the microphone.
• Voice in VR rooms (clause 14.7).

A School administrator confirms once, for the whole School, in the School settings of Kublio's teacher area, that the School has parents' or carers' consent for Optional Features, collected under the School's usual process. Until the School has confirmed, every Optional Feature is off in every class and none can be turned on.

Once the School has confirmed, each Optional Feature is a plain on or off switch for each class, which a teacher who can change the class turns on or off. There is no further prompt, and nothing is asked of a student.

Kublio records the School's confirmation: who confirmed it (by their Kublio identifier, not their name), their role, when, when it ends, and the words they confirmed. It holds nothing about any child. Confirming, withdrawing, the confirmation running out, and each class switch being turned on or off are all written to the security log (clause 16.3).

The confirmation lasts twelve months. If the School has chosen its state's curriculum in School settings, it ends sooner if the School's next school year starts first: on the first day of that school year. A confirmation made in the six weeks before a school year starts counts for that coming year. The School confirms again each year.

When the confirmation runs out, or a School administrator withdraws it, every Optional Feature is turned off in every class. A teacher can also turn an Optional Feature off for a class at any time. Either way it stops for that class within a minute. Sounds a student has already recorded stay in their world, because they are the student's own work. When showcases are turned off, the list of worlds shown to the class is cleared.

The School decides whether to confirm consent and which Optional Features to turn on for each class. The School is responsible for collecting parents' or carers' consent under its own process, for confirming it in Kublio only when it has that consent, and for withdrawing the confirmation if that consent is withdrawn. This does not reduce AirbourneIT's own obligations under the Privacy Act or under this statement.

A person's information and User Content are kept until the School deletes the person, or until the School's data is deleted under clause 9.3.

Backups are kept for up to twelve months, encrypted, in the two places named in clause 6.4. If a backup is ever restored, everything deleted since that backup was made is deleted again before Kublio is used.

Kublio keeps a security log of what adults and the system do, such as who signed in, who changed a setting, who confirmed or withdrew the School's consent for Optional Features, who turned an Optional Feature on or off for a class, and who deleted a person. A child is never recorded as the person who did something; a child can appear only as the person something was done to, and then by their Kublio identifier, not their name. The security log is kept for two years.

A trial sign-up request (the name, school, work email address and any note typed on the sign-up page) is deleted 30 days after it last changed, that is, 30 days after it was made, confirmed, approved or declined, whichever was latest.

For VR headsets: the copy of a world on our servers, and any first name typed for it, is deleted within about 10 minutes of the share ending (clause 14.5). The room server's technical log is kept for 7 days (clause 14.6). Voice is not yet available to any School (clause 14.7).

The network address each connection to Kublio hosted by AirbourneIT comes from is logged for 7 days, to protect the service from attack.