Last updated: 4 August 2026
This Privacy Policy explains how Storypark Group collects, holds, uses, discloses, stores and otherwise processes Personal Information in connection with its Products and Services.
For Australian users, this Privacy Policy is intended to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable Australian privacy laws. Storypark Group also adopts privacy practices that are informed by internationally recognised privacy principles, including those reflected in the European Union General Data Protection Regulation (GDPR), to support the protection of Personal Information across its products and services.
This Privacy Policy applies to all Products and Services made available by Storypark Group, including Storypark Community, Xap products, CCMS, Storypark Assist, Storypark AI and any other products, services, applications, websites, portals or functionality made available by Storypark Group from time to time.
By accessing or using our Products and Services, you acknowledge that you have read and understood this Privacy Policy.
For the purposes of this Privacy Policy:
Storypark Group means Storypark Limited, Xap Technologies Pty Ltd, their related bodies corporate and any successor entities operating the Products and Services.
This Privacy Policy applies to Personal Information collected or processed by Storypark Group in connection with:
This Privacy Policy does not apply to the Personal Information of Storypark Group employees, contractors or job applicants, which is governed by separate internal privacy practices.
Unless otherwise defined in this Privacy Policy, capitalised terms have the meanings given to them in the applicable Customer Terms or End User Terms.
In this Privacy Policy:
Customer means the organisation or person that has entered into an agreement with Storypark Group for the provision of Products and Services.
Customer Data means all data, records, information, Personal Information, Content and other materials uploaded to, stored in, processed by or generated through the Products and Services by or on behalf of a Customer or its Authorised Users.
Content means any text, images, videos, audio recordings, documents, educational observations, messages or other user-generated materials forming part of the Customer Data.
Child means an individual under the age of majority in the jurisdiction in which they reside.
Child Content means any Content relating to or depicting a Child.
Child Record means the record maintained within the Products and Services in relation to a Child, which may include Customer Data (including Child Content), and comprises an Organisation Child Record and, where applicable, a Family Child Record.
Family Child Record means the Child Record that is accessible to, controlled by or managed on behalf of a Child's Primary Account Holder.
Organisation Child Record means the Child Record created, maintained or administered by a Customer or its Authorised Users for the purposes of providing education, care, administration or related services to a Child through the Products and Services.
Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form.
Sensitive Information has the meaning given under the Privacy Act 1988 (Cth) and includes health information, biometric information, racial or ethnic origin, religious beliefs and other information afforded additional protection under applicable privacy laws.
Products and Services means the products and services made available by Storypark Group from time to time, including Storypark Community, Xap, CCMS products, Storypark Assist, Storypark AI and any associated functionality.
Primary Account Holder means a Child's parent or guardian, or another person authorised by the Child's parent or guardian, who administers or controls a Family Child Record.
Storypark Group recognises that its Products and Services may involve the collection and handling of Personal Information relating to Children. We are committed to protecting that information and processing it responsibly, transparently and securely.
Where Products and Services involve Children's Personal Information, Storypark Group supports a role-based governance model under which Customers, Authorised Users, Primary Account Holders and Authorised Viewers have different rights and responsibilities regarding access to, and management of, Child Records.
Nothing in this Privacy Policy limits the obligations imposed on Customers and users under the applicable Customer Terms, End User Terms or AI Terms.
The types of Personal Information we collect depend on the Products and Services you use and your relationship with Storypark Group.
We may collect the following categories of Personal Information:
Information relating to Customers, Authorised Users, Primary Account Holders, Authorised Viewers and other users of the Products and Services, including:
Depending on the Products and Services being used, we may collect Personal Information relating to Children, including:
Where required by law, Storypark Group relies on the Customer to obtain all necessary parental, guardian or other legally required consents before Children's Personal Information is collected, uploaded or otherwise processed through the Products and Services.
We may automatically collect information relating to the use of our Products and Services, including:
Where you communicate with us or choose to receive marketing communications, we may collect:
Where you use Storypark AI or other AI-enabled functionality, we may collect and process:
in accordance with this Privacy Policy, the Customer Terms and the Storypark AI Terms.
Storypark Group does not use identifiable Customer Data, Personal Information or Children's Personal Information to train or improve its underlying artificial intelligence models. Storypark Group may use de-identified, anonymised and aggregated information for analytics, security, quality assurance, product development and service improvement where such information does not reasonably identify any individual.
Storypark Group collects Personal Information in a variety of ways, including where:
We may also collect Personal Information from publicly available sources and trusted third-party providers where reasonably necessary to provide, administer, improve or secure the Products and Services.
Storypark Group recognises that protecting Children's Personal Information is fundamental to the Products and Services we provide.
Where the Products and Services include Child Records:
Customers are responsible for ensuring that they have obtained all necessary consents and provided all required privacy notices before Children's Personal Information is uploaded or otherwise made available through the Products and Services.
Storypark Group processes Children's Personal Information only for the purposes of providing, administering, securing and improving the Products and Services, complying with applicable law and otherwise as described in this Privacy Policy and the applicable Customer Terms.
For Products and Services provided to Australian Customers, Personal Information relating to Children is hosted in Australia.
Storypark Group collects and processes Personal Information only where reasonably necessary to provide, administer, secure and improve the Products and Services, comply with our legal obligations or otherwise for purposes permitted by applicable law.
Depending on the Products and Services you use, we may use Personal Information to:
Where permitted by law, Storypark Group may also use Personal Information for purposes that are reasonably related to the purposes described in this Privacy Policy.
Storypark Group may make artificial intelligence and AI-assisted functionality available through the Products and Services.
Where Storypark AI is used, Personal Information may be processed, for example, to generate recommendations, summaries, translations, drafting assistance, insights or other AI-assisted outputs requested by users.
Storypark Group does not use identifiable Customer Data, Personal Information or Personal Information relating to Children to train, retrain or improve its underlying artificial intelligence models.
Storypark Group may generate, collect and use de-identified, anonymised and aggregated information derived from Customer Data and use of Storypark AI for analytics, benchmarking, quality assurance, security, service improvement, product development and operational purposes, provided that such information does not reasonably identify any individual.
The use of Storypark AI is also governed by the applicable Storypark AI Terms.
Storypark Group does not sell Personal Information.
We may disclose Personal Information where reasonably necessary to provide or support the Products and Services, including to:
Where we disclose Personal Information to service providers, we require them to protect that information and only use it for the purposes for which it was disclosed or as otherwise permitted by law.
Storypark Group primarily hosts Customer Data, including Personal Information relating to Children for Australian Customers, within Australia.
Depending on the Products and Services being used, some Personal Information may be accessed, processed or stored by Storypark Group or its authorised service providers outside Australia where reasonably necessary to provide, support, secure or improve the Products and Services. However, where a particular Product or Service, customer agreement or applicable regulatory requirement requires Customer Data and/or Personal Information to be hosted and processed solely within Australia (including certain Xap products and services), Storypark Group will manage that Customer Data and/or Personal Information in accordance with those requirements.
Where Personal Information is disclosed outside Australia, Storypark Group will take reasonable steps to ensure that recipients are subject to appropriate contractual, technical or organisational safeguards designed to protect Personal Information in accordance with applicable privacy laws.
Some Products and Services may be subject to customer-specific or regulatory data residency requirements. Where Storypark Group has agreed to such requirements with a Customer, Storypark Group will manage Personal Information in accordance with those agreed arrangements.
Storypark Group uses cookies and similar technologies (including pixels, web beacons, local storage and similar technologies) to operate, secure and improve the Products and Services and our websites.
We use the following categories of cookies:
These cookies are necessary for the operation, security and administration of the Products and Services. They cannot be disabled through our cookie preferences because they are required for core functionality.
These cookies enable enhanced functionality and improve your experience of the Products and Services, such as remembering preferences and personalising your experience.
These cookies help us understand how visitors use our websites and Products and Services by collecting statistical and usage information. This information helps us improve performance, functionality and user experience.
Where permitted by law and with your consent where required, these cookies help us deliver more relevant advertising and measure the effectiveness of our marketing activities.
You may manage your cookie preferences through your browser settings or any cookie preference tools made available through our websites. Please note that disabling certain cookies may affect the functionality or performance of the Products and Services.
Storypark Group maintains administrative, technical and physical safeguards designed to protect Personal Information against unauthorised access, disclosure, alteration, misuse, interference, loss and destruction.
These safeguards include, where appropriate:
While Storypark Group implements commercially reasonable safeguards, no method of electronic transmission or storage is completely secure. Accordingly, Storypark Group cannot guarantee the absolute security of Personal Information.
Customers and users are also responsible for maintaining appropriate security over their own accounts, credentials, devices and systems used to access the Products and Services.
If Storypark Group becomes aware of a Security Incident affecting Personal Information under its control, Storypark Group will investigate the incident and respond in accordance with applicable privacy laws.
Where required by applicable law, Storypark Group will notify affected Customers, individuals and relevant regulators within 72 hours.
Customers must notify Storypark Group without undue delay if they become aware of any actual or suspected Security Incident affecting the Products and Services or Customer Data.
Storypark Group retains Personal Information only for so long as reasonably necessary to fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce our agreements and protect the security and integrity of the Products and Services.
Retention periods vary depending on the type of Personal Information and the relevant Products and Services.
Administrative information, billing records and other business records may be retained for periods required by applicable law.
Where Products and Services include Child Records, different retention practices may apply because Child Records may be shared between multiple authorised users and organisations. Following closure of an account, some Child Content or Child Records may remain accessible to other authorised users where required for the continued operation of the relevant Products and Services.
Storypark Group may also retain:
where reasonably necessary for legal, regulatory, operational, security, fraud prevention or business continuity purposes.
Where Personal Information is no longer required, Storypark Group will securely delete, destroy or de-identify it in accordance with applicable law.
In accordance with Australian privacy laws, you may have the right to:
Where Storypark Group processes Personal Information on behalf of a Customer, some requests may need to be directed to the relevant Customer because they control the relevant Personal Information.
Storypark Group will respond to privacy requests within the time required by applicable law.
Where permitted or required by law, Storypark Group may refuse a request where a legal exemption applies or where the request is manifestly unfounded, excessive or cannot reasonably be fulfilled.
Storypark Group may send marketing communications about our Products and Services where permitted by law.
You may opt out of receiving marketing communications at any time by:
Even if you opt out of marketing communications, Storypark Group may continue to send service-related, transactional, billing, security and administrative communications where reasonably necessary.
Storypark Group may update this Privacy Policy from time to time to reflect changes to our Products and Services, technology, privacy practices or legal obligations.
Where changes are material, Storypark Group will take reasonable steps to notify affected users before the changes take effect.
The latest version of this Privacy Policy will always be published on the relevant Storypark Group website.
Your continued use of the Products and Services following the effective date of an updated Privacy Policy constitutes acknowledgement of the updated Privacy Policy.
If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact:
Email: privacy@storypark.com
Storypark Group will acknowledge privacy enquiries as soon as reasonably practicable and will respond within the timeframes required by applicable privacy law.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner or another competent privacy regulator with jurisdiction over your complaint.
Join over 6,700 Australian early learning services who rely on Storypark every day.