What we collect, where it is kept, who else can see it, and how it is removed — for the schools using our digital newsletter platform, and for the families who read it.
Your subscriber list, articles, calendar and staff accounts are stored in Australia, on servers in Sydney.
Your data stays in Australia. The database holding your subscriber list, articles, calendar and staff accounts is hosted in Sydney, and so is the tool your staff write in. Photographs and published pages sit on Cloudflare's global network so newsletters load quickly anywhere, and newsletter emails are sent from Japan and stored in the United States — the two tables below name exactly what goes where.
We hold no student records. No names, results, attendance, medical, wellbeing or behavioural data. A newsletter may contain photographs and first names written by the school as editorial content, but we operate no student database of any kind.
Parents never create an account. There is no parent login, no password, no profile. A parent reads the newsletter as an ordinary web page. The only thing we hold about a parent is what they type into the subscribe box, if they choose to use it.
The school owns its content. Articles, photographs, calendar events and documents are supplied by school staff and remain the school's. We publish them; we do not use them for anything else.
Everything the system stores, in full.
| Whose | What | Why, and when |
|---|---|---|
| Parent | Email address. First and last name, if given. | Only if they use the subscribe box on a newsletter. Used to email them when a new issue is published, and for nothing else. |
| Reader | A page path and a date. | So a school can see how many people read each issue. No IP address, no device information, no identifier of any kind — the record is literally “the calendar page was opened on 12 August”. |
| School staff | Work email address, a password stored only as a cryptographic hash, an authenticator-app enrolment, and the time of their last sign-in. | To let staff sign in and write newsletters, and to record who published what. |
| School | Articles, photographs, PDFs, calendar events, school name, colours, logo and contact details. | Supplied by staff. This is the newsletter itself. |
The part that matters most to families, so we are specific about it.
They are cleaned automatically. Phones embed the exact location and time a photograph was taken. Every image uploaded to Modular Media has that data removed in the staff member's own browser, before it ever reaches us. Orientation is preserved; GPS coordinates, camera details, timestamps and embedded thumbnails are all discarded.
A published newsletter is a public web page. Newsletters are marked so search engines do not index them, which keeps a student's name from becoming searchable. That is not the same as private — a newsletter page, and the images on it, remain readable by anyone who has the web address. Please treat a newsletter link as public when deciding what to publish.
Removing images. Removing an article from a newsletter takes it off the page, but the underlying image file is not deleted at the same moment. If a school needs specific photographs permanently removed — a withdrawn consent, a family's request, or the end of our arrangement — tell us and we will delete them within 30 days.
Named plainly, provider by provider. Your school's records are held in Australia. Photographs and published pages are distributed globally, and email is sent from Japan and stored in the United States — both named below rather than glossed over.
| What | Held by | Where |
|---|---|---|
| Subscriber list, articles, calendar, staff accounts | Supabase (PostgreSQL) | Sydney, Australia |
| Photographs and PDFs | Cloudflare R2 | United States, distributed globally |
| Published newsletter pages | Cloudflare Pages | Global content network |
| The staff writing tool | Vercel | Sydney, Australia |
Every third party that touches school or family information, what each one receives, and on what basis.
| Provider | Contact | What it receives | Purpose | Lawful basis | Location |
|---|---|---|---|---|---|
| Supabase Inc. | supabase.com | School records, staff email addresses, subscriber email addresses, article and calendar content | Database, sign-in, application functions | Contract — necessary to provide the service | Sydney, Australia |
| Cloudflare, Inc. | cloudflare.com | Published pages, uploaded photographs and PDFs, reader IP address in transit | Hosting, content delivery, file storage, DNS, firewall | Contract | United States, global network |
| Vercel Inc. | vercel.com | Staff application requests and staff IP addresses | Runs the staff writing tool | Contract | Sydney, Australia |
| Resend | resend.com | Subscriber email address and first name, at the moment of sending | Sends the “new issue” email | Consent — the parent subscribed | United States (stored); emails sent from Japan (Tokyo) |
| Google LLC — Fonts | fonts.google.com | A reader's IP address when a page opens | Supplies the newsletter typefaces | Necessary to display the page | United States |
| Google LLC — Translate | translate.google.com | Page text and reader IP — only if a reader chooses to translate | Optional translation | Consent | United States |
| YouTube / Vimeo | youtube.com, vimeo.com | A reader's IP address — only if a school embeds a video and a reader plays it | Video playback | Consent | United States |
Each of these processes data only on our behalf, for the purpose named above. We do not sell, rent or trade information, and no advertising network has access to any part of the system. We use no customer relationship system, no telephony platform and no usage-profiling tools, so there is no second copy of your information sitting in a sales database.
| Control | What it means |
|---|---|
| Two-factor authentication | Compulsory for every staff account. Signing in to the newsletter tool requires an authenticator app as well as a password. |
| Separation between schools | Enforced in the database itself, not only in the application, so one school cannot read another's information. |
| Encryption | In transit and at rest, throughout. |
| Audit trail | Publishing, member changes, settings changes, subscriber exports and account resets are recorded against the person who made them, and kept. |
| Hidden from search engines | Every school newsletter is marked so search engines do not index it, so a student's name does not become searchable. |
| Restricted access | Only Modular Media staff can reach the underlying systems, and only for support and maintenance. Everyone with that access holds a current Working With Children Check. |
| Security testing | Automated security tests are run before each release, and a structured security test against the OWASP Web Security Testing Guide is carried out after major changes and at least annually. |
| What | Kept until | How it goes |
|---|---|---|
| Subscriber | They unsubscribe | The one-click link in every email. The record is deleted outright, not flagged. |
| Reader counts | The school leaves | Deleted with the school. Contains nothing identifying. |
| Staff account | Removed from the school | A School Admin, from the members page. Access ends immediately. |
| Articles, calendar, subscribers, audit history | The school leaves | Deleting the school removes all of it and takes the newsletter website down. |
| Photographs and PDFs | Deletion is requested | Removed within 30 days of a request. See Photographs above. |
A school may request a copy of, or the complete deletion of, its information at any time.
Access. You can ask what personal information we hold about you, and we will provide a copy.
Correction. If anything we hold about you is wrong or out of date, tell us and we will correct it. School staff can correct most of their own details directly in the newsletter tool.
Deletion. You can ask us to delete personal information we hold about you, or to remove you from any list. A parent can unsubscribe instantly using the link in any newsletter email, which deletes the record on the spot.
All of this is free of charge. Email privacy@modularmedia.com.au and we will respond within 30 days, usually much sooner.
If you want to complain. Email the same address. We will acknowledge within 5 business days, investigate, and give you a written answer within 30 days, including what we found and what we have done about it. If you are not satisfied with our response, you can raise it with the Office of the Australian Information Commissioner at oaic.gov.au, or with the Office of the Victorian Information Commissioner at ovic.vic.gov.au.
Where an incident involves unauthorised access to, or disclosure of, personal information, we will notify the affected school's principal and privacy contact as soon as practicable and within 72 hours of discovering it.
The notification will tell you what happened, when it occurred and when we discovered it, which individuals and what categories of information were affected, what we have done to contain it, and what your school may need to do. Where we cannot yet determine the full scope, we will notify you with what is known and keep you updated until it is resolved.
We will support your school in meeting its own obligations under the Privacy and Data Protection Act 2014 (Vic) and, where it applies, the federal Notifiable Data Breaches scheme, and we will notify the relevant Commissioner where the law requires it.
If we change this policy in a way that materially affects how we handle personal information, we will email every school administrator before the change takes effect, explaining what is changing and why. Minor corrections — a clarified sentence, an updated contact address — are made without notice, and the version and date at the top of this page always tell you which version you are reading.
Privacy Officer — Kevin Cummins, Modular Media
privacy@modularmedia.com.au
The Privacy Officer is responsible for privacy advice, handling enquiries, complaints and requests for access and correction, maintaining a record of what personal information we hold, assisting schools with privacy impact assessments, and liaising with the relevant Information Commissioner.
This page covers the Modular Media newsletter platform. Our broader company privacy policy, covering photography, video and marketing services, is published at modularmedia.com.au/privacy.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Because we work with Victorian government schools, we also work to the Privacy and Data Protection Act 2014 (Vic) and the Information Privacy Principles, and to each school's own privacy, consent and child-safe policies.