Trust and security
Where Qwizflow keeps data, how it is protected, and what happens if something goes wrong. Our privacy policy is the full account.
Where data is kept
- Learning records: Google Firestore, Melbourne, Australia (australia-southeast2).
- Sign-in: Firebase Authentication, United States.
- AI requests: Google AI (text, images and voice), Google's global endpoints.
- Our server: Microsoft Azure, Australia Southeast.
Backups and recovery
- The learning-records database has point-in-time recovery switched on, covering the last 7 days, and is protected against deletion.
- Encrypted daily backups are kept in Australia for up to 35 days.
Encryption and AI masking
- Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
- Email addresses and phone numbers, and names written behind a label, are masked before any AI call; the masking is pattern-based, so it cannot reliably catch personal details a learner types in their own words.
If something goes wrong
- We notify affected users and school administrators within 72 hours of becoming aware of a data breach.
- We report notifiable data breaches to the Office of the Australian Information Commissioner, under the Notifiable Data Breaches scheme.
Who processes data
Each service provider we use, what it receives and where, is listed in section 4 of our privacy policy.
Assessments and reporting a problem
Qwizflow does not hold ST4S (Safer Technologies 4 Schools) approval.
To report a security problem, email support@qwizflow.com. Our security.txt gives the same contact.