Privacy Policy

PassNaati is operated by Tatwam Ventures (“we”, “us”). This policy explains what personal information we collect when you use the PassNaati website and app, why we collect it, who we share it with, and how you can access, correct or delete it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Information you give us

• Account details: your name and email address, and a securely hashed password. If you sign in with Google, we receive your name, email address and profile photo from Google.
• Study details: your CCL language, target score, exam date and study plan settings, if you choose to provide them.
• Practice content: recordings of your spoken interpreting practice, the transcripts made from them, your marks and feedback, mock exam results, vocabulary progress, and any photos of handwritten notes you upload for note-taking practice.
• Messages: what you send us when you contact support or request a refund or language change.
• Email choices: whether you agreed to receive practice tips, reminders and offers, and when and where you agreed.

Information collected when you use the Service

• Payments: Stripe collects your card details. We receive your plan, payment status, amounts and receipt references, never your full card number.
• Technical information: your IP address, browser and device type, and records of requests to our servers. We use these to keep the Service secure, prevent abuse and fix problems.
• Error reports: when something goes wrong, Sentry records technical details of the error. For a small share of visits it also records a replay of the page interaction, with all text masked and images and media blocked.
• Analytics, only with your consent: Google Analytics and our own sign-up journey measurement run only if you switch them on. Both are off by default, and you can change your choice at any time. See our Cookie Policy.

You can browse our public pages without an account. You cannot use the practice features anonymously, because your recordings and progress have to be linked to your account.

• to provide the Service: practice sessions, transcription, marks and feedback, mock exams, progress tracking and study plans;
• to manage your account, payments and subscription;
• to send account emails, such as verification, password resets, receipts and notices about your subscription or these policies;
• to send practice tips, reminders and offers, only if you have agreed;
• to answer support requests;
• to keep the Service secure and prevent misuse;
• to check and improve the accuracy of our transcription and marking (see section 4); and
• to meet our legal obligations.

When you practise, your recording is sent to AI providers to be transcribed, and the transcript is sent to AI models that estimate your marks and write feedback. The providers are listed in section 5. They receive the recording or text needed for that task, not your name or email address.

• Marks are produced automatically. They are practice estimates, not NAATI results, and are not used to make decisions about you beyond showing your progress and suggesting what to practise. If you think a mark is wrong, contact us and a person will look at it.
• We do not use your recordings to identify you by your voice.
• To check and improve our marking, we may review practice transcripts and marks with your name and email address removed. Tell us at privacy@passnaati.com if you do not want your practice used in this way.

We do not sell or rent your personal information, and we do not share it with advertisers. We share it only with the service providers below, who process it for us to run the Service, and where the law requires.

• Vercel

  Hosting the website and app

  Processed in: Australia (Sydney), with a global network

• Neon (on Amazon Web Services)

  Our database

  Processed in: Australia (Sydney)

• Cloudflare (R2)

  Storing practice recordings

  Processed in: Global network

• Groq

  Speech transcription and AI scoring

  Processed in: United States

• Google (Gemini)

  Speech transcription and AI scoring

  Processed in: United States and other countries

• OpenAI

  Fallback transcription and scoring; reading photos of handwritten notes you upload

  Processed in: United States

• Anthropic

  Fallback AI scoring

  Processed in: United States

• Stripe

  Payments

  Processed in: Australia, United States and other countries

• Resend

  Sending email

  Processed in: United States

• Sentry

  Error monitoring

  Processed in: United States

• Upstash

  Rate limiting and scheduled jobs

  Processed in: United States and other countries

• Google Analytics (only if you allow it)

  Website analytics

  Processed in: United States and other countries

We may also disclose information if the law requires it, to protect people from serious harm, or to a buyer of the business, who would have to handle it in line with this policy.

Our database and website hosting are in Sydney, but several of the providers above process information in the United States and other countries, as listed in section 5. We choose providers that protect personal information under their contractual terms, and we send them only what they need for their task.

We send account emails whenever they are needed. We send practice tips, reminders and offers only if you agreed, for example by ticking the box at sign-up or switching email on in your settings. Every one of these emails has an unsubscribe link, and you can also change your choice in your account settings.

• Account details, study details and practice content: until you delete them or your account.
• Recordings in an unsaved practice draft: deleted when the draft is discarded or expires.
• Payment and tax records: for as long as Australian tax law requires, usually 5 to 7 years.
• Technical logs and error reports: for a limited period set by our providers, typically up to 90 days.

When you delete your account in Settings, we delete your account, practice history and recordings. Copies in backups are removed as backups are replaced in the normal cycle. Stripe keeps its own payment records as the law requires.

Information is encrypted in transit, stored with providers that encrypt it at rest, and access is limited to people who need it to run the Service. Passwords are stored only as secure hashes, and recordings are kept in private storage that only your account can access through the Service. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.

• Access: ask for a copy of the personal information we hold about you.
• Correction: update your details in Settings, or ask us to correct anything that is wrong.
• Deletion: delete your account in Settings, or ask us to delete specific information.
• Email: unsubscribe from non-essential emails at any time.
• Analytics: switch analytics on or off at any time.

Email privacy@passnaati.com to make a request. We will respond within 30 days. We may need to confirm your identity first, and if we cannot do what you ask, we will explain why.

The Service is for people aged 16 and over. If you believe someone under 16 has given us personal information, contact us and we will delete it.

If you have a question or a complaint about how we have handled your personal information, email privacy@passnaati.com. We will reply within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

We will update this policy when our practices change. The date at the top shows when it last changed. If a change significantly affects how we use information we already hold, we will tell you by email or in the Service before it takes effect.