SCHOOL HOUSE COMP PRIVACY POLICY Effective date: 07/09/2026 Last updated: 07/09/2026 1. WHO WE ARE LocalUplift, operating as School House Comp (we, us, our), provides an online house-points management and scoreboard service for schools and organisations (the Service). For questions about this Privacy Policy or our handling of personal information, contact us at privacy@schoolhousecomp.com or: LocalUplift trading as School House Comp privacy@schoolhousecomp.com This policy explains how we collect, use, disclose, retain, and protect personal information when you use the Service or contact us. 2. OUR ROLE AND YOUR SCHOOL'S ROLE When a school or organisation uses the Service, it decides what staff, student, house, event, and score information to enter. In relation to that information, the school or organisation is generally the controller or responsible organisation, and we generally process the information on its behalf as a service provider or processor. Schools and organisations are responsible for providing any required privacy notices, obtaining permissions or consents, responding to requests from their students, families, and staff, and ensuring that their use of the Service complies with applicable law and policy. Where we collect information directly from you for our own business purposes, such as account enquiries, billing administration, security, and support, we act as the controller or responsible organisation for that information. 3. INFORMATION WE COLLECT We may collect the following categories of information: - Account and staff information: name, email address, school or organisation, user role, and encrypted or hashed password credentials. - School and competition information: school name, house names, house colours, house logos, display settings, competition or event names, points totals, point-change reasons, and point history. Point history may identify the staff member who made a change. - Invitation and account-recovery information: invited email address, invitation token, password-reset token, token expiry and use status. - Billing information: plan, subscription status, trial and renewal dates, Stripe customer and checkout reference identifiers, and billing-email records. We do not receive, process, or store full payment-card details; Stripe processes card payments. - Uploaded content: house logos and other files that an authorised user uploads. Do not upload personal information unless you have a lawful basis and authority to do so. - Technical and security information: session identifiers stored in browser cookies, IP address and basic request information that may be recorded by our hosting infrastructure, browser and device information provided in ordinary web requests, and security or error logs where enabled. - Communications: information you provide when contacting support or responding to service emails. The Service is intended for use by authorised school or organisational staff. We do not knowingly solicit personal information directly from children. Schools must not create direct student accounts unless we have expressly agreed this in writing and it is permitted by applicable law. 4. HOW WE USE INFORMATION We use personal information to: - provide, operate, authenticate, secure, and support the Service; - create and administer school accounts, staff access, invitations, password resets, and sessions; - display house scores and event information as configured by the school or organisation; - process trials, payments, subscription access, renewals, and related notices; - send service, security, account, billing, and support communications; - investigate, prevent, and respond to fraud, misuse, technical issues, and legal or security incidents; - comply with legal obligations and enforce our Terms of Service; and - improve and maintain the Service using aggregated or de-identified information where reasonably practicable. We do not sell personal information. We do not use personal information for targeted advertising. 5. PUBLIC SCOREBOARDS The Service includes live school and event scoreboards that may be publicly accessible to anyone with the relevant URL. These pages can display school names, house names, house logos, colours, points, and event names. Information displayed publicly should not include personal information unless the school or organisation has determined that public display is lawful and appropriate. 6. COOKIES AND SIMILAR TECHNOLOGIES We use a strictly necessary session cookie named shp.sid to keep authorised staff signed in and to protect the Service. The cookie is HTTP-only and is configured with same-site protections. In production it is configured for secure HTTPS transmission. We do not use advertising cookies. You can control cookies through your browser settings, but disabling necessary cookies may prevent you from signing in or using parts of the Service. 7. HOW WE SHARE INFORMATION We may share information only as necessary with: - the relevant school or organisation and its authorised users; - service providers that help us host, maintain, email, secure, support, or process payments for the Service, including Stripe for payment processing and [HOSTING PROVIDER] and [EMAIL PROVIDER] where applicable; - professional advisers, insurers, auditors, regulators, law enforcement, or other parties where required or permitted by law; and - parties involved in a merger, acquisition, financing, reorganisation, sale of assets, or similar transaction, subject to applicable law. We require service providers to handle personal information only for authorised purposes and with appropriate safeguards. We do not share personal information with third parties for their own direct-marketing purposes. 8. INTERNATIONAL DATA TRANSFERS Your information may be processed in countries other than the country where it was collected, including where our service providers operate. Where required, we will use appropriate safeguards for international transfers, such as contractual protections recognised by applicable law. [INSERT TRANSFER MECHANISM AND RELEVANT HOSTING LOCATIONS.] 9. RETENTION We retain personal information for as long as reasonably necessary to provide the Service, comply with legal and accounting obligations, resolve disputes, enforce agreements, and maintain security. Account, school, competition, and point-history information is generally retained while the account remains active. Following account closure, we may delete or anonymise account content after [INSERT RETENTION PERIOD], unless a longer period is required or permitted by law. Invitation and password-reset tokens expire automatically and should not be used after expiry. Session cookies expire after up to seven days unless ended earlier. You are responsible for exporting any records your school or organisation needs before account closure. Contact support@schoolhousecomp.com to request deletion or discuss retention requirements. 10. SECURITY We use reasonable technical and organisational measures designed to protect information, including password hashing, authenticated staff access, role-based permissions, session protections, limits on login attempts, and payment processing through Stripe's hosted checkout. No system is completely secure, and we cannot guarantee absolute security. You must protect account credentials, use unique passwords, restrict staff access to authorised people, and notify us promptly at support@schoolhousecomp.com if you believe your account or information has been compromised. 11. YOUR PRIVACY RIGHTS Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or objection to the processing of your personal information; to receive a portable copy of certain information; to withdraw consent; or to complain to a privacy regulator. If your information was entered by a school or organisation, please direct your request to that school or organisation first. We will assist it as appropriate. For information we control directly, contact support@schoolhousecomp.com. We may need to verify your identity and authority before acting on a request. In Australia, privacy matters are regulated by the Office of the Australian Information Commissioner (OAIC), which administers the Privacy Act 1988 and the Australian Privacy Principles. If you believe your privacy rights have been breached, you may lodge a complaint with the OAIC at https://www.oaic.gov.au or by contacting 1300 363 992. 12. THIRD-PARTY SERVICES The Service uses Stripe to process payments. Stripe's use of personal information is governed by its own privacy policy. The Service may also link to or interact with third-party services. We are not responsible for the privacy practices of third parties; review their policies before providing them information. 13. CHANGES TO THIS POLICY We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date and, for material changes, provide reasonable advance notice through the Service or by email where appropriate. Your continued use of the Service after the updated policy takes effect is subject to the updated policy. 14. CONTACT AND COMPLAINTS Contact us with privacy questions, requests, or complaints at support@schoolhousecomp.com or at the address in section 1. We will respond within the timeframe required by applicable law.