Trust & Compliance

Who's responsible for your data

SwiftsReader is built and operated by Ten Labs Pty Ltd, an Australian company. We are the ones accountable for how student data is collected, used, and protected — not a subsidiary of a larger platform, not a reseller.

How SwiftsReader Schools handles student consent

SwiftsReader Schools is supplied to schools for use by their enrolled students in Year 4 and above. Students access it through an account their school creates and manages, not through open self-signup.

• The school is responsible for obtaining any consent required under its own enrolment processes and applicable law before giving students access.
• We process student information — reading progress, assignment submissions, AI Tutor conversations, and reward-profile selections — solely to provide the educational service the school has contracted, for as long as the school's licence is active.
• Parents and guardians with questions about their child's data should contact their school first, since the school controls enrolment and account access. We assist schools in responding to these requests.

Full detail: Privacy Policy, Section 11.

Where data is stored, and how it's protected

Data is currently stored on infrastructure located primarily in the United States (Vercel for hosting, Neon/Prisma for the database), protected with TLS in transit and encryption at rest, with access restricted to authorised personnel. We disclose this location openly rather than leaving it implicit — see our Privacy Policy for the full subprocessor list. Australian data residency is on our roadmap as we scale within Australia and New Zealand.

Security practices

• Dependency hygiene: in August 2026 we ran a full audit of every software dependency across the platform and patched all known vulnerabilities flagged by GitHub's security scanning — this is now part of our ongoing release process, not a one-off.
• Authentication: account sign-in is handled by Clerk, a dedicated identity provider, rather than a custom-built auth system.
• Payments: handled entirely by Stripe — we never see or store full card details.
• Least-privilege access: access to student data is restricted to what each service needs to function, not broadly shared across our systems.

Third-party services we use

We use a small number of specialist providers to deliver the service — for authentication, payments, AI features, hosting, and email. Every one is named, with what it's used for and where it's based, in our Privacy Policy, Section 4. None of them are permitted to use student data for advertising or to train their own models on it.

Data retention & deletion

Account data and uploaded documents are retained for as long as an account is active. If an account is deleted, personal data is removed within 30 days, except where we're required by law to retain it longer.

Where we're heading on compliance

We're a young company — SwiftsReader launched in 2026 — and we'd rather be upfront about what's in place versus what's in progress than overstate either: