Nexties Classroom: Security & Risk Information Sheet

Last updated: [DATE]

This sheet answers the questions a school’s own due diligence process (or the Office of the Privacy Commissioner’s digital technology checklist) will typically ask before approving a new tool for use with students. It’s designed to be read alongside our Student Data Privacy Notice, which is the fuller reference document.

What personal information does Nexties Classroom collect?

Name and school-issued contact details; responses given during a student’s conversations with Nexties Classroom’s AI features (typed, or spoken via optional voice input); and the insights, Future Selves (pathway explorations), and course recommendations generated from those. We also collect usage information (messages sent, time spent, session count, last active date).

Because the conversation is open-ended and student-led, the profile Nexties builds may also record contextual factors a student volunteers that affect their pathway options — for example health considerations, family or caregiving responsibilities, learning barriers, or sources of stress. This information is used only to make guidance relevant to that student. It is never shown to school staff and is structurally excluded from every teacher-facing view and report. We collect only what’s needed to provide career and pathway guidance.

Does Nexties Classroom use AI to process student information? What does it do?

Yes. AI powers the interactive conversation features that help students explore career and study pathways. Personal information provided during a conversation is not used to train any underlying AI model — the AI only processes what’s needed to generate a response to that student in that session. Course and pathway recommendations are based on the student’s own profile and publicly available course and provider information, not any commercial arrangement.

How is information stored and kept secure?

Currently hosted on Amazon Web Services (AWS) in the Australia region (ap-southeast-2), with a planned future migration to the AWS New Zealand region (no confirmed date yet).

Security measures include:

Encryption in transit and at rest
Role-based access control
Multi-factor authentication for privileged access
Logging and monitoring of access to production systems

We don’t sell student information or use it for advertising or marketing. We share identifiable student information only where required by law, with the small number of service providers who help us run the platform (see below), or where a student has separately given further consent for a specific feature.

A school’s own staff can see specified categories of their students’ information where granted permission, set out in full in the Student Data Privacy Notice:

Insights and observations
Future Selves
Saved course recommendations
Usage information
A one-to-one preparation report, available to school administrators only

Raw conversation transcripts are never visible to the school.

Separately, we may use anonymised, aggregated insights, which cannot identify any individual student, for sector-wide or government reporting purposes — for example with the Ministry of Education, the Tertiary Education Commission, or regional partners such as Auckland Council on place-based initiatives. No individual student is identifiable in this reporting.

Who are the third-party providers involved, and what do they do?

We use a small number of trusted service providers to operate Nexties Classroom. These providers only process the minimum data needed for their specific function and do not use student data for their own purposes.

AWS — Hosting, databases, file storage (Sydney, ap-southeast-2) — All student data at rest
Vercel — Application hosting and delivery for the student-facing app — Data in transit during use
OpenAI — Powers the AI conversation features, and converts optional voice input to text — Conversation content; audio, transiently. Does not train on this data
Braintrust — AI orchestration, routing, and performance logging — Conversation content, for quality monitoring
Mixpanel — Product and engagement analytics behind the school dashboard — Usage events, linked to student, school and year level
Pusher — Real-time delivery of updates to the student’s screen during a conversation — Message delivery signals
Sentry — Error monitoring and diagnostics — Technical error data, filtered to remove personal information
Postmark — Transactional email (invitations, notifications) — Name and school email address

Is there third-party monitoring, or access to microphones, cameras, or location?

Nexties Classroom does not access cameras or location data, and does not conduct location tracking or any form of third-party monitoring.

It does offer optional voice input. A student may tap a microphone button to speak a response instead of typing it. The browser requests microphone permission the first time, and a student can decline it or simply never use the feature — typing is always available. When a student does use it, the recording is sent to OpenAI solely to convert speech to text. The resulting text becomes the student’s message in the conversation; Both OpenAI or Nexties do not store the audio recording, and it is not used for any other purpose. There is no always-on, background, or ambient microphone access — recording happens only when a student has actively started one, and ends when they finish.

What happens to student information when a student leaves the school, or the school stops using Nexties Classroom?

A student can request to transfer their account to a personal email at any time (for example, when finishing school), which moves them to the general Nexties Platform and ends the school’s ongoing access to their information. Otherwise, personal information is retained for 12 months after a student’s account becomes inactive, then anonymised, unless earlier deletion is requested. The same approach applies if a school’s agreement ends. Anonymised, aggregated insights may be retained indefinitely for sector-level reporting (for example, to the Ministry of Education), since de-identified information is no longer personal information under the Privacy Act 2020.

Raw student data is not handed over to a school in a portable form, given the nature of the AI-derived insights involved; a student’s underlying Privacy Act rights (access, correction, deletion) apply regardless of the school’s own involvement.

Does this apply to any pre-purchase trial period?

Nexties Classroom’s Base Plan is free on an ongoing basis, not a time-limited trial, so the practices above apply from first use.

Does the technology use strong authentication practices?

Yes. Students and staff authenticate via Microsoft or Google sign-in on the school’s own domain; there are no separate Nexties-specific passwords to manage for school accounts. Multi-factor authentication is used for privileged internal access.

Does Nexties Classroom hold any independently verified security or privacy certifications (e.g. ISO, SOC 2)?

How does Nexties Classroom integrate with a school’s existing systems?

Nexties Classroom integrates with a school’s existing Microsoft or Google identity for sign-in. There is currently no integration with student management systems; student rosters are established through the school’s email domain rather than an SMS feed.

What happens if there’s a data breach?

If a notifiable privacy breach occurs, we notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020, and notify the affected school as soon as reasonably practicable.

Who is the point of contact for privacy questions?

Craig Boxall, Privacy Officer, privacy@nexties.com. General questions: info@nexties.com.

This sheet reflects Nexties Classroom’s Base Plan as at [DATE]. It will be updated alongside the Student Data Privacy Notice and Terms of Use whenever practices change.