Welcome to Quadley. Quadley (referred to as "we", "us", or "our") operates a platform designed to facilitate secure communication, community engagement, and incident reporting within educational institutions. We are committed to protecting the privacy and confidentiality of our users.

This Privacy Policy explains how we collect, hold, use, and disclose personal and sensitive information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and subsequent amendments.

1. The Kinds of Personal and Sensitive Information We Collect

To provide our services, maintain safety, and enable incident reporting, we collect both personal information and sensitive information.

Account and Contact Information: When you register for an account, we collect your first and last name and your email address.
Communication Data (Chat Messages): When you use our interactive chat features, our servers process and host the contents of your messages, timestamps, and interaction logs so the chat can function.

To protect player and student privacy, these chats are strictly confidential and are not systematically monitored, read, or accessed by Quadley or college administrators.

Chat data is only exposed to manual human review by a designated college administrator under two specific exceptions:
1. A user utilises the "Report Message" function to flag a specific piece of chat for harassment, violence, or bullying.
2. Our automated safety filters detect an explicit, critical reference to imminent self-harm or a threat of violence that requires immediate safety intervention.
User-Submitted Violence and Harassment Reports (Sensitive Information): If you utilise our manual reporting mechanism, you may submit text descriptions concerning incidents of harassment, bullying, inappropriate content, threats, gender-based violence, or other forms of violence. Under Australian law, information relating to a person's health, racial or ethnic origin, philosophical beliefs, or details regarding incidents of personal harm is classified as Sensitive Information and is afforded a higher level of protection.

2. Anonymity and Pseudonymity

In accordance with APP 2, Quadley allows users to submit reports about gender and other violence anonymously.

Anonymous Reports: If you choose to submit a report without providing identifying details, we do not systematically link that report text back to your account profile or contact information in our administrative dashboards.
The Nature of Contextual Identification: Users should be aware that if a report description contains highly unique, specific situational details, a human reviewer at your college may still be able to deduce identities based solely on context. Quadley takes reasonable data architecture steps to separate account profiles from anonymous submission boxes to prevent technical deanonymization.

3. How We Collect Your Information

We collect information directly from you when you interact with our platform:

When you create or update an account.
When you fill out and submit a "Report Message" form or provide additional contextual details regarding an incident.

We do not collect personal information from third-party data brokers or open-web scraping tools.

4. Purposes of Collection, Use, and Holding of Information

We collect, hold, use, and process your personal and sensitive information for the following specific purposes:

To operate, maintain, and secure the Quadley platform.
To facilitate student-to-student and community communications.
To enforce our community guidelines, protect users from cyber-bullying or harassment, and prevent threats or incidents of self-harm.
To securely route safety and incident reports to the appropriate authority for manual investigation and pastoral care.

5. Automated Decision-Making (ADM) Transparency

Compliance Statement under APP 1.7 – 1.9 (Effective 10 December 2026)

Quadley utilises automated, rule-based technology to review real-time chat data for safety purposes. This system does not use generative artificial intelligence to interpret context dynamically, nor does it use personal data to train public models. Instead, it relies on static matching against a predefined list of prohibited words and phrases.

This automation results in two specific outcomes:

Automated Nudges ("Think Before You Send"): If a typed message contains language matched to our standard harmful or harassing database, the system generates an automated pop-up warning encouraging the user to edit or delete the text before transmission. This is a non-binding notice; the user retains the ability to bypass the prompt.
Automated Restrictions ("Message Blocked"): If a typed message matches criteria indicating an active threat of violence or a reference to self-harm, the computer program automatically executes a definitive, restrictive decision. The message is completely blocked and cannot be sent. This processing relies on scanning the active text tied to your account token.

Your Right to Request Human Review: If you believe your message was blocked or flagged in error by our automated filter, you have the right to request an independent human review of the decision. To lodge a review request, please contact our Privacy Officer using the details provided in Section 11 of this policy.

6. How We Disclose Your Information to Third Parties

Quadley does not sell, rent, or trade your personal or sensitive information to corporate advertisers or third-party brokers.

However, because Quadley is a tool deployed on behalf of residential organisations, your data is disclosed to third parties under the following conditions:

Manual Report Routing: When a user explicitly submits a report via our app dashboard (e.g., flagging a message for Harassment, Bullying, or Threats/Violence), this data is not analysed by AI. It is securely routed directly to the designated human administration team at your respective college. The college administration acts as an independent entity that will evaluate the text manually to execute institutional disciplinary or safety workflows.
Legal & Law Enforcement Obligations: We may disclose personal information if required to do so by an Australian court order, subpoena, or a lawful request by law enforcement under the Privacy Act 1988 (Cth), particularly where a threat to life, health, or public safety is identified.

7. Cross-Border Data Disclosures

Quadley prioritises domestic data storage wherever possible.

All primary application databases housing user names, email addresses, and manual violence reports are hosted within secure servers physically located in Australia.
We do not transfer sensitive user-submitted violence reports to overseas cloud providers or external automated third-party processors.

8. Data Security and Retention

Given the sensitive nature of the reports processed by our manual flows, Quadley maintains stringent security protocols in compliance with APP 11:

Access Control: Access to back-end administration panels containing user information or report text is restricted via strict Role-Based Access Control (RBAC) and protected by mandatory Multi-Factor Authentication (MFA).
Encryption: Data is encrypted both in transit (using HTTPS/TLS protocols) and at rest within our databases.
Data Destruction: Personal and sensitive information is only held for as long as necessary to fulfil our service commitments to your residential institution or as required by statutory record-keeping frameworks. Once data is no longer required, it is securely destroyed or permanently de-identified.

9. Accessing and Correcting Your Information

Under APPs 12 and 13, you have the right to request access to the personal information we hold about you, and to request that we correct it if it is inaccurate, out of date, incomplete, or misleading.

You may update fundamental account parameters (such as your name) directly within your app profile settings.
For formal access requests or comprehensive data history pulls, please email our Privacy Officer. We will process your request within 30 days, free of charge, subject to identity verification.
Note on Sensitive Reports: To protect the privacy and physical safety of third parties, we may restrict access to portions of an incident report if disclosing it would breach the privacy rights of another individual or jeopardise an ongoing campus safety investigation.

10. Serious Invasions of Privacy (Statutory Tort Compliance)

Quadley acknowledges its obligations regarding individual privacy rights under Australian common law and statutory frameworks. We maintain rigorous physical, administrative, and network security policies designed to prevent data leaks. Any unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm to an individual will be handled immediately via our Notifiable Data Breaches (NDB) framework, and affected individuals, along with the OAIC, will be notified immediately.

11. How to Make a Complaint or Appeal an Automated Decision

If you have a concern about how we have handled your privacy, wish to appeal an automated chat block, or believe we have breached the Australian Privacy Principles, you can lodge a formal complaint with our Privacy Officer:

Email: support@quadley.com
Mail: Attn: Privacy Compliance Officer, Quadley Pty Ltd, PO Box 1252, Fortitude Valley QLD 4006

We will investigate your complaint thoroughly and provide a written response within 30 days outlining our findings and any remedial actions taken.

If you remain unsatisfied with our internal resolution, you have the right to escalate your complaint directly to the external regulator:

Office of the Australian Information Commissioner (OAIC)
- Web: www.oaic.gov.au
- Phone: 1300 363 992