OurNews Privacy Policy
Version 1.0 · Last updated 3 September 2026
OurNews is a storytelling platform for schools, run by Bolsta Education Pty Ltd (ABN 15 693 606 996; “we”, “us”). This policy covers what personal information we collect, why, how we hold it, and how to access, correct or complain.
Who is responsible for what
- Everything a school publishes (its stories, photos and names) belongs to the school, which decides what to publish.
- We act only on the school’s instructions, under our Data Processing Terms (ournews.school/trust/data-processing), and don’t use, analyse or share that content for our own purposes.
- For staff accounts and reveal-gate visitor details, we decide why and how long we keep them.
What we collect, and why
- School staff account data. Names, work emails and sign-in records for staff who publish a school’s stories, to run and protect accounts.
- Reveal-gate visitor data. A school can withhold a story’s photos or names until a reader confirms an email; we record the email, IP, time and story, so the school knows who unmasked it and when.
- School Content. Story text, photos, captions and visibility settings a school uploads, held as processor under the Data Processing Terms.
- Story submission data. When someone submits a story to a school, through the school’s submission link, by email, or a QR code, we hold the email address they verify and the submission itself during intake, so the school can review it and turn it into a story. If the school credits or records a contributor on the published story, that detail is held with the story as its content.
We don’t hold class lists, parent or guardian details, student ID numbers, enrolment records, or a student information system feed, and don’t run facial recognition on any photo.
How long we keep it
| What | Kept for |
|---|---|
| Reveal-gate email address | 12 months, then deleted |
| Reveal-gate IP address | 90 days, then deleted |
| Anything removed (a takedown, a closed account) | Purged from backups within 7 days |
| Story submissions (raw email and intake payload) | Raw email removed once the story is seeded, with a 7-day backstop. Intake and contributor payload erased within 30 days |
| A school’s content and staff accounts, after account end | 30 days to export, deleted at day 30, backups purged by day 37 |
| Staff sign-in and security-event records | IP addresses 90 days, staff identity 12 months; the de-identified event record is kept while the school’s account is open and for 24 months after it closes, so a late-reported incident can still be investigated |
| Staff interest in an upcoming feature (a “coming soon” click) | Who clicked is cleared after 90 days; the count is kept |
How we hold it
- A school picks its region at account creation (Australia, the EU, the UK, the US or Singapore); content is stored there, encrypted at rest and in transit.
- No photo has a raw, public storage link; every image goes through our access-controlled route, checking the story’s visibility setting on each request.
- We rely on specialist providers: hosting, database, email, error monitoring, bot protection and rate limiting. Full list at ournews.school/trust/sub-processors.
Overseas disclosure
- Data lives in the region a school picks. Where OurNews or a sub-processor sends or accesses information from outside it (including vendor staff), that’s an overseas disclosure under Australian Privacy Principle 8. Per-vendor detail: ournews.school/trust/sub-processors.
Cookies
OurNews sets only first-party cookies. We do not use third-party advertising or cross-site tracking cookies on school pages.
- Staff sign-in. Session cookies keep a signed-in staff member signed in. They are httpOnly, so scripts in the page cannot read them.
- The reveal gate. After a reader confirms their email, a signed pass on their device remembers them for that school’s gated stories for 120 days, so they aren’t asked to verify on every story. Short-lived httpOnly cookies hold the in-progress state while a reader is verifying.
- Story submission. When someone submits a story through the school’s link, an httpOnly pass remembers their verified email for 120 days, with a short-lived cookie holding the in-progress state during verification.
- The school link. For a Link-only school, an httpOnly cookie remembers that this browser holds the school’s link, for 120 days, refreshed on each visit.
- Reactions. A per-story cookie remembers which reactions this browser already gave, for 120 days, so a reader isn’t offered the same one twice. It is readable by the page by design and holds no personal information.
- Staff workspace. Small cookies remember a staff member’s workspace preferences, such as whether the sidebar is collapsed, and carry a story’s approval-share link while it is being shared internally.
- The demonstration site. On the OurNews demo, httpOnly cookies hold the demo gate and the “view as” role while someone tries the product. These never run on a real school’s pages.
- No third-party analytics or tracking cookies run on school pages. Cloudflare Turnstile checks visitors aren’t bots on story submission, the reveal gate and the demo, using the IP address, TLS fingerprint and user-agent.
The OurNews website
ournews.school itself collects:
- Your full name, email address, and phone number when you open the demo.
- Your name, school, and phone number if you register interest in the pilot, and whether you asked to be kept posted.
We email these demo details to the founder, who may follow up with you; they aren’t stored anywhere else.
We use these pilot details to send you information about OurNews if you asked. Unsubscribe or ask for deletion at any time: hello@bolsta.education.
With your consent in the website’s cookie banner, Google Analytics measures how the website is used; decline and it is not loaded. Analytics never runs on a school’s pages.
Children
- Photos and names of children appear only if a school chooses to publish them. The school is wholly responsible for ensuring consent and privacy policies are adhered to.
- Anyone in a school community, including a student, may pass the reveal gate. We do not ask for age verification.
Access and correction
- To see what account or reveal-gate data we hold about you, or have it corrected, email hello@bolsta.education.
- For a student’s image or name, contact the school directly; it holds the consent and publishing decision.
Complaints
Email hello@bolsta.education; we’ll look into it and respond. If you’re not satisfied with how we’ve handled a privacy complaint, contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Outside Australia, contact your own data protection authority.
Contact
Bolsta Education Pty Ltd (ABN 15 693 606 996)