OurNews Privacy Policy
Last updated 17 August 2026
OurNews is a storytelling platform for schools, run by Bolsta Education Pty Ltd (ABN 15 693 606 996; “we”, “us”). This policy covers what personal information we collect, why, how we hold it, and how to access, correct or complain.
Who is responsible for what
- Everything a school publishes (its stories, photos and names) belongs to the school, which decides what to publish.
- We act only on the school’s instructions, under our Data Processing Terms (ournews.school/trust/data-processing), and don’t use, analyse or share that content for our own purposes.
- For staff accounts and reveal-gate visitor details, we decide why and how long we keep them.
What we collect, and why
- School staff account data. Names, work emails and sign-in records for staff who publish a school’s stories, to run and protect accounts.
- Reveal-gate visitor data. A school can withhold a story’s photos or names until a reader confirms an email; we record the email, IP, time and story, so the school knows who unmasked it and when.
- School Content. Story text, photos, captions and visibility settings a school uploads, held as processor under the Data Processing Terms.
We don’t hold class lists, parent or guardian details, student ID numbers, enrolment records, or a student information system feed, and don’t run facial recognition on any photo.
How long we keep it
| What | Kept for |
|---|---|
| Reveal-gate email address | 12 months, then deleted |
| Reveal-gate IP address | 90 days, then deleted |
| Anything removed (a takedown, a closed account) | Purged from backups within 7 days |
| A school’s content, after account end | 30 days to export, deleted at day 30, backups purged by day 37 |
How we hold it
- A school picks its region at account creation (Australia, the EU, the UK, the US or Singapore); content is stored there, encrypted at rest and in transit.
- No photo has a raw, public storage link; every image goes through our access-controlled route, checking the story’s visibility setting on each request.
- We rely on specialist providers: hosting, database, email, error monitoring, bot protection and rate limiting. Full list at ournews.school/trust/sub-processors.
Overseas disclosure
- Data lives in the region a school picks. Where OurNews or a sub-processor sends or accesses information from outside it (including vendor staff), that’s an overseas disclosure under Australian Privacy Principle 8. Per-vendor detail: ournews.school/trust/sub-processors.
Cookies
- Staff sign-in. A session cookie keeps a signed-in staff member signed in. It is httpOnly: scripts running in the page cannot read it.
- The reveal gate. After a reader confirms their email, a signed pass on their device remembers them for that school’s gated stories, so they aren’t asked to verify again on every story. It is valid for the school term.
- Reader preferences. A cookie stores a reader’s personalisation choice.
- No third-party analytics or tracking cookies run on school pages. Cloudflare Turnstile checks visitors aren’t bots on story submission and the reveal gate, using the IP address, TLS fingerprint and user-agent.
The OurNews website
ournews.school itself collects:
- Your email address, verified with a short-lived one-time code, when you open the demo; and the fact and time you opened it.
- Your name, school, and phone number if you register interest in the pilot, and whether you asked to be kept posted.
We use these to open the demo, keep a record of who has seen it, and send you information about OurNews if you asked. Unsubscribe or ask for deletion at any time: hello@bolsta.education.
With your consent in the website’s cookie banner, Google Analytics measures how the website is used; decline and it is not loaded. Analytics never runs on a school’s pages.
Children
- Photos and names of children appear only if a school chooses to publish them. The school is wholly responsible for ensuring consent and privacy policies are adhered to.
- Anyone in a school community, including a student, may pass the reveal gate. We do not ask for age verification.
Access and correction
- To see what account or reveal-gate data we hold about you, or have it corrected, email hello@bolsta.education.
- For a student’s image or name, contact the school; it holds the consent and publishing decision. We’ll help find and fix it, since every photo is filed against its story.
Complaints
Email hello@bolsta.education; we’ll look into it and respond. If you’re not satisfied with how we’ve handled a privacy complaint, contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Outside Australia, contact your own data protection authority.
Contact
Bolsta Education Pty Ltd (ABN 15 693 606 996)