Privacy policy
Last updated: 15 October 2026. See also our Terms of Service.
CourseForge · The Trustee for The Marchesani Family Trust · ABN 36 699 424 420
hello@aisi.au
1. Who is responsible
CourseForge is the trading name of The Trustee for The Marchesani Family Trust, ABN 36 699 424 420. Contact hello@aisi.au for privacy questions, access or correction requests, deletion requests or complaints. This policy covers our website, Course Studio, LMS and optional add-ons. An organisation using the LMS also has responsibilities for the learner information it collects and manages, and its own privacy notice may apply to that information.
2. Information we collect
We collect account and profile details such as email address, display name, profile photo, authentication information and organisation membership. Cloud features store course drafts, SCORM files, version history, branding, certificate designs and collaboration records you save. LMS records can include enrolments, learning activity, progress, quiz and assessment answers, evidence and attachments, feedback, workplace or placement logs, support requests, certificates and audit records. SMS features use phone numbers, consent preferences, message content and sending records. We also hold billing identifiers, plan, seats, subscription status, transaction information and credit balances, plus technical, security and operational logs.
3. How we collect it and your choices
Information comes from you when you register, upload, edit, submit work, contact support or use a feature; from your training organisation or an authorised integration when it invites or enrols you or supplies records; and from service activity and payment notifications. Organisations must explain their collection to learners and have the necessary authority and consents, including for any sensitive information contained in evidence or support records. Provide only information needed for the relevant task. If you do not provide required account, billing or training information, we or your organisation may be unable to provide the requested feature. You can choose not to use optional cloud, AI or SMS features.
4. Browser-based editing is not the same as cloud or AI
Core SCORM opening, editing, validation, preview and export run in your browser. Opening a package locally does not by itself upload it to our cloud storage. Saving cloud projects or course drafts, sending a course to the LMS, or requesting AI assistance transmits the relevant files or text to online services. Imported courses and embedded videos, fonts, links or other resources can also contact their original external providers when loaded; those providers’ privacy practices apply. Local autosaves and preferences may remain in your browser until cleared. Keep local backups and take care on shared devices.
5. Why we use information
We use information to authenticate accounts, deliver and sync courses and projects, administer organisations and enrolments, record learning and assessments, issue certificates, provide support and notifications, process payments and credits, calculate allowances, prevent abuse and unauthorised access, diagnose errors and meet legal obligations. Organisational reports and authorised integrations use the records needed for their requested purpose. We do not sell personal information. Marketing communications, where sent, are subject to applicable consent and unsubscribe requirements; necessary service messages are separate from marketing.
6. Access by your organisation and collaborators
Authorised owners, administrators, trainers and assessors can access learner records according to their role and organisation permissions. Employer supervisors or other authorised members may see the records assigned to their role. Invited project collaborators can access the shared project to the extent their permission allows. Information you or your organisation exports or sends through an authorised integration passes to that recipient and is subject to its handling practices. Learners should ask their training organisation about enrolments, assessment records, retention and removal of access. Learner accounts do not have unrestricted administrator or account-deletion controls.
7. Service providers and other disclosures
We use Lovable Cloud (Lovable Labs Incorporated, on Supabase and Amazon Web Services infrastructure in Mumbai, India) for hosting, database, file storage, sign-in and account emails, and Cloudflare for web delivery. Stripe receives the identity, billing and transaction information necessary for checkout, tax and subscriptions; full payment-card details are handled by Stripe rather than CourseForge. SMS Messenger (SL Interactive) receives the destination number and message when an authorised SMS is sent. AI providers receive the feature inputs described below. External media providers receive the requests needed to display their content. Authorised support personnel may access relevant information when necessary to resolve an issue. We may disclose information when required by law or reasonably necessary to protect legal rights, safety or security.
8. AI processing and assessment assistance
When an authorised user requests AI feedback or answer checks, relevant assessment questions, learner answers, marking guides and mapped criteria are sent to Lovable AI Gateway, which currently routes them to Google Gemini models. Voiceover requests send narration text to Google Gemini text-to-speech through Lovable AI Gateway. Avoid including unnecessary identifiers or sensitive information. CourseForge does not itself use your course or learner content to train an AI model; this statement is not a guarantee about every external provider’s retention or processing terms. Contact us before submitting information requiring specific provider or location assurances. AI suggestions can inform assessor feedback and answer checks, and configured quizzes can calculate scores automatically. The LMS assessment workflow requires the authorised assessor to make final competency decisions; AI drafts do not independently award competency or issue credentials.
9. Overseas processing
Our hosting, payment, email, messaging, media and AI providers may process information outside Australia. Processing locations depend on the provider and feature; we do not represent that all information remains in Australia. Contact hello@aisi.au for current provider and processing-location information before using a feature subject to a data-residency requirement. Where applicable law requires it, we take reasonable steps concerning overseas recipients and required safeguards. An organisation must assess whether the features it enables meet its own privacy and regulatory obligations.
10. Security and incidents
We use authentication, access-controlled storage, organisation permissions and other technical safeguards to limit unauthorised access. Access is not limited solely to a file owner: authorised organisation members and collaborators may also have permission. No online service or device is perfectly secure. Protect your credentials and API keys, remove access when no longer required and keep backups. Report suspected incidents to hello@aisi.au. We assess suspected breaches and, where required by applicable law, notify affected people and the appropriate regulator.
11. Retention and deletion
Information is kept for as long as needed for the purpose for which it was collected, service operation, dispute resolution, security or applicable legal and recordkeeping duties. Project deletion can initially move content to trash, and file cleanup and backup cycles mean deletion is not necessarily immediate. Available account deletion removes the account and its owned Course Studio data, but is not a promise that every billing, audit, backup or organisation-held learner record disappears immediately. Training organisations may need to retain assessments, evidence and issued-certificate records after a learner leaves. Billing records may be retained for tax and accounting requirements. Cancel paid subscriptions separately before closing an account. When an LMS subscription ends, organisation learner records, reports and certificate records stay readable and exportable for 30 days after the paid period ends and are then permanently deleted, apart from routine backup cycles and billing records kept for tax purposes. Contact us or your training organisation for a record-specific retention or deletion request.
12. Access, correction and privacy requests
You can update available profile details and use the provided project export and deletion controls. For other requests, contact hello@aisi.au and describe the information and outcome you seek; we may verify your identity to protect your privacy. For organisation-managed learning or assessment records, contact the organisation first; we can help direct the request where appropriate. We assess access, correction, deletion and other requests under the law that applies to the information and explain any lawful restriction. Rights under the Australian Privacy Act or overseas privacy laws apply where those laws cover the relevant processing; this policy does not claim every overseas law automatically applies to every user.
13. Cookies, local storage and external content
CourseForge uses cookies and browser storage for sign-in sessions, preferences and local editing or autosave information. Blocking or clearing them can sign you out or remove locally stored work. We have not added advertising cookies to the CourseForge application. Hosting services may collect website traffic and technical information for operation and security, and embedded media, checkout or external resources may use their own cookies or similar technologies. Their policies apply when you use those services. Do not assume an imported course is free of its author’s external tracking or links.
14. Complaints and updates
Email hello@aisi.au with a description of your privacy concern and the resolution you seek. We will review the complaint, seek any information needed and respond within a reasonable period, keeping you informed if further investigation is needed. If you are dissatisfied, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au where it has jurisdiction, or another applicable privacy regulator. You may request a copy of this policy by email. We publish changes on this page with a revised date and give notice of material changes where appropriate.