PLAYCONOMICS

LIONSHEART STUDIOS PTY LIMITED

PRIVACY POLICY

This Privacy Policy governs the use of the Product (as defined in our Terms and Conditions of Use) by a User referred to as User, you, your. The Product is provided by LionsHeart Studios Pty Limited (ACN: 169 410 459) referred to as Lionsheart, we, us, our.

In this policy, we explain our information handling practices, describe the way your information is collected and used by us, and provide other information to show how we comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (Act).

A copy of the Act is available here.

Due to changing customer expectations or laws, we may change our privacy policy from time to time.

When we refer to personal information, we mean information about an individual where that individual is reasonably identifiable.

Introduction

We operate the Site through which you are able to access the Product and to participate in the Site and the Game, either as a Student or as an Educator.

If you proceed to open an account, you consent to the collection and use of the information you provide in the manner we describe in this policy.

Permission

If you provide us with your personal information, you consent to us handling of that information in accordance with this policy.

If you are under the age of 15, you must obtain the consent of your parent or guardian before you provide any of your personal details to us.

If you are under the age of 18, you are not required to obtain consent from your parent or guardian. If you are unsure, however, whether you should provide us your personal information, or how we will handle that information, we recommend that you seek permission from your parent or guardian.

When do we collect information?

We will collect information from you when:

  • you set up an account on the Site (which you will do either as an Educator or as a Student);
  • you purchase the Product (which you will do as a Student);
  • you access and use the Product (which you will do either as an Educator or as a Student);
  • you contact us with a question or feedback about the Product; and
  • we request, and your Education Organisation or Educator agrees, to provide us with your course and any course-related data (including demographics and academic performance) at the conclusion of the Term in which you used the Product.

When you visit the Site, or log in to third-party sites from the Site, we will receive information that those pages have loaded in your web browser.

We use cookies and similar technologies, including mobile application identifiers, to identify your computer (and help us recognise you across different devices), facilitate access to the Site, facilitate Game sessions, and compile usage statistics.

On the Site we use cookies from Google Analytics. You can find their privacy policy here.

You can control cookies through your browser settings and other tools. Please be aware that, if you reject the cookie, you may not be able to use our web-based services.

What information do we collect?

We ask you to provide us with information about yourself when you set up an account on the Site and when you purchase the Product through the Site.

If you are an Educator, when you set up an account on the Site we collect your name, the name of your Education Organisation, and the contact details at that Education Organisation.

If you are a Student, when you set up an account on the Site we collect your name, the student identification number (if applicable), the name of your Education Organisation, and your contact details at that Education Organisation.

If you purchase the Product and/or engage with the Service, financial information (such as your credit/debit card information) may also be collected directly by our third-party payment processors. We do not store, process or transmit payment card details through our infrastructure.

While you are using the Product, we will collect Product usage data and also technical data on your computer specifications to optimise Product delivery.

Please note that we only ask for a student identification number when an Educator has instructed us to do so and we are satisfied that this is required to enable your Educator to determine your progression in relation to the Product.

At the conclusion of the course in which you participate and for which you use the Product, we may, with the permission of your Educator, collect data on your course experience and progression, including demographics and academic performance (i.e., marks or grades) for each of the assessment tasks (including exams).

In this case, we may link your course and course-related data with your Product data and, after the linked data have been de-identified, perform statistical analysis for academic research purposes (including publication) and so that we can continue to improve the Product. Your name or any other direct identifiers will not be included in the analysis or published.

How do we use information that we collect

We use the information that we collect about you to:

  • complete your purchase of the Product;
  • provide you with access to the Product;
  • allow you to engage with the Service;
  • provide support related to any Product aspects;
  • improve the user experience;
  • facilitate quick retrieval of relevant information;
  • improve and adapt the content we deliver to you;
  • provide course announcements;
  • alert you to updated information on the Product; and
  • investigate problems, resolve disputes, or enforce our Terms and Conditions of Use.

Please note that you might not be able to unsubscribe from course announcements, which contain important information about the course, as set by your Educator.

We also use de-identified information, collected from you, from other users of the Product, and from your Educator, for academic research purposes (including publication) and so that we can continue to improve the Product.

You will not be reasonably identifiable from any of this information but it is derived from your use of the Product. For example, we may tell a researcher that a particular number of individuals completed the Game, but we would not disclose any information where it may make you reasonably identifiable.

Automated decision making

We use automated decision making for certain activities within the Product, including to assess the short-answer questions submitted by you. Responses are assessed against strict marking criteria set by the Educator, with the system producing a mark and written feedback. This information is used to assist Educators in assessing your coursework and completion of the course.

For what purposes do we NOT use information?

We will not:

  • sell or trade your personal information, such as name, contact details (email or street address) to third parties; or
  • use your contact details (email or street address) to send you marketing materials.

Who do we disclose information we collect to?

If you are a Student, we will provide personal information to your Education Organisation and/or Educator, upon request, to enable them to administer your usage of the Product. For example, the Educator may require the information for the purpose of assessing Game progression or notifying Students about issues arising during the course.

If you have any further questions about your Educator’s use of personal information, the Educator should be contacted directly.

We will also make the information we collect from you available to third parties:

  • where it is reasonably necessary to complete your purchase of the Product;
  • where it is reasonably necessary to enable us to make the Product available to you;
  • where it is reasonably necessary for your usage of the Product;
  • for the purposes of product development, academic research, or statistical analysis.
  • when we reasonably believe it is required by law;
  • as reasonably necessary in order to protect the personal safety of users of the Product or the public; and
  • as necessary to assert our rights.

We engage trusted third-party service providers to support the hosting, operation and functionality of the Product.

Our primary hosting provider is Amazon Web Services Inc. (Amazon), which provides the infrastructure on which the Product operates. Amazon was selected having regard to its security, resilience and data protection safeguards. Further information about Amazon security is available here.

We also engage third-party service providers, including OpenAI, Segment and Google BigQuery, to support particular Product features and analytics. We limit the information made available to these providers to what is reasonably necessary for the relevant service and apply appropriate privacy, confidentiality and security safeguards to such processing.

How we protect and secure information

We take reasonable steps to protect the personal information we hold from loss, misuse, unauthorised access, disclosure, alteration, or destruction. The controls we apply are proportionate to the sensitivity of the information.

Access controls

Access to personal information is restricted to authorised personnel who require it to operate and support the Product and is granted on a least-privilege basis. Administrative access to the Product is restricted according to role, requires individually issued credentials, and a user's data is scoped to the courses in which they are enrolled. Our staff and contractors are required by contract and internal policies to maintain the confidentiality of your information.

Network security

Production infrastructure is hosted on cloud infrastructure provided by Amazon Web Services in the Sydney region of Australia. We use appropriate technical and organisational security measures to protect our systems and information from unauthorised access, use, alteration or disclosure.

Encryption

All data transmitted between users and our services is encrypted in transit using TLS (Transport Layer Security). Data held in our file storage is encrypted at rest. Passwords are never stored in recoverable form and are protected using industry-standard cryptographic hashing.

Retention

We retain personal information only for as long as it is needed for the purpose for which it was collected, or for as long as we are required or permitted to retain it under the APPs.

  • Account information is retained while the account remains active.
  • Student coursework, marks, feedback, and chat messages submitted through the Product are retained for the duration of the course and for a period after the course concludes in line with the relevant Education Organisation’s academic requirements and our own recordkeeping, after which the records are deleted or irreversibly de-identified, unless the Education Organisation has directed a longer retention period to meet its own academic record keeping obligations.
  • Backups are retained on a rolling basis and are then destroyed.

Where information is collected or used for academic research, it is retained and managed in accordance with the applicable ethics approval, research protocol and institutional research data requirements. Where appropriate, identifying information is removed from, or stored separately from, research data.

Where an Education Organisation or you make a valid request for deletion of personal information (and any required approval from the relevant Education Organisation has been obtained) we will action it within 30 days and confirm completion in writing, except where applicable legal, regulatory, academic, research or recordkeeping obligations require or permit us to retain particular information, in which case we will inform you of what information we are required or permitted to retain, and the basis for this retention.

Conducting higher education record keeping on behalf of the Educator

Your Education Organisation may have record keeping obligations and sometimes they will ask us to retain your personal information to fulfil those obligations.

Secure deletion and media handling

We do not use removable media to store or transfer personal information, and personal information is not transferred using physical media.

In limited circumstances, authorised personnel may generate report exports containing information from the Product for a specific administrative, analytical or academic research purpose, including to support and improve the design and delivery of the Product at participating Education Organisations. Access to these exports is restricted to authorised personnel, and only information reasonably necessary for the relevant purpose is included.

Where such exports are temporarily stored on authorised staff devices, those devices are protected by operating-system-level encryption and the exports are retained only for as long as required for the relevant purpose, after which they are securely deleted. Report exports do not include authentication credentials or payment information.

When cloud storage media is decommissioned, it is handled through the cloud provider's media sanitisation and destruction processes. Information deleted from our systems is removed from live storage and subsequently ages out of backups in accordance with the applicable backup retention cycle.

Data location

Personal information is stored and processed in Australia, primarily within the Amazon Web Services Inc (AWS) Sydney region, subject to the following limited exceptions.

Analytics information about how the Product is used is collected via Segment and stored in Google BigQuery which is hosted outside Australia.

In addition, certain Product features use third-party artificial intelligence services provided by OpenAI, which may process information submitted through those features outside Australia. This information may include answer text, chat messages, and game activity data and is associated with opaque, pseudonymous identifiers rather than your name or other direct identifiers, so that you are not reasonably identifiable.

Account credentials, names, IDs and other direct identifiers are not submitted to these services.

Data breaches

We have procedures in place for responding to suspected or actual data breaches.

For information about how we identify, manage and respond to data breaches, please see our Data Breach Response Plan.

Updating your information

You may access and update or correct your personal information whenever you choose to do so.

Your right to withdraw consent

You can withdraw your consent for our use of your personal information at any time by emailing playconomics@lionsheartstudios.com. Please note that if you withdraw your consent for our use of your personal information to make the Product available to you, we might be unable to continue maintaining it operational for your use.

How to Contact Us

You may want to contact us about the personal information we hold about you (including to update any information), ask a question about our Policy, or make a complaint related to a breach by us of the Act.

You may do so by:

  • Email: playconomics@lionsheartstudios.com
  • Mail: Playconomics @ School of Economics, UNSW Business School, UNSW Sydney Kensington 2052 NSW Australia
  • Telephone: +61 2 9385 7480

Complaints

If you have a complaint about our compliance with the Act and we have not resolved your complaint within 30 days after you first notified us of your complaint, you can refer your complaint to the Office of the Australian Information Commissioner by visiting their site: https://www.oaic.gov.au/.

Effective December 2014

Updated September 2026