Privacy Policy

Citizenpro Australia is a private learning platform that helps people prepare for the Australian citizenship test. It is offered as a mobile and web app and through this website. It is not affiliated with, endorsed by, or acting on behalf of the Australian Government or the Department of Home Affairs.

The organisation responsible for your personal information is Ott & Stadler Group KLG (general partnership (Kollektivgesellschaft)), Rosgartenstrasse 26, 8280 Kreuzlingen, Switzerland, business identification number (UID) CHE-452.933.007. We handle your personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because we are based in Switzerland, we are also subject to the Swiss Federal Act on Data Protection (FADP).

Some obligations under the Privacy Act apply differently to small businesses with an annual turnover below AUD 3 million. Regardless of whether such an exemption applies to us, we choose to handle your personal information in line with the APPs as described in this policy.

Contact for all privacy questions and requests: citizenprosupport@gmail.com.

Data you submit on this website, such as an Early Access signup, is stored in Google Cloud Firestore in the region Sydney, Australia (Google Firebase project of this website). Data of the app is stored with Google Firebase as well, in the region Sydney, Australia.

Our operator is located in Switzerland and accesses this data from Switzerland. Some service providers process data outside Australia. The sections on service providers and on overseas disclosure explain who they are and what this means for you.

This website does not require an account and does not collect the app data listed further below. It collects the following personal information, only in the situations described:

Early Access signup: the email address you enter and the context described in the next section. Technical server data: your IP address, the time, the requested page and your browser type, which our hosting provider records in server logs to run and secure the website. Contact by email or through the contact form: whatever you send us, and for the form your first and last name, email address and message. Form messages reach us by email through our email delivery provider and are not stored on the website itself. We keep them in our mailbox only as long as needed to answer you and to follow up, and delete them on request.

The website does not use advertising cookies, does not show advertising, does not sell or rent any data and does not profile visitors. Analytics: the website can use Google Analytics 4 to understand which pages are visited and how the site is used. It only runs after you accept the Statistics category in the cookie banner; before that, no request is sent to Google Analytics. It collects pseudonymous usage data such as pages viewed, approximate location (country, region), device and browser type, and referring website. We do not use it for advertising, Google Signals is turned off, and the data is kept for 14 months. You can change your cookie choice at any time using the Cookie Settings link in the footer.

If you join Early Access on our website, we collect your email address, the time of your signup and limited technical context that helps us understand where signups come from and prevent abuse: your browser language, the page you came from, the page you signed up on and your browser type.

We use your email address only to reserve your free Premium access, to manage the Early Access list (including a counter and a check that an address is not entered twice), and to tell you when the app is available. We do not send you a confirmation email, we do not use your address for advertising, and we do not sell it.

Your signup is stored in Google Cloud Firestore in the region Sydney, Australia, and it is delivered to us by email through our email delivery provider Resend, whose servers are located in the United States. To limit repeated or automated signup attempts, we also process your IP address temporarily in the memory of our server. We do not store it.

We rely on your consent, which you give by submitting the form after reading the notice under it. You can withdraw it at any time. We keep Early Access email addresses until the launch notification has been sent and for 12 months afterwards, or until you ask us to delete yours, whichever comes first. To withdraw or delete your signup, write to us at the contact address.

The website stores a few things on your own device, and they do not leave it: your choice in the cookie banner and the progress of the checklists you tick off in the Resource Centre. We use this to make the website work the way you set it up.

The website sets no advertising or cross-site tracking cookies. You can clear this data at any time in your browser settings. Doing so resets your saved choices.

Account data: the email address and nickname you provide at registration, and, if you sign in with Google or Apple, the basic profile data they share for that login. Sign-in is handled by Firebase Authentication, so we never see or store your password in plain text.

Learning data: your quiz answers, results, spaced-repetition progress, favourites, weak-topic statistics and your planned test date if you enter one. Settings: your app language.

Purchase status: whether you have Premium access. Payments are handled exclusively by Apple or Google. Our provider RevenueCat receives the purchase status so that we can unlock Premium. We never receive or store your payment card details.

Feedback: the message and, if you choose, the star rating you send from the feedback page or the rating dialog. It reaches us by email through Resend, together with your nickname and email address if you are signed in.

Technical data: basic diagnostics that are needed to keep the app working.

Under APP 3 we only collect personal information that is reasonably necessary for our functions, and we collect it directly from you wherever practicable. We use your data only to: create and secure your account, save and restore your learning progress across devices, unlock the Premium access you purchased, manage the Early Access list and tell you about the launch, answer your messages and feedback, keep the app and website technically working and secure, and meet our legal obligations.

We do not use your data for advertising, we do not sell or rent your personal information, and we do not profile you for advertising or any other purpose. We do not collect sensitive information such as health data, and we do not ask for your visa, immigration or citizenship application details.

You can use the website without identifying yourself. The app needs an email address to save your progress across devices (APP 2, anonymity and pseudonymity: a nickname is enough, you do not have to give your real name).

We use service providers strictly to operate the app and website. Their access is limited to what they need to provide their service to us:

Google (Firebase): authentication, database (Cloud Firestore) and website hosting (Firebase Hosting on Google Cloud). Firestore is set up in the region Sydney, Australia.

Google (Google Analytics 4): website usage statistics, only after your consent in the cookie banner. Servers in the United States and other countries.

Resend: email delivery of Early Access signups, contact form messages and feedback messages to us. Servers in the United States.

RevenueCat Inc.: management of the purchase status for the app. Servers in the United States.

Apple and Google (App Store and Google Play): distribution of the app and processing of payments, under their own privacy policies. Your payment details never pass through our systems or RevenueCat.

Your personal information is disclosed outside Australia in three ways. First, our operator is located in Switzerland and accesses the data from there. Second, Resend and RevenueCat process data on servers in the United States, and so does Google Analytics if you accept statistics cookies. Third, Google may operate hosting and support infrastructure outside Australia, even where a database is located in Sydney.

Before we disclose personal information overseas, we take reasonable steps to ensure that the recipients handle it consistently with the APPs, relying on contracts and technical safeguards such as encryption in transit and access controls. Switzerland has its own data protection law, the FADP, which offers a high level of protection. You can ask us for more information about these disclosures at any time.

We send commercial electronic messages, such as the launch notification for Early Access, only to people who have consented to receive them, as required by the Spam Act 2003 (Cth). Every such message identifies us as the sender and contains a functional way to unsubscribe, which we honour within 5 working days.

Messages that are necessary for the service, such as a reply to your request or a notice about changes to this policy, are not marketing and can still reach you after you unsubscribe.

The practice recommendations of the app (for example, which questions to show you again) are generated automatically from your own answer history with a standard spaced-repetition method. This does not produce a decision with legal or similarly significant effects on you. It only affects which practice questions are suggested. No profiling for advertising or other purposes takes place.

Early Access email addresses: until the launch notification has been sent and for 12 months afterwards, or until you ask us to delete yours.

Account and learning data in the app: as long as your account is active. If your account has been inactive (no login) for more than 24 months, we may delete it after giving you 30 days notice by email.

Feedback and email conversations: as long as needed to handle them and to improve the app, and until you ask us to delete them.

Technical server logs: for a limited period set by our hosting provider, only for operation and security.

Google Analytics statistics: 14 months, then deleted automatically.

Data stored only on your device stays there until you clear it.

You can delete your app account and all associated data at any time in the app under Profile, Delete account. This is final. Step-by-step instructions are in the account deletion guide.

To withdraw or delete an Early Access signup, or to have any other data deleted, write to the contact address. We respond within 30 days. Purchase records held by Apple, Google or RevenueCat under their own policies are outside our control and follow their own retention rules.

Data is transmitted encrypted (HTTPS). Passwords are handled by Firebase Authentication and are never visible to us in plain text. Our providers apply industry-standard technical and organisational safeguards, and we limit internal access to personal information to the people who need it to operate the app and website. No system is completely secure, and we cannot guarantee absolute security.

If a data breach involving your personal information is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, where that scheme applies to us, and we will take steps to contain the breach.

You have the right to access the personal information we hold about you and to ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You can also withdraw your consent and ask us to delete your information, subject to legal retention requirements.

Where the Swiss FADP applies to you, you have comparable rights. For any request, write to the contact address. We respond within 30 days and do not charge you for making a request. We may need to verify your identity first.

If you believe we have not handled your personal information properly, please contact us first at the contact address. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, phone 1300 363 992. For matters under Swiss law, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

The app and website are not directed at children under 13, and we do not knowingly collect personal information from children under 13. Minors under 18 may use them only with the consent of a parent or guardian.

We may update this policy to reflect changes in our practices or in the law. The current version is always on this page. We will inform active users of material changes, and we will ask again for consent where the law requires it. The date at the top shows when it was last updated.