Privacy as architecture, not policy.
Why no learner work is stored, and what that means for your RTO.
Most privacy pages describe what a company promises not to do with your data. Ours describes what the software doesn’t keep, because it was built without a store of learner work.
Student work is some of the most personal material an RTO holds. The safest place for it is where it already was. While it is being marked, it is held in the assessor’s browser and never stored by Apollo. De-identified text, redacted page images and the unit’s marking materials go to Anthropic, outside Australia.
No learner work stored, by construction
Apollo has no submissions database. Its service passes the de-identified work to the AI and back and keeps none of it, so there is no copy of a student’s work sitting in our infrastructure. The batch lives in memory on the assessor’s machine while it is being marked and clears when they reload or sign out. Learner submissions aren’t stored on our systems, so a breach there has no submissions to expose.
Names come off first
Apollo removes names and IDs automatically on the trainer’s machine, and blacks them out of scanned pages. It can miss things, such as handwriting, so Apollo holds images back and waits for the assessor’s explicit OK rather than deciding for them. The model reads de-identified work. The person reads the student.
A promise can be broken. An architecture has to be rebuilt.
Honest about the boundary
There’s one overseas data flow, and we’d rather state it plainly than bury it. De-identified text, redacted page images and the unit’s marking materials go to the AI on Apollo’s managed Anthropic account, outside Australia. That is the fact your privacy officer needs for an Australian Privacy Principle 8 assessment, and it belongs on the front of the page, not in clause 14. Privacy philosophy, for us, is mostly the discipline of making the true sentence the prominent one. The full data-handling detail lives on Your data.
Editorial note: this article originally said processing ran on the RTO’s own account. It has been updated to the current model: a managed Anthropic account operated by Apollo, with no key held by the RTO.