Lantern’s privacy, AI and security facts, in one place.

At a glance

Short answers to the questions reviewers ask first.

Data hosting

All Lantern data is stored in Australia (AWS Sydney, with a backup copy in Melbourne).

AI processing

AI drafting and checking use Google Cloud Vertex AI, which may process the data each request needs outside Australia, including the United States.

Voice

Voice is processed by Google Cloud in Sydney.

Training on user data

Lantern does not train AI models on user data, and our AI provider doesn't train on it either.

Breach history

No data breaches to date.

Who uses Lantern

For school staff. Students do not use Lantern.

GDPR, COPPA and FERPA

Lantern serves Australian schools and is built to the Privacy Act 1988 and the Australian Privacy Principles, and NSW health privacy principles. GDPR, COPPA and FERPA don't apply.

01 · Privacy and data protection

Privacy and data protection

All Lantern data is stored in Australia (AWS Sydney, with a backup copy in Melbourne). Lantern holds what teachers need to write reports: each student’s name and pronoun as the school enters them, the teacher’s notes, and the draft and final comments. It holds no contact details for students or parents.

Lantern serves Australian schools and is built to the Privacy Act 1988 and the Australian Privacy Principles, and NSW health privacy principles. GDPR, COPPA and FERPA don’t apply. Our privacy policy has the full detail.

International data transfers

Lantern’s database and files are stored in Australia. Some of our service providers handle information outside Australia:

• AI drafting and checking. Google Cloud Vertex AI receives the information each request needs, such as the teacher’s notes and the draft comment. It may process it outside Australia, including the United States. Google handles it under its Cloud data processing terms and doesn’t use it to train its models.
• Help centre chat. Questions are processed by Vertex AI outside Australia, including the United States, after names we recognise are replaced.
• Sign-in. Signing in with Google or Microsoft is processed in the United States.
• Payments. Stripe processes billing in the United States.
• Email. Our support and privacy inboxes are provided by Google Workspace, outside Australia, including the United States.

Voice is processed by Google Cloud in Sydney and is not sent overseas. Information may therefore be handled outside New South Wales and outside Australia. Ember stays responsible for it under the Australian Privacy Principles, and takes reasonable steps to make sure overseas providers handle it consistently with them.

Service providers and AI models

The same list, with how we tell schools about changes, is on our third-party service providers page.

Retention and deletion

• Deleted records are removed from Lantern straight away and permanently purged after 30 days.
• A purge removes every stored version of a file, not only the latest.
• Deleted data ages out of backups and the Melbourne copies within 30 days of the purge.
• When a school leaves, it can export its data first, and Ember sends the school a deletion certificate once the purge is complete.
• Teachers and school administrators can correct or remove student records in Lantern themselves. Access, correction and erasure requests to Ember are answered as the Privacy Act requires.

Breaches and incidents

No data breaches to date.

Ember follows a written data breach response plan built on the Notifiable Data Breaches scheme in the Privacy Act. If a breach may affect a school’s information:

• Ember contacts the school’s nominated contact promptly and shares what it knows, even before the facts are complete.
• Ember assesses whether it is an eligible data breach as quickly as practicable, within the 30 days the scheme allows.
• Ember notifies the Office of the Australian Information Commissioner and affected people where the law requires, after asking for the school’s views.

Schools can ask for the full plan.

02 · AI risk, ethics and bias

AI risk, ethics and bias

A teacher reviews, edits and accepts every comment. Lantern can’t export a comment the teacher hasn’t accepted, and it never publishes anything on its own.

Models

Google Gemini on Vertex AI: Gemini 3.1 Flash Lite drafts, and Gemini 3.8 Flash runs the rules check. The model behind each report is recorded with it.

Training

Lantern does not train AI models on user data, and our AI provider doesn’t train on it either.

Where it runs

Vertex AI may process the data each request needs outside Australia, including the United States. See international data transfers.

Record of AI use

An append-only record of drafting, editing, approval and export shows who did what to each report, and when.

Bias and fairness

Each draft is written from the teacher’s own notes about that student. Lantern’s rules check then reviews the comment against the school’s own writing rules, such as tone, balance and appropriate wording, and flags any it breaks. The check can miss things, which is why the teacher’s review and acceptance is the last step before a comment can be exported.

Australian Framework for Generative AI in Schools

How Lantern relates to each of the framework’s six principles.

1. Teaching and learning

Lantern supports teachers' reporting work, and students do not use it. Each comment starts from the teacher's own notes, and the teacher decides the final wording.

2. Human and social wellbeing

Students and parents have no accounts, and Lantern sends them no messages. The rules check reviews each comment against the school's writing rules before the teacher accepts it.

3. Transparency

This page, our privacy policy and our service provider list say which AI Lantern uses, where it runs and what data it receives. Each report keeps a record of the AI drafting steps, the teacher's edits and who accepted it.

4. Fairness

Every comment is checked against the school's own writing rules and reviewed by the teacher, who can change or reject it. Teachers can also write comments themselves and use Lantern only to check them.

5. Accountability

A teacher accepts every comment before it can be exported, and Lantern never publishes anything on its own. Ember is responsible for running Lantern and for how it handles personal information.

6. Privacy, security and safety

Data is stored in Australia, each school's data is kept separate in the database, data is not used to train AI models, and AI processing outside Australia is disclosed. The privacy and security sections of this page give the detail.

03 · Security

Security

Each school kept separate

Row-level security in the database is on for every table holding a school’s data, so each request can reach only its own school’s rows. Application code also limits every query to the user’s school.

Encryption

TLS 1.2 or higher in transit. At rest, the database is encrypted with AES-256 under a key Ember manages in AWS KMS, and files with AWS-managed keys.

Sign-in

Staff sign in with their school’s Google Workspace or Microsoft Entra account, so the school’s own multi-factor authentication applies, or with an email and password Ember sets up. A sign-in lasts at most 12 hours.

Roles

Owner, admin, reviewer and teacher. Teachers see only their own classes and reports; reviewers read the whole school’s reports without changing them.

Ember’s administrative access

Protected by multi-factor authentication and logged.

Releases

Lantern is released only from a version whose automated tests, school-isolation tests and secret scan have passed.

Deletion

Purged after 30 days, every stored version included. See retention and deletion.

Reporting a concern

Email security@embereducation.com.au. We acknowledge reports within 2 business days.

04 · Child protection

Child protection

For school staff. Students do not use Lantern.

• Students and parents have no accounts and never sign in. Lantern refuses student accounts.
• Lantern holds no contact details for students or parents and sends them no messages.
• Within a school, teachers see only their own classes and reports. When a reviewer reads another teacher’s report, it is logged.
• A staff member disabled in Google Workspace or Microsoft Entra loses Lantern access within 12 hours of their last sign-in. Removing someone from the school in Lantern ends their access to school data at their next request.
• Ember’s support staff see the help requests people send and the account details of the person asking: school, role, plan and setup progress. The support console doesn’t show student records or report content, and each time a support agent opens someone’s account details, it is recorded.
• Ember’s administrative access is protected by multi-factor authentication and logged.

More detail

Policies, help and documents

• Privacy Policy and Collection Notices
• Terms (the School Services Agreement)
• Security overview and third-party service providers
• Help centre, including where your data is stored and AI and your data
• Security and compliance documentation: available to schools on request from privacy@embereducation.com.au