Last Updated: October 2026
Sub-processors
| Sub-processor | Entity | Contact URL | Data types | Lawful basis | Country |
|---|---|---|---|---|---|
| Amazon Web Services: hosting, database, storage, and SES transactional email | Amazon Web Services Australia Pty Ltd | AWS Privacy and AWS Contact Us | All Platform data held on the service: account details (name, email, date of birth), assessment responses, free-text responses, AI-generated results, course recommendations, school association, IP addresses and audit logs. Also email addresses and message content for transactional email. | Primary purpose (APP 6.1): needed to provide the Platform. Contractual necessity for school and direct users. | Australia |
| OpenAI: AI-assisted summaries and recommendations | OpenAI OpCo, LLC | OpenAI Privacy Policy and privacy@openai.com | Selected assessment responses, personality, trait and career results, and free-text responses (which may contain identifying details). Name and email are not intentionally sent. API data may be kept up to 30 days for abuse monitoring, and CourseMatch has not opted in to model training. | Primary purpose (APP 6.1): generating the AI-assisted outputs users request. Disclosure to an overseas recipient is under APP 8. | United States |
| Stripe: payment processing for direct student purchases | Stripe Payments Australia Pty Ltd | Stripe Privacy Policy and privacy@stripe.com | Payment card and billing details, email address, transaction amount and reference. Card details go straight to Stripe and don't touch CourseMatch systems. | Contractual necessity: completing the purchase the user requested. | Australia |
Scroll horizontally to view the full table.