for business managers, IT and privacy officers
Built for the privacy review.
What your assessment needs to know: where student data lives, who can see it, what happens to recordings, and what Descant will never do with it.
In brief
- Student records stored in Sydney
- Speech-to-text in Australia; audio deleted once transcribed
- Each school’s data separated and closed by default
- Every access to a student record is logged
- Never used to train AI, never sold
Where data lives
| What | Where |
|---|---|
| Student records, case notes and reports | Stored in Australia (Sydney) |
| AI drafting of notes | Runs in Australia; nothing is kept by the AI service |
| Speech-to-text for spoken notes | Processed in Australia; the recording is deleted once it is transcribed |
| Enquiry and notification emails | Sent through an email provider in the United States; no student information |
| Website analytics (public pages only) | United States |
| Card payments, if a school pays by card | United States |
How access and records are controlled
Encrypted and closed by default
Data is encrypted in transit and at rest. Each school’s data is separated at the database level and access fails closed: if the system can’t confirm who you are and which school you belong to, it shows nothing.
Role-based access
Staff see what their role allows. A referral is open to the people working on it. Every access to a student record is logged.
De-identified downloads
Leaders see how the support service is running — referrals, waiting times, caseloads — on the Reports page. Downloaded reports leave out student names and hide small numbers.
No recordings kept
Spoken notes are turned into text and the audio is deleted. Only the reviewed written note is kept. Recordings can be transcribed from Arabic, Persian, Pashto and Urdu, as well as English. Notes are written in English for your school’s records.
People decide
AI is an optional paid add-on, off unless your school adds it; with AI off, nothing is sent to an AI model. When on, the AI drafts notes; it never triages, diagnoses or categorises a student. Every draft is reviewed by a person. A check-in is flagged for staff only by simple rules: the student asks to talk, or rates mood or safety 2 or lower. No AI is involved.
Never used to train AI, never sold
Your school’s data is not used to train AI models and is never sold.
Children’s privacy: the changes due in December 2026
The Children’s Online Privacy Code
Australia’s first code for children’s privacy online is due to be in place by 10 December 2026. Descant is about students, so we expect it to apply to us, and we are preparing for it now. We will say what changes once the final code is registered.
What is already true
Students don’t have Descant accounts or passwords. A student check-in asks one required question; the rest is optional. Nothing is used to advertise or market to students, no location is collected, and student data is never sold or used to train AI.
Automated decisions
From 10 December 2026, privacy policies must explain automated decisions that could significantly affect someone. In Descant, a student’s check-in can be flagged automatically for a staff member to review, for example when the student asks to talk to someone. A person always decides what happens next.
Sources: OAIC, Children’s Online Privacy Code · OAIC, transparency in automated decision-making
Privacy law and state requirements
We align with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Each state and sector assesses new platforms differently; our state-by-state guides explain what your school’s process is likely to ask for.
Privacy policy · School privacy compliance by state · Security pack (PDF)Questions assessors ask
Something we haven't answered? Ask us and a person from the team will reply.
Ask a questionWhere is student data stored?
Student records, case notes and reports are stored in Australia, in Sydney. Spoken notes are turned into text in Australia; the recording is then deleted and only the written note is kept. Student information is processed and stored only in Australia.
Is Descant ST4S assessed?
ST4S does not currently assess AI services that process health and wellbeing data, so Descant has not been assessed. This is a scope decision about the whole category, not an assessment outcome for Descant. Your school should complete its own risk assessment for AI use; we provide the privacy, security and data-handling evidence to support that review.
Who are your service providers?
We keep a register of the service providers who process data for us, with what each does and where. We provide it on request as part of a school’s assessment.
Does the Children’s Online Privacy Code apply to Descant?
The code is due to be in place by 10 December 2026. Descant is about students, so we expect it to apply, and we are preparing for it now. We will publish what changes once the final code is registered.
Can staff outside the support team see student notes?
No. Staff who add through the educator portal see only their own notes and when the support team has reviewed them, never the case. Access to a student’s record follows each person’s role in the support team.
What does the AI do with student information?
Nothing unless your school adds AI, an optional paid add-on that is off by default. When on, it turns an educator’s words into a written note for a person to check. It does not make decisions about students, and the data is not used to train AI models.
Need something for your assessment?
Ask for the service-provider register, our privacy and security evidence, or anything else your process needs.
- A made-up school like yours to explore for 14 days
- We check each request by hand and reply within two school days
- Made-up students only: no real student information needed
Prefer email? Write to [email protected].
(03) 4422 2284: answered any time by Descant's AI receptionist, which keeps a written record of the call. Please don't share student details. Our team replies within two school days.