Privacy policy
EnrolHero handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and keeps it in Australia apart from the overseas services listed below. EnrolHero is responsible for it.
Two roles
- For studios' families and students, EnrolHero holds information on the studio's behalf. The studio decides what is collected and why, under its own privacy notice; EnrolHero uses it only to run the studio's account. Questions about that information should go to the studio first.
- For studio owners, staff and visitors to enrolhero.com, EnrolHero decides how information is used, as set out below.
What we collect
| From | What | Why |
|---|---|---|
| Studio owners and staff | Name, email, phone, sign-in details, authenticator setup, what they do in the account | To provide and secure the account, support and billing |
| Studios (billing) | Business name, ABN, address, billing contacts, payments | Invoices and payment records |
| Families and students (on a studio's behalf) | Names, dates of birth, contact details, emergency contacts, enrolment answers, attendance, packages and payments, photo and video consent, level and progress | To run the studio's enrolments, classes and communications |
| Website visitors | Messages and demo requests sent through our forms; technical details such as IP address and browser, kept briefly for security | To answer enquiries and block abuse |
We don't sell personal information, use it for advertising, or use studios' family information for anything other than running that studio's account.
Children
Many students are under 18. Their information is entered by the studio or a parent or guardian, and is used only for their classes. Family pages are protected by a code and the student's date of birth.
Who we share it with
Only the services that run EnrolHero (below), professional advisers when needed, and authorities when the law requires it.
Where it's kept
The database is in Sydney, Australia (Supabase, on Amazon Web Services). Emails are sent through Resend (USA). Website traffic passes through Cloudflare's worldwide network, and the website is hosted by Render. A weekly encrypted backup is kept in Google Drive, which may store it outside Australia. We choose services with strong security and contracts that protect the information.
Security
Information is encrypted in transit and at rest, each studio's information is kept separate from every other studio's, staff sign-in can require an authenticator app, and EnrolHero staff can open a studio's account only in a support session the studio allows and can see in its history.
How long we keep it
While the studio's account is open. After it closes, for 30 days so the studio can ask for a copy, then it is deleted, apart from invoices and payment records we must keep for tax (5 years). Backups are replaced on a rolling cycle.
Your rights
You can ask for access to or correction of your information at support@enrolhero.com. If it is held for a studio, we'll pass your request to the studio or help it respond. We reply within 30 days.
Data breaches
If a breach is likely to cause serious harm, we notify the affected studios, the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Complaints
Contact us first at support@enrolhero.com. If you're not satisfied, you can contact the OAIC at oaic.gov.au.
Last updated: 6 November 2026.