Privacy Policy
Effective Date: 01/03/2025
1. About This Policy
Ludolio Pty Ltd ("Ludolio," "we," "our") operates a game-based learning platform that gives educational institutions access to curated commercial video games for use in teaching, learning, and research.
This Privacy Policy explains how we collect, use, store, share, and delete personal information, and sets out the rights available to you depending on where you are located.
Ludolio operates under a dual-jurisdiction framework.
By creating a Ludolio account, or subscribing to our waitlist, you agree to this Privacy Policy and our Terms of Use.
---
2. How Ludolio Works — The Institutional Model
Access to Ludolio is provided exclusively through educational institutions (schools, universities, libraries, museums, and other educational bodies) that have entered into an Institutional Agreement with Ludolio.
Ludolio does not provide services directly to members of the public.
2.1 University-Context Users
University students are adults who provide their own consent for data collection. When a university deploys Ludolio, students are presented with this Privacy Policy and our Terms of Use at account creation and are asked to provide their consent before accessing the platform.
Consent can be withdrawn at any time by contacting privacy@ludolio.com, though withdrawal will affect your ability to access the platform.
The university acts as the responsible institution for educational records and data governance, and Ludolio processes student data on the university's behalf for legitimate educational purposes as defined in the Institutional Agreement. Educators at your university may access your in-game data for students enrolled in their courses via the educator dashboard.
2.2 School-Context Users (Users Under 18)
When a school deploys Ludolio for student use, the school acts as the responsible party for student personal information. Ludolio handles student data only as directed by and on behalf of the school.
In practice this means:
Students under 18 access Ludolio exclusively through their school-issued email address or single sign-on. A student cannot create a Ludolio account outside of an active school relationship.
The school notifies students and families about Ludolio's data practices through its own communications. Ludolio provides a Parent/Guardian Letter Template for this purpose, and also displays a collection notice to users at account creation.
Parents or guardians who have questions about their child's data should contact the school in the first instance. The school liaises with Ludolio on their behalf. Where a parent objects to their child's use of the platform, Ludolio provides schools with an administrative control to restrict access for individual students.
Ludolio does not collect individual parental consent directly, the school's institutional consent covers its enrolled students.
---
3. What We Collect and Why
3.1 Account and Identity Data
Email address: your institutional email used to verify your identity and grant access to the platform via one-time password or SSO login.
Name: optionally provided at account creation; used so you appear under your own name in educator dashboards.
3.2 Enrolment and Institutional Data
Enrolment information: the courses or units of study you are enrolled in, used to curate your game library and grant access to required titles.
Institutional affiliation: the institution to which your account is linked, used to provision and scope your access.
3.3 In-Game Data
Game installation records: which games you have downloaded or installed.
Play time: how long you have played each game.
Achievements: in-game milestones or progress markers earned during play.
In-game data is used to track platform usage for billing and institutional reporting, and to support teaching and assessment by making this data available to educators via the educator dashboard.
3.4 Technical Data
IP address: collected to monitor bandwidth usage, prevent abuse, and associate activity with your account. Retained for security monitoring then anonymised.
Device ID: the unique identifier of the device on which you install the Ludolio client. Collected to monitor for repeat installs and improve service reliability. Retained for security monitoring then anonymised.
3.5 Support and Communications Data
Support interactions: information you provide when contacting us, used to respond to your requests and maintain service history.
Update and notification data: metadata used to deliver service updates and notifications.
Ludolio does not collect your home address, telephone number, date of birth, or payment information. Ludolio does not use your personal information for advertising, marketing profiling, or any non-educational commercial purpose. Ludolio does not use automated decision-making or profiling to make decisions about you.
---
4. Games and Data Collection
Ludolio's catalogue contains two categories of game, which differ in their data collection characteristics.
4.1 Standard Games
For standard games, every developer has warranted to Ludolio as a condition of listing that their game contains no independent data collection mechanisms: no feature that transmits, collects, or stores personally identifiable information about users to the developer's own servers or any third party.
For standard games, Ludolio is the sole data collector on the platform.
Standard games are the default. Unless a game is explicitly identified at the point of access as an approved data-collecting game, it is a standard game and this protection applies.
4.2 Approved Data-Collecting Games
Some games - typically multiplayer titles or games where telemetry is structurally necessary to function - require some data collection by the developer. These games are listed on the platform only where the developer has fully disclosed their data practices to Ludolio, obtained Ludolio's written approval, and warranted that their disclosures are complete and accurate. Developers must notify Ludolio before any update that materially changes their data practices, and accept that the game will be suspended from the catalogue pending review if they do not.
For university-context users: when you access an approved data-collecting game for the first time, you will be shown that developer's terms of service and privacy policy and asked to give your consent before the game launches. If the developer updates their policies, you will be asked to re-consent before continuing to play.
For school-context users under 18: approved data-collecting games are not available in the school catalogue by default. If a school wishes to make a data-collecting game available, the school must review the developer's data practices and provide written approval before the title is added to the school's catalogue. If a developer updates their data practices, Ludolio notifies the school, suspends the game, and requires re-confirmation of school-level consent before access is restored.
For approved data-collecting games, Ludolio's post-contract deletion commitment covers only data within Ludolio's control. Data held independently by a developer under their own approved practices is governed by that developer's privacy policy.
---
5. Who We Share Your Information With
5.1 Information Linked to Your Identity
Your educational institution: usage data shared in accordance with the Institutional Agreement to enable institutional reporting and administration.
Educators within your institution: authorised educators may access your in-game data for courses in which you are enrolled, via the educator dashboard.
Service providers: trusted vendors engaged to operate Ludolio (for example, hosting, email delivery, and update distribution). All service providers are bound by confidentiality agreements and data processing obligations.
Legal authorities: where required by law, court order, or to protect the rights, safety, or integrity of our services.
5.2 Anonymised or Aggregated Information
Game developers: aggregated, anonymised usage data only (for example, total play hours across all users) for standard games. No individually identifiable user data is shared with developers of standard games under any circumstances.
Service improvement: anonymised data used to understand usage trends and improve Ludolio's services.
Ludolio does not sell your personal information. Ludolio does not share your personal information for advertising or marketing purposes.
---
6. How Long We Keep Your Information
We keep your personal information only for as long as necessary to provide our services, meet our legal obligations, and resolve any disputes.
Account and enrolment data: kept while your account is active or until your institution requests deletion.
In-game data: kept for the duration of your course or your institution's agreement with Ludolio.
Support interactions: kept for service history purposes, then anonymised or deleted.
IP address and Device ID: kept for security monitoring purposes, then anonymised or deleted.
After your institution's agreement ends: personally identifiable data held by Ludolio is deleted or irreversibly anonymised within 90 days, except where retention is required by law. For approved data-collecting games, data held by the developer is governed by that developer's privacy policy.
To request deletion of your account and associated data, contact privacy@ludolio.com.
---
7. Cookies and Tracking
Ludolio uses cookies and similar technologies on our website and client application for the following purposes:
Authentication and session management: essential cookies that keep you logged in and maintain your session. These cannot be disabled without affecting your ability to use the platform.
Security: cookies used to detect and prevent fraudulent or abusive activity.
Service analytics: anonymised data about how the website and client are used, to help us improve the service. This data does not identify you individually.
Ludolio does not use cookies for advertising or cross-site tracking. You can manage cookies through your browser settings. Disabling authentication cookies will prevent you from logging in.
---
8. Security
Ludolio uses encryption for data in transit and at rest, access controls, and regular security reviews to protect your personal information. In the event of a data breach likely to result in serious harm, we will notify affected institutions and relevant regulatory authorities within 72 hours of becoming aware of the breach, and notify affected individuals in accordance with applicable law.
---
9. Australian Users
Ludolio's Australian operations are governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
You have the right to request access to the personal information Ludolio holds about you, and to request correction of information that is inaccurate, incomplete, or out of date.
Requests can be made to privacy@ludolio.com.
If you believe we have mishandled your personal information, you can lodge a complaint with us at privacy@ludolio.com.
If you are not satisfied with our response, you can escalate your complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au.
---
10. United States Users
10.1 FERPA
For US institutions, Ludolio operates as a school official with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). Student educational records are processed solely on behalf of and under the direction of your institution. Ludolio does not disclose student educational records to third parties except as permitted under FERPA. Students wishing to exercise FERPA rights - including the right to inspect or request amendment of educational records - should contact their institution's Registrar or privacy office in the first instance.
10.2 California
For California school institutions, Ludolio complies with the Student Online Personal Information Protection Act (SOPIPA) and California Education Code § 49073.1. Ludolio does not use student data for non-educational commercial purposes, does not sell student data, and supports schools' ability to access, correct, and delete student data.
California residents also have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, to access it, to correct it, and to request deletion. Note that personal information covered by FERPA is exempt from the CCPA. Ludolio does not sell personal information and does not share it for cross-context behavioural advertising.
To exercise your CCPA rights, contact privacy@ludolio.com.
10.3 Utah
Utah residents have the right to confirm whether Ludolio is processing their personal data, to access it, to request deletion of data they have provided, and to obtain a portable copy.
To exercise these rights, contact privacy@ludolio.com.
10.4 Massachusetts
Ludolio maintains a Written Information Security Program consistent with Massachusetts data security law. In the event of a breach involving Massachusetts residents' personal information, Ludolio will notify affected individuals and the Massachusetts Attorney General's Office as required by law.
10.5 Other US States
For schools in other US states, Ludolio operates consistently with applicable state pupil records laws and federal FERPA requirements. The Institutional Agreement for each school reflects the applicable legal framework for that institution's jurisdiction.
---
11. Your Rights
Depending on where you are located, you may have the right to access, correct, delete, or obtain a portable copy of your personal information.
University students may exercise these rights directly with Ludolio. School students should contact their school in the first instance.
To exercise any of these rights, contact: privacy@ludolio.com
We will respond within 30 days, or within any shorter period required by applicable law. We may ask you to verify your identity before processing your request. University students exercising FERPA rights should contact their institution in the first instance.
Ludolio does not use automated decision-making or profiling to make decisions about you.
---
12. Changes to This Policy
We may update this policy from time to time. Where changes are material, we will notify you by email or through the platform and ask you to re-accept the updated policy at next login. The current version is always available at www.ludolio.com/privacy.
---
14. Contact Us
For privacy questions, requests, or complaints:
Email: privacy@ludolio.com
Website: www.ludolio.com/privacy
