Privacy Policy

Draft prepared for attorney review before the first paying customer. Bracketed items are still to be completed.

1. Responsible party

[Conrad's full legal name] trading as K53 Academy (sole proprietor), [Physical address — to complete], [Business telephone number — to complete]. Information Officer: [Conrad's full name] (owner; registered with the Information Regulator: pending), reachable at myk53academy@gmail.com.

2. What we collect

• Account: email address, password (stored hashed by our authentication provider), the name you give us.
• For learners under 18: the parent or guardian’s name and email, so we can confirm consent.
• Learning activity: which questions you answered and whether you were right, sessions, exam results, lesson progress, streaks. This is the product working; we cannot provide it without this data.
• Purchases: what you bought, when, the amount, and the payment reference from Paystack. We never receive your card number.
• Technical: IP address and browser details in server logs, kept briefly for security.

3. Why we process it

• To provide the service you paid for and show your progress (performance of a contract).
• To send account emails: confirmation, password reset, receipts. We do not send marketing email unless you opt in.
• To prevent fraud and abuse and to meet legal record-keeping duties (legitimate interest, legal obligation).

4. Children

Most learners are 16 or 17. POPIA treats anyone under 18 as a child. We ask at signup whether you are under 18 and, if so, for a parent or guardian’s details, and we require an adult to make the purchase. We do not knowingly process a child’s information without a competent person’s consent. A guardian may withdraw consent and have the account deleted at any time by emailing us.

5. Where your data is stored (cross-border transfer)

Our database and authentication are hosted by Supabase in the European Union (AWS, Ireland), and the website is served by Vercel. Neither provider has a South African region. This is a transfer of personal information outside South Africa under POPIA section 72. Both providers are bound by written agreements that require a level of protection substantially similar to POPIA, including the EU’s standard contractual clauses. Payment data is processed by Paystack (South Africa).

6. Who we share it with

• Supabase (database, authentication), Vercel (hosting), Paystack (payments). Each only receives what it needs to do its job.
• No selling of personal information, ever. No advertising networks.
• Authorities, if the law requires it.

7. How long we keep it

For as long as you have an account, then deleted when you delete it, except purchase records, which we keep for five years for tax and accounting law, with your name removed from the account link.

8. Your rights

• See and download your data: Account → Download my data.
• Delete your account and data: Account → Delete account. This is immediate and cannot be undone.
• Correct your details, object to processing, or ask questions: email us.
• Complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.

9. Security

Data is encrypted in transit and at rest. Correct answers are stored separately from the questions served to browsers. Access to personal information is limited to server code and the operator. If a breach affects you we will notify you and the Regulator as POPIA requires.

10. Cookies

We use only the cookies needed to keep you logged in. No tracking or advertising cookies.

11. Changes

We will post changes here with a new date and, for material changes, email account holders.