Privacy Notice

This notice explains how SchoolTooDoo processes personal information under the Protection of Personal Information Act, 2013 (POPIA). It applies to parents/guardians, learners and adult learners using the platform.

• Account details (name, email, role) — to create and secure your account.
• Learner details (name, grade, date of birth, subjects, school if provided) — to run the learner's workspace and apply child/adult safeguards.
• Academic information (timetable, homework, assessments and marks, study plans, uploads of schoolwork) — to provide tutoring, tracking and progress reporting.
• Toodoo conversations and learning evidence (questions asked, answers, errors, hints, practice results) — to teach, to check understanding and to build the evidence record.
• Payment information — processed by PayFast; we store subscription status, references and dates, never your card details.
• Usage and technical data — to operate, secure and improve the service.

For learners under 18, a parent or guardian creates and controls the learner profile and consents to processing on the learner's behalf. Guardians can view, correct, export and request deletion of the learner's records, and can withdraw authorisation for linked guardians or professionals at any time — withdrawal stops future access.

We use personal information only to provide and improve SchoolTooDoo: tutoring, academic tracking, evidence-based progress views for authorised parents/guardians, notifications you have enabled, payment processing and legal compliance. We do not sell personal information, and we do not use learner data for advertising.

AI processing (Toodoo tutoring, document analysis, study planning) happens on secured server-side infrastructure using the minimum learner context needed for the task. AI access is scope-limited: a tutor session can read only that learner's own academic data.

We share personal information only with:

• service providers that run the platform (hosting, database, payment processing via PayFast, AI processing) under contractual confidentiality;
• people you authorise (linked guardians, or an academic support professional you explicitly assign) — only the information their role permits;
• regulators or courts where the law requires it.

We keep personal information only as long as needed for the purposes above or as the law requires. You may request account and data deletion from the dashboard. Deletion follows a controlled process: learning records for the affected profiles are removed, while records we must lawfully retain (such as payment and audit history) are kept for the required period and then removed.

Under POPIA you may request access to your personal information, ask for correction or deletion, object to certain processing, and withdraw consent where processing is based on consent. You also have the right to complain to the Information Regulator (South Africa).

Accounts are authenticated, learner data is isolated per family through row-level access controls, files are stored privately, payment webhooks are verified server-side, and significant actions (role grants, guardian changes, payments, consent records) are logged in an audit trail.