← Back to TutorApp
Privacy Policy
Last updated: 14 August 2026 (Version 2026-08-14)
This Privacy Policy explains how personal information is collected, used, protected, and shared when you use the TutorApp platform. This notice is issued in compliance with Section 18 of South Africa's Protection of Personal Information Act, 2013 (POPIA) and the Promotion of Access to Information Act, 2000 (PAIA).
1. Responsible Party & Information Officer
TutorApp is owned and operated by Bokano Tech (Pty) Ltd (trading as TutorApp), a private company incorporated under the laws of the Republic of South Africa:
- Company Registration Number: 2026/649274/07
- Information Regulator Registration Number: 2026-064447 (Registered: 14 August 2026)
- Registered Jurisdiction: Western Cape, South Africa
In accordance with Section 55(1) of POPIA, our designated Information Officer is:
Any inquiries, requests to exercise your statutory data subject rights, or questions regarding this Privacy Policy should be directed to the Information Officer at the address above.
2. Personal Information We Collect
We collect personal information directly from users when registering, interacting with educators, or utilizing platform tools:
Tutors & Educators
- Identity & Contact Information: Full name, email address, telephone/WhatsApp number, and professional qualifications.
- Security Credentials: Cryptographic password hashes (salted bcrypt hashes — plain text passwords are never stored or accessible).
- Educational Material: Curriculum subjects, cohorts, quizzes, assignments, rubrics, lesson plans, and uploaded resource files.
- Billing & Banking Preferences: Rate card configurations, fee structures, and invoice generation preferences.
- Audit & Security Logs: Authentication timestamps, IP addresses, and failed sign-in attempts used for automated account protection.
Students & Learners
- Identity & Contact Information: Full name, email address, and date of birth.
- Parent/Guardian Information: Name, contact email address, and relationship type for minors requiring parental consent or progress reports.
- Academic Submissions & Evidence: Completed quiz answers, assignment attachments, homework submissions, and project files.
- Performance & Analytics Records: Calculated assessment scores, grade averages, mastery metrics, diagnostic skill breakdowns, and attendance.
- Platform Communications: Educational messages and session notes exchanged with enrolled tutors.
Parents & Guardians
- Contact & Relationship Details: Full name, email address, and linked student identifiers.
- Consent & Verification Records: Immutable audit records of Section 35 guardian consent authorizations, including timestamp, IP header details, and the active privacy policy version consented to.
- Billing & Invoicing Interactions: Payment confirmations, invoice receipts, and package purchase authorizations where direct billing is enabled by the tutor.
3. Purpose and Legal Basis for Processing
We process personal information under the lawful grounds established by POPIA Section 11, including contractual necessity, legitimate interest, and explicit consent:
- Service Delivery & Learning Management: Enabling tutors to administer courses, host interactive classes, distribute homework, grade assessments, and track student growth.
- Performance Analytics & Parent Consultation: Generating diagnostic insights and student consultation reports for students and authorized parents/guardians.
- Platform Security & Abuse Prevention: Verifying accounts, enforcing role-based permissions, isolating multi-tenant student data, and preventing unauthorized access.
- Statutory Compliance: Ensuring strict adherence to child protection mandates under POPIA Section 35 and financial record-keeping standards.
We do not sell, rent, or trade personal information to third parties, and we do not use personal information for targeted third-party advertising.
4. Third-Party Service Providers & Cross-Border Data Transfers
To deliver high-availability cloud infrastructure and advanced educational tooling, TutorApp engages trusted third-party cloud service providers (operators). In accordance with Chapter 9 of POPIA, please note that some operators process data on secure servers located outside South Africa (including the United States and European Union) under data protection safeguards, contractual data processing agreements, and international encryption standards:
| Processor / Infrastructure |
Location |
Service Purpose & Data Processed |
| Google Cloud (Gemini API) |
United States / Global |
Artificial Intelligence & Pedagogical Tools: Student work, quiz prompts, and rubric criteria are processed to generate quizzes, suggest marks for open-ended questions, draft lesson plans, and summarize progress. |
| OpenAI |
United States |
AI Fallback & Language Processing: Secondary AI provider processing structured prompts for educational content generation and automated feedback. |
| Amazon Web Services (AWS S3) |
United States / Global |
Encrypted File Storage: Secure storage of tutor resource libraries, student assignment attachments, and PDF document exports. |
| Brevo |
European Union |
Transactional Email: Transmission of authentication links, password resets, guardian consent requests, and session confirmation notifications. |
| LiveKit Cloud |
Global Edge |
Interactive Video & Audio: Low-latency real-time encrypted video streaming for live tutoring classrooms. |
| Sentry |
United States |
Error Monitoring & Diagnostics: Real-time crash diagnostics and performance tracing. Error events may include obfuscated user IDs to troubleshoot application defects. |
| Railway |
United States |
Cloud Hosting & PostgreSQL Database: Primary server hosting environment and encrypted relational database hosting platform data. |
5. Data Retention & Erasure Schedule
We retain personal information only for as long as necessary to fulfill the educational purposes for which it was gathered or as mandated by South African statutory obligations:
- Active Account Data: Maintained for the duration of the active tutor or student account.
- Academic & Assessment Records: Retained for the active duration of the student's enrollment plus a 12-month grace period after relationship completion to allow academic export and grade portfolio transfer.
- Financial, Billing & Invoicing Records: Retained for 5 years in compliance with Section 29 of the South African Tax Administration Act, 2011 and the Companies Act, 2008.
- Guardian Consent Records: Maintained as an immutable audit record for the duration of the minor's account lifecycle plus 3 years.
- Security & Access Logs: Automatically rotated and purged after 90 days.
6. Your Data Subject Rights
Under Sections 23, 24, and 25 of POPIA, you hold the following rights regarding your personal information:
- Right of Access: Request confirmation of whether we hold personal information about you and receive a copy of such records.
- Right to Rectification: Request correction or updating of inaccurate, irrelevant, out-of-date, or incomplete personal information.
- Right to Delete & Erasure: Ask us to delete your personal information or account data. Tutors may initiate account closure and delete personal data directly via Settings → Account & Profile. Note that where academic assessments belong to enrolled learners, historical student records are retained to protect the learner's own educational record.
- Right to Object & Withdraw Consent: Object to processing on reasonable grounds or withdraw previously granted consent.
- Right to Lodge a Complaint: You have the statutory right to lodge a complaint with the Information Regulator of South Africa:
7. Protection of Children's Personal Information (POPIA Section 35)
The protection of minor learners (children under the age of 18) is a foundational invariant of TutorApp. In compliance with Section 35 of POPIA:
- When a student indicates that they are under 18 years of age, their account requires verified authorization from a parent or legal guardian.
- Consent is collected through an affirmative, authenticated opt-in link delivered directly to the guardian's verified email address.
- Silence is never consent: TutorApp does not utilize automated sweeps, countdown timers, or implied consent for minor data processing. A minor's guardian status remains pending until affirmative consent is explicitly recorded.
- Consent events record an immutable audit stamp including the exact policy version consented to, preventing retrospective policy expansion without re-consent.
8. Information Security Measures
In accordance with Section 19 of POPIA, we employ appropriate, reasonable technical and organizational measures to protect personal information against loss, unauthorized access, destruction, or disclosure:
- All network communication is strictly encrypted in transit using Transport Layer Security (TLS 1.3/HTTPS).
- Authentication credentials use salted, work-factor tuned bcrypt hashing.
- Multi-tenant database queries enforce rigorous cohort-level authorization barriers to prevent cross-tenant data leakage.
- Restricted administrative access governed by strict role-based access control and principle of least privilege.
9. Amendments to this Privacy Policy
We may periodically update this Privacy Policy to reflect system enhancements, legislative amendments, or new operational processors. When material revisions occur, account holders will be notified, and the version number and date at the top of this document will be updated.
View Terms of Use →