Your privacy, plainly explained.

1. Who this policy covers

This Privacy Policy explains how GradesPal (“GradesPal”, “we”, “us”) collects, uses, discloses and protects personal information when you use gradespal.co.za and the GradesPal platform (together, the “Service”), whether as a learner, a parent or guardian, a tutor, a school administrator, or a visitor.

GradesPal is a South African business, and we process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). By using the Service you acknowledge that your information will be processed as described in this policy.

2. Information we collect

We collect information you give us directly, information created as you use the Service, and information from the third parties that help us run it.

Account and profile information

• Full name, email address, password (stored as a salted hash, never in plain text), phone number and grade level for learners.
• For tutors: a professional profile, subject expertise, a profile photo, and, where you apply for verification, supporting documents we use only to review your application.
• For school administrators: your name, role and the school workspace you manage.

Learning activity

• Practice papers and assessments you start, your answers, marks, time spent and progress across subjects and topics.
• Messages, notes and files (including photos and PDFs) exchanged between learners and tutors.
• Camera and screen recordings captured during proctored exam attempts, where that feature is enabled (see “Live classes, messaging and recordings” below).
• Live class attendance and, where a class is recorded, the recording itself.

Payment information

Subject and tutoring payments are processed by iKhokha, an independent South African payment service provider. GradesPal does not receive or store your full card number, expiry date or CVV; we receive a transaction reference, status and amount so we can activate what you paid for.

Technical information

IP address, browser and device type, and basic usage logs, collected automatically to keep the Service secure and working correctly.

3. How we use your information

• To create and administer your account, and to give you access to the subjects, papers and features you are entitled to.
• To mark and give feedback on practice papers and assessments, and to build your progress record and weak-topic recommendations.
• To connect learners with tutors, and to support messaging, live classes and subject delivery.
• To process payments and keep accurate records of what has been paid for.
• To send account, subject, payment and reminder notifications by email.
• To verify tutor applications and keep the tutor marketplace trustworthy.
• To detect and prevent fraud, abuse and academic dishonesty, including through exam recordings where enabled.
• To maintain, secure, troubleshoot and improve the Service.
• To comply with our legal obligations, including tax, consumer protection and record-keeping requirements.

4. Our legal basis for processing

We process personal information on one or more of the following grounds recognised under POPIA:

• Performance of a contract — to provide the account, subject or tutoring service you signed up for.
• Consent — for example, when you agree to a proctored exam recording, or opt in to a particular communication.
• Legitimate interest — to keep the Service secure, prevent abuse, and improve how it works, balanced against your rights.
• Legal obligation — where we must keep records or disclose information to comply with the law.

5. Children and parental consent

GradesPal is built for Grade 10–12 learners, many of whom are under 18. POPIA treats the personal information of children with special care, and processing it generally requires the consent of a parent or legal guardian (a “competent person”), or another lawful ground such as the processing being necessary to establish, exercise or defend a right, or being manifestly made public by the child with the competent person’s consent.

If you are a parent or guardian and believe your child created an account without your consent, contact us at info@gradespal.co.za and we will review and, where appropriate, restrict or remove the account and associated data.

School workspaces allow a school administrator to oversee learner accounts created under that school; where a school enrols learners, the school is responsible for obtaining any consent it needs from parents or guardians for that enrolment.

6. Payments and financial information

All card and payment data is captured and processed directly by iKhokha under its own privacy and security terms. GradesPal only holds the transaction reference, status, amount and the subject, subscription or product it relates to, which we use to activate access and keep accurate billing records.

We do not sell payment information, and we never ask you to send card details by email or message.

7. Live classes, messaging and recordings

Live classes run on Jitsi / 8x8 JaaS. Where a class or session is recorded, participants are shown that recording is active, and the recording is stored to support review, marking and dispute resolution.

Where an assessment uses camera and/or screen recording (proctoring), that recording is captured only for the duration of the attempt, is visible to you as it happens, and is used solely to verify the integrity of that assessment and to support marking or an appeal. It is not used for any other purpose and is not shared outside GradesPal except where the law requires it.

Messages and files exchanged between learners and tutors are stored so both sides can refer back to them, and so GradesPal can investigate a complaint if one is raised.

8. Who we share information with

We do not sell your personal information. We share it only where necessary to run the Service, with providers bound by contract to protect it and use it only for the purpose we specify:

Assigned tutors, and, for school-enrolled learners, the relevant school administrator, can see the learning activity and progress needed to support that learner. We may also disclose information where required by law, to protect the rights, property or safety of GradesPal, our users or the public, or in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

9. Where your information is stored

Your information is stored on Microsoft Azure infrastructure. We take reasonable steps to keep data within, or otherwise adequately protected when it leaves, South Africa, and we require our providers to apply appropriate technical and organisational safeguards wherever data is processed.

10. How long we keep your information

We keep personal information for as long as your account is active, and afterwards for as long as is reasonably necessary to meet the purpose it was collected for, including legal, accounting or dispute-resolution requirements. In general:

• Account and learning-activity records are kept for the life of the account plus a reasonable period after closure, so results and certificates remain verifiable.
• Exam recordings are kept for a limited period after the assessment, long enough to support marking, review and any appeal, and are then deleted.
• Payment records are kept for as long as required by tax and financial record-keeping law.

You can ask us to delete your account and associated personal information at any time, subject to information we are legally required to keep.

11. Keeping your information secure

We use industry-standard safeguards, including encrypted connections (HTTPS/TLS), hashed passwords, access controls limiting who inside GradesPal can view personal information, and private, access-restricted storage for recordings, message files and tutor documents.

No system is completely secure. If we become aware of a breach that is likely to put you at risk, we will notify the Information Regulator and affected users as required by POPIA.

12. Your rights under POPIA

Subject to POPIA, you have the right to:

• Ask us to confirm whether we hold personal information about you, and to access it.
• Ask us to correct or update inaccurate, incomplete or out-of-date information.
• Ask us to delete personal information we no longer have a lawful reason to keep.
• Object to processing based on legitimate interest, or withdraw consent you previously gave, at any time and without penalty (this does not affect processing that already happened lawfully before you withdrew consent).
• Lodge a complaint with GradesPal directly, or with South Africa’s Information Regulator, if you believe your information has been mishandled.

The Information Regulator (South Africa) can be contacted at inforegulator.org.za.

13. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences and keep the Service secure. We do not use these technologies for third-party advertising. Most browsers let you block or delete cookies; doing so may affect features that rely on staying signed in.

14. Changes to this policy

We may update this policy as the Service or the law changes. Material changes will be highlighted on this page, and the “Effective” date at the top will be updated. Continuing to use the Service after a change takes effect means you accept the updated policy.

15. Contact us and our Information Officer

For any question about this policy, or to exercise your POPIA rights, contact GradesPal’s Information Officer at info@gradespal.co.za. We aim to acknowledge privacy requests within 5 business days.