This Privacy Notice explains how MindMath SA ("MindMath SA", "we", "us"), the operator of MindMath SA, collects, uses, shares, and protects your personal information. We comply with the South African Protection of Personal Information Act, 2013 ("POPIA").
1. Who we are (Responsible Party)
MindMath SA is the Responsible Party (data controller) for personal information processed through MindMath SA. Contact: hello@mindmath.co.za.
2. Information we collect
- Account information — name, email, password (hashed), grade, subject, locale.
- Profile and learning data — display name, avatar, XP, streak, lesson progress, quiz attempts, mastery levels.
- AI Coach messages — text you send to the AI tutor and the AI's responses.
- Homework scans — images you upload to the Homework Scanner and the AI's responses.
- Parent/child links — invite codes connecting parent and learner accounts.
- Technical data — IP address, device type, browser, log timestamps, basic usage analytics.
We do not collect payment card details. Payment information is collected and processed directly by Paddle (see section 5).
3. How and why we use it (Legal basis)
- To provide the Service — account creation, lesson delivery, progress tracking, AI tutoring, parent dashboards (contract performance).
- To keep the Service secure — fraud and abuse prevention, rate-limiting, security monitoring (legitimate interest).
- To improve the Service — aggregate, de-identified analytics on feature usage (legitimate interest).
- To communicate — service notices, billing receipts, support replies (contract performance); marketing only with your consent.
- To comply with the law — tax, accounting, and lawful requests (legal obligation).
4. Children's information
MindMath SA is designed for learners in Grades 7–12, including children under 18. POPIA requires the consent of a parent or legal guardian to process the personal information of a child. By creating an account for a learner under 18, you confirm that you are the parent or legal guardian and consent to the processing described in this Notice, or that the learner has obtained such consent. Parents may request access, correction, or deletion of their child's data at any time.
5. Who we share information with
We share personal information only with the following categories of recipients, under written agreements that require them to protect your data:
- Hosting and infrastructure — our backend provider hosts the database, authentication, and file storage.
- AI processing — Lovable AI Gateway forwards messages and scans to the AI model (currently Google Gemini) solely to generate a response for you. Inputs are not used to train AI models.
- Merchant of Record — Paddle.com Market Limited acts as our Merchant of Record for sales, subscription management, payments, tax compliance, and invoicing. Paddle collects and processes your billing data under its own privacy notice.
- Professional advisers — accountants and legal advisers, where strictly necessary.
- Authorities — where required by South African law or court order.
We do not sell your personal information.
6. International transfers
Some of our service providers (hosting, AI processing, Paddle) operate servers outside South Africa. Where personal information is transferred internationally, we ensure appropriate safeguards are in place as required by POPIA, including processor agreements and reliance on jurisdictions with comparable data protection laws.
7. Retention
We keep your personal information for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, and dispute-resolution obligations. Homework scans and AI conversations may be deleted from your account at any time. On account closure, we delete or anonymise your personal data within 90 days, except where retention is required by law.
8. Security
We use appropriate technical and organisational measures to protect personal information, including encryption in transit (HTTPS/TLS), encrypted storage, hashed passwords, row-level access controls in our database, and least-privilege service credentials. No system is perfectly secure; please use a strong, unique password and notify us of any suspected breach.
9. Your rights under POPIA
You have the right to:
- Access the personal information we hold about you.
- Request correction or deletion of inaccurate or unnecessary data.
- Object to processing based on legitimate interests.
- Withdraw consent for marketing at any time.
- Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).
To exercise these rights, email hello@mindmath.co.za. We will respond within a reasonable period and at most 30 days.
10. Cookies
We use only essential cookies and local storage required for authentication and session management. We do not use third-party advertising or marketing cookies. If we introduce analytics or marketing cookies in future, we will request your consent first.
11. Changes to this Notice
We may update this Notice from time to time. Material changes will be notified by email or in-app notice. The "Last updated" date at the top reflects the latest version.
12. Contact
MindMath SA
Email: hello@mindmath.co.za