Privacy Policy

POPIA-Compliant Privacy Policy for the LevelUpJNR Platform, operated from Cape Town, South Africa. Contact: ajrvisions@gmail.com.

Effective Date: 13 July 2026

PRIVACY POLICY

1. Queries

Queries regarding this Privacy Policy or the processing of your personal information may be directed to: ajrvisions@gmail.com.

2. Definitions

In this Privacy Policy, unless the context indicates otherwise:

• "Personal Information" means information relating to an identifiable, living, natural person or juristic person as defined in POPIA.
• "Processing" means any operation performed on personal information, whether by automatic or manual means.
• "Child" means a natural person under the age of 18 years.
• "Child Profile" means a profile created within the Platform for a learner aged between 9 and 13 years.
• "Parent" means the parent or legal guardian who holds a Parent Account and has consented to the creation of a Child Profile.
• "Data Subject" means the person to whom personal information relates.
• "Information Regulator" means the Information Regulator established under POPIA.

3. What Personal Information We Collect

3.1 Parent Account Information

When a parent registers, we collect:

• Full name
• Email address
• Password (stored as a hashed value. We do not store plain-text passwords)
• Subscription tier and payment history (payment card details are processed by our payment gateway and are not stored on our servers)
• Device fingerprint (used solely to detect and prevent abuse of the Free Tier)
• IP address and browser information (collected automatically for security and technical purposes)

3.2 Child Profile Information

For each Child Profile created by a Parent, we collect:

• Child's first name (as entered by the parent; parents may use a nickname rather than a full legal name)
• Grade (4, 5, 6 or 7)
• Username chosen by the parent
• 6-digit PIN (stored as a hashed value)
• Subjects selected
• Avatar choice (no personal image; children select from pre-designed illustrated characters)

We do not collect the following information about children under any circumstances:

• Surname, ID number, date of birth or any biometric information
• Physical address, school name or school registration details
• Photographs, videos or audio recordings
• Email address, phone number or any direct contact details of the child
• Any social media profiles or external account information

3.3 Usage and Activity Data

We automatically collect the following information when the Platform is used:

• Quiz session data: questions attempted, answers selected, scores, time taken, date and time of sessions
• Progress data: streaks, badges earned, XP points, levels reached
• Subject completion progress per term
• Session duration and frequency

This data is linked to the Child Profile and is used to generate Learning Summaries and to power the engagement features of the Platform (streaks, badges, progress rings).

4. How and Why We Process Personal Information — Lawful Basis

POPIA requires us to have a lawful basis for processing personal information. We process personal information on the following grounds:

4.1 Performance of Contract

Processing your account information and subscription data is necessary to provide the Platform services you have contracted for, including:

• Creating and managing your Parent Account and Child Profiles
• Processing subscription payments and managing billing
• Providing access to quiz content and tracking progress
• Generating Learning Summaries

4.2 Legitimate Interests

We process certain data based on our legitimate interest in operating a secure, functional and improving Platform, including:

• Using device fingerprinting to prevent abuse of the Free Tier
• Using anonymised, aggregated usage data to improve Platform content and features
• Security monitoring to protect the Platform and its users

4.3 Parental Consent for Child Data

In terms of section 35 of POPIA, we may only process personal information of a child with the consent of a competent person (parent or legal guardian). By registering and creating Child Profiles, the parent provides informed consent for the processing of the limited child data described in this Policy.

Parents may withdraw this consent at any time by deleting Child Profiles or requesting account deletion. Withdrawal of consent will result in loss of access to the Platform.

4.4 Compliance with Legal Obligations

We may process personal information where required to comply with applicable South African law, including tax obligations and regulatory requirements.

5. How We Use Personal Information

We use personal information collected for the following purposes only:

• To register and manage your Parent Account and Child Profiles.
• To deliver quiz content personalised to your child's grade and subjects.
• To track and display your child's progress, streaks, badges and level progression.
• To generate Learning Summary reports and make them available in the Parent Dashboard.
• To process payments and manage subscriptions.
• To send essential service communications (account confirmation, payment receipts, subscription status updates).
• To send optional progress notification emails where the parent has opted in (e.g. streak risk alerts, weekly activity summaries). These can be disabled in account settings.
• To ensure the security and integrity of the Platform.
• To detect and prevent fraud, abuse of Free Tier limits, or violation of our Terms and Conditions.
• To improve the Platform through analysis of anonymised, aggregated usage patterns.

We do not use children's personal information for marketing purposes. We do not serve targeted advertising to children on the Platform.

6. Sharing of Personal Information

We do not sell, rent or trade your personal information or your child's personal information to any third party.

We may share personal information only in the following limited circumstances:

6.1 Service Providers (Operators)

We use carefully selected third-party service providers ("Operators" as defined in POPIA) to assist in operating the Platform. These include:

• Payment processing services to process subscription payments securely
• Email delivery services to send transactional and notification emails
• Cloud hosting and infrastructure providers to store and serve the Platform

All Operators are contractually required to process personal information only as instructed by us, to maintain appropriate security measures, and to comply with POPIA. We do not permit Operators to use personal information for their own purposes.

6.2 Legal Requirements

We may disclose personal information where required to do so by South African law, court order, or regulatory authority, including the Information Regulator. We will notify you of any such disclosure unless prohibited from doing so by law.

6.3 Business Transfers

In the event that A.J. Redlinghuis (AJRVisions) is acquired, merged with, or transfers its business to another entity, personal information may be transferred as part of that transaction, subject to the receiving entity agreeing to treat personal information in accordance with this Privacy Policy and applicable law. You will be notified of any such transfer via email prior to it taking place.

7. Cross-Border Transfers of Personal Information

Some of our service providers may be located outside the Republic of South Africa. Where personal information is transferred to a third country, we ensure that such transfer takes place only to countries that provide adequate protection for personal information, or we put in place appropriate contractual safeguards as required by section 72 of POPIA.

We will not transfer personal information of children outside South Africa without appropriate safeguards and compliance with POPIA.

8. Security of Personal Information

We take the security of personal information seriously and implement appropriate technical and organisational security measures to protect it against unauthorised access, loss, alteration or disclosure.

These measures include:

• All passwords and PINs are stored using industry-standard cryptographic hashing. We do not store plain-text passwords.
• Payment card information is processed by our payment gateway and is not stored on our servers.
• Communication between your device and the Platform is encrypted using HTTPS/TLS.
• Access to personal information within our organisation is restricted to personnel who require it to perform their functions.
• Regular security reviews of our Platform and infrastructure.

While we implement reasonable security measures, no transmission over the internet or electronic storage system is completely secure. You use the Platform at your own risk in this regard.

8.1 Security Compromise Notification

In the event of a security compromise that results in, or is reasonably likely to result in, harm to Data Subjects, we will notify the Information Regulator and affected Data Subjects as soon as reasonably possible, in accordance with section 22 of POPIA.

9. Retention of Personal Information

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

10. Your Rights as a Data Subject

POPIA grants you the following rights in respect of your personal information:

1. Right of Access: You have the right to request confirmation of whether we hold your personal information, and to access a copy of that information.
2. Right to Correction: You have the right to request that we correct inaccurate, incomplete or misleading personal information.
3. Right to Deletion: You have the right to request the deletion of your personal information where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
4. Right to Object: You have the right to object to the processing of your personal information for purposes of direct marketing. You may opt out of marketing communications at any time.
5. Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
6. Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Regulator if you believe your rights under POPIA have been infringed.

To exercise any of these rights, please submit a written request to ajrvisions@gmail.com. We will respond within 30 days as required by POPIA. We may request verification of your identity before processing any request.

Information Regulator Contact Details

• Website: www.inforegulator.org.za
• Email: inforeg@justice.gov.za
• Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

11. Special Protections for Children's Information

Section 35 of POPIA provides specific protections for personal information of children. We apply the following additional protections:

• We will not process personal information of a child without the verifiable consent of a parent or legal guardian.
• We collect only the minimum information about children necessary to provide the educational Platform service.
• We do not use children's personal information for any marketing, profiling or advertising purposes.
• We do not share children's personal information with any third parties except as described in section 6 of this Policy.
• We do not permit children to directly register on the Platform. All child access is managed through a verified Parent Account.
• Children cannot access, modify or delete their own profile data. All changes to Child Profiles must be made by the registered Parent Account holder.
• Children's data is deleted within 30 days of a Parent Account deletion request.

12. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies to provide core functionality and improve user experience. We use:

12.1 Essential Cookies

These are required for the Platform to function and cannot be disabled. They manage user sessions, authentication and security. No personal browsing data is shared with third parties through essential cookies.

12.2 Functional Cookies

These remember your preferences (such as sound settings and language) to personalise your experience. They do not track activity across external websites.

12.3 Analytics

We use anonymised, aggregated analytics to understand how the Platform is used and to improve it. This data does not identify individual users. We do not use third-party behavioural advertising trackers.

By continuing to use the Platform after being notified of our cookie usage (via our cookie notice on first visit), you consent to our use of cookies as described above. You may disable cookies in your browser settings, but this may affect Platform functionality.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. Where changes are material, we will notify you by email to your registered Parent Account address at least 30 days before the changes take effect.

The updated Privacy Policy will be posted on the Platform with the revised effective date. Your continued use of the Platform after the effective date of any changes constitutes acceptance of the updated Policy.

14. How to Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or the processing of your personal information, please contact us at ajrvisions@gmail.com.

We aim to respond to all privacy-related queries within 5 business days, and to all formal data subject access or deletion requests within 30 days as required by POPIA.

This Privacy Policy was last updated on 13 July 2026.