Privacy & POPIA Statement

School Tracker (Pty) Ltd is the responsible party for the personal information processed through the School Tracker application, under the Protection of Personal Information Act, No. 4 of 2013 (POPIA). This statement explains what we collect, why, and your rights.

What we collect

• About you (the parent): your name (or an alias) and your email address only - no other contact information.
• About your child (as you enter it): their name, alias or chosen identifier, their grade, subjects, school activities, and their school's name and address.
• Child profile access: a 4-digit PIN, stored only as a secure cryptographic hash - never in plain text.

The app has no facility to record a child's phone number, email address or any other contact detail or personal identifier, so we collect no child information beyond what is listed above. We keep the school's address only so that you can use it when you need it. We do not collect South African ID numbers, biometric data, financial information or location, and we do not verify the identity of the person who signs up - our agreement is with the person who represents that they are an adult and the child's parent.

Why we process it (lawful basis)

Processing of a child's information is made lawful by the explicit consent of a Competent Person - the parent or guardian - during account setup (POPIA Sections 34 and 35). Your weekly progress report is a contractual performance instrument (Section 11(1)(b)), not marketing.

Your information belongs to you

All information about your child under your account belongs to you, the parent. Only you may share it with a third party, if you choose to. Under no circumstances will School Tracker provide your information to any third party, and it is never sold.

We do not share information in the app with anyone - please do not ask us to. If you want to share the information, do so directly from your account.

Service providers, and where your data is stored

“Third party” above means anyone who might want your family’s information for their own purposes - we never sell or hand your information to such a party. To run the service, we do rely on a small number of established technology providers (called “operators” under POPIA) that process information strictly on our instructions and only to make School Tracker work. They may not use it for their own purposes and are bound by a data-processing agreement with us. We deliberately chose industry-recognised providers that hold independently-audited information-security certifications:

• Secure cloud database & sign-in - stores your account and your children’s information. Certified to SOC 2 Type II and HIPAA standards.
• Email delivery - sends your password-reset, sign-in confirmation, weekly-summary and report emails, which may include your child’s marks. Certified to SOC 2 Type II and GDPR-aligned.
• Website & app hosting - serves the app and this website. Certified to SOC 2 Type II and ISO 27001.

These certifications are maintained by our providers and audited annually by independent, accredited auditors. Some of these providers store or process information outside South Africa: our database is hosted in the European Union, and our email and hosting providers operate from the United States. POPIA (Section 72) permits this because these providers are bound by laws or agreements that give your information protection comparable to POPIA (such as the European Union’s GDPR). All information is transmitted over encrypted connections, and each provider may process it only to deliver the service to you.

Parents, guardians and disputes

In this statement, and throughout School Tracker, the word "parent" also includes a legal guardian.

We deal only with the account holder - the person who signed up - and we have no obligation to provide information to anyone else. If another person claims to be a parent or legal guardian of a child on an account, they must take that up directly with the account holder; we will not provide, discuss or change the information at their request.

We hold no information that would confirm whether a child whose school details are entered is in fact the child that any third party may claim as their own, and we do not verify family relationships or identities. For that reason, School Tracker will not become involved in disputes between parents or guardians, and will not release, change or withhold information at the request of anyone other than the account holder.

How we keep it safe

• Authentication secrets and child PINs are stored only as cryptographic hashes.
• Each family's data is isolated at the database level using Row Level Security, so no account can see another's records.
• Within your account, each linked child can see only their own information - one child cannot see another child's data.
• Data is transmitted over encrypted connections (TLS), with access on a least-privilege basis.

How long we keep it

Your plan ends on its contract date - 30 June or 31 December for a half-year, and 31 December for a full year. You can delete any and all of your child's information yourself, at any time. If you renew for another contract-period or calendar year, you keep whatever you choose to. If you do not renew, we keep anything you have not deleted for up to 30 days beyond your contract's end date - for example, until 30 January for a plan ending 31 December - and then delete all information relating to the un-renewed plan, without exception. Once you delete information, the app has no facility to retain or recover it. (On the month-to-month Tracker plan, information is deleted 45 days after a missed payment.) This meets POPIA's retention-limitation principle (Section 14).

Payments

Payment is taken only through the app, using a third-party Payment Processing Company. We never handle or store your card details; we receive only confirmation of payment from that company.

Direct marketing

We only send marketing or feature updates where you have explicitly opted in (for example, "notify me when this launches"). We do not send unsolicited direct marketing (POPIA Section 69).

Your rights and control

You are in control of your information. You can access, correct or delete it at any time from your account. Because you choose what to enter and we use it only to provide the service you signed up for, there is normally nothing to object to - and if you ever want us to stop processing, you can simply delete your information or close your account, and the processing ends.

You also keep your statutory right under POPIA to lodge a complaint with the Information Regulator of South Africa if you believe we have handled your information unlawfully. If that ever arises, please contact us first at support@schooltracker.co.za so we can put it right.

Contact and Information Officer

Information Officer: the Director, School Tracker (Pty) Ltd, contactable only at support@schooltracker.co.za. Our full records-access process is set out in our PAIA Manual.

Information Regulator (South Africa): inforegulator.org.za.