MathsConnected is a South African maths learning site for Grades 1–7. This explains what we collect, why, and what we refuse to collect. It is written to be read by a parent, not a lawyer.

The short version

• We store a child's first name or nickname, their grade, and an animal avatar. Nothing else.
• Children never give us an email address, phone number, date of birth, surname or photo.
• We never advertise to children and never sell anyone's information.
• Card details never reach us — our payment provider handles those.

What we collect about a child

A display name (first name or nickname), a grade, an avatar, and their progress: which levels they finished, their scores, and when they last played. School learners also choose a username and password so they can log in on a shared computer. The username is theirs to invent and need not be their real name.

What we collect about adults

Parents, teachers and school admins give a name, an email address and a password. Schools also give the school's name. Passwords are stored hashed — scrambled one way, so nobody, including us, can read them back.

Consent (POPIA sections 34 and 35)

South African law prohibits processing a child's personal information without the consent of a competent person — normally a parent or guardian.

• Families: the parent creates the account, confirms they are the parent or guardian, and consents. We record who consented, when, and which version of this policy applied.
• Schools: the school confirms it has obtained parental consent for its learners and provides the learner information. Schools should follow their own consent process with parents.

Consent can be withdrawn at any time by deleting the child's profile, which deletes their progress.

Where the information lives

Our database is hosted by Supabase on servers in the European Union. No South African region is available. This is a cross-border transfer under section 72 of POPIA, disclosed here, to a provider bound by contractual data-protection terms and subject to the GDPR.

Payments

Card payments are handled by Paystack, which is PCI DSS certified. Card numbers never touch our servers or our code. Schools are invoiced and pay by EFT.

Who can see a child's progress

• Their parent, if they play at home.
• The teacher whose class they belong to — and only that teacher's classes.
• The school's admin, for that school only.

These limits are enforced by the database itself, not merely hidden in the screens.

How long we keep it

For as long as the account is active. Delete a child and their profile and progress go with it. Close an account and we remove its data within 30 days, except records we must legally keep, such as invoices.

Your rights

You may ask what we hold, correct it, delete it, or complain to the Information Regulator (inforegulator.org.za). To exercise any of these, email the address below.

Contact

Information Officer: Louise Rautenbach
louise.rautenbach@cliftonprep.org.za

Before launch: register the Information Officer with the Information Regulator and publish a PAIA manual.