Privacy Policy

1. About us

PathTo80 is an adaptive learning platform operated by Rorisang Pty Ltd (trading as PathTo80), a South African company.

Contact: hello@pathto80.app

2. What data we collect

We collect the following personal information:

• Parent or guardian email address (for login and account management)
• Student learning data: quiz answers, completion times, topics studied, and progress scores
• Device information: browser type, operating system, and IP address (for security and app functionality)
• Payment information: processed through PayFast, not stored on our servers

We do NOT collect or store student names, dates of birth, addresses, or phone numbers. Student profile data is identified by a unique ID only.

3. Why we collect data

We collect data for the following purposes only:

• Delivering the learning service: tracking student progress, personalising questions, storing quiz results
• Account management: sending login links, password resets, and subscription notifications
• Analytics: understanding app usage to improve teaching effectiveness (data is aggregated, not linked to individual students)
• Security: detecting fraud, preventing abuse, and protecting app integrity

We do NOT use student data for advertising, marketing, or any purpose unrelated to the service.

4. How we protect children's data

PathTo80 collects information about students under the age of 18. In compliance with the Protection of Personal Information Act (POPIA), Section 35:

• Student data is processed only with verifiable parental consent (a parent or guardian creates and manages the account)
• We collect and retain the minimum data necessary to deliver the service (data minimisation principle)
• Student data is never sold, shared with third parties, or used for any purpose beyond education delivery
• No student data is used to train artificial intelligence models or feed automated decision systems
• A parent can request deletion of their child's data at any time by emailing hello@pathto80.app

5. Data sharing and third parties

We do not share student data with third parties except in the following limited cases:

• Supabase (database hosting): your data is encrypted at rest and in transit on Supabase servers located in South Africa
• PayFast (payment processor): payment data is processed directly by PayFast and not stored on our platform
• Legal requirement: we may disclose data if required by South African law or court order

We do not share data with advertisers, analytics companies, or any other external parties.

6. Data retention and deletion

We retain data only as long as your subscription is active.

• Active subscription: data is kept in full for as long as you maintain an active account
• Account cancellation: upon cancellation, you have 30 days to download your progress reports. After 30 days, all student learning data is permanently deleted
• Parent email: we retain parent email for billing and legal purposes until you request deletion
• Deletion request: you can request immediate deletion of all data at any time by emailing hello@pathto80.app

7. Your rights under POPIA

Under the Protection of Personal Information Act, you have the right to:

• Access: request a copy of all personal information we hold about you or your child
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request deletion of your account and all associated data
• Objection: object to certain processing activities
• Data portability: request your child's progress data in a portable format (e.g., CSV)

To exercise any of these rights, email hello@pathto80.app with your request. We will respond within 20 business days as required by POPIA.

8. Security

We take data security seriously:

• All data in transit is encrypted using TLS/SSL (HTTPS)
• All data at rest is encrypted on Supabase using AES-256
• Database access is controlled using row-level security policies
• All servers are located in South Africa to comply with data residency requirements
• We conduct regular security audits and maintain logging to detect unauthorised access

9. AI and automated decision-making

PathTo80 does NOT use student data for any AI training, machine learning, or automated decision-making systems that affect the individual student (except the app's core spaced-repetition algorithm, which personalises questions based on performance and is not a decision system).

Your child's data will never be used to train large language models, recommendation systems, or any external AI service.

10. Cookies and tracking

We use minimal cookies:

• Authentication: session cookies to keep you logged in
• No third-party tracking cookies
• No analytics tracking cookies (we do not use Google Analytics or similar)
• No advertising cookies

You can delete session cookies at any time by logging out. Clearing your browser cookies will not affect your account.

11. International transfers

Your data is stored exclusively in South Africa. We do not transfer data outside South Africa except for legal or security reasons required by South African law.

12. Changes to this policy

We may update this policy from time to time. We will notify you by email if we make material changes that affect how we handle your data. Your continued use of PathTo80 after changes take effect means you accept the updated policy.

13. Contact us

If you have questions about this Privacy Policy or want to exercise your POPIA rights, contact us at:

hello@pathto80.app