Privacy Policy & POPIA Compliance

1. Introduction

LearnerLens ("we", "us", "our") provides a secure school results portal for South African schools, teachers, parents, and learners. We publish test results and teacher notes through separate role-based portals.

2. POPIA roles

Under POPIA, the school that uploads or controls learner data is the responsible party. It decides why and how learner personal information is processed.

LearnerLens acts as an operator (processor): we process personal information only on the school's documented instruction. A written operator agreement is required between each school and LearnerLens before production use, as contemplated in POPIA section 21.

For questions about a learner's records, contact your school's Information Officer first. For operator-related queries, contact privacy@leerderlens.app.

3. Who this notice applies to

• School administrators and teachers using the staff portal
• Parents and legal guardians using the parent portal
• Learners using the student portal
• School representatives managing subscription and billing

4. Personal information we process

Depending on your role, we may process the following categories of personal information:

• Learners: name, learner or external ID (which may include a school pupil number or ID number, as determined by the school), grade, class, test marks and percentages, teacher notes marked visible to parents, parent account linkages, hashed login PIN, school invite code, enrolment status, and optional consent timestamps
• Parents: name, email address, account credentials (managed via Firebase Authentication), privacy consent timestamp, and linked children
• Staff: name, email address, role, and class or grade scope assignments
• Schools: school name, school code, contact email, optional phone and address, subscription status, and Stripe billing identifiers
• Technical and security data: authentication session data, staff active-school preference cookie, audit logs (actor, action, resource, timestamp), and IP address used for rate limiting and abuse prevention

We do not sell personal information. We do not use third-party advertising or analytics cookies.

5. Why we process personal information

• Provide and operate the staff, parent, and student portals
• Display test results, teacher notes, and school analytics to authorised users
• Authenticate users and enforce role-based access controls
• Link parents to their children using school-issued invite codes
• Maintain audit logs for security and accountability
• Manage school subscriptions and billing
• Protect the platform against fraud and abuse (including reCAPTCHA on login)

6. Lawful basis for processing

We process learner personal information as an operator acting on the school's instruction. The school, as responsible party, must have an appropriate lawful basis for providing that instruction.

When a parent registers for an account, they must tick an explicit consent checkbox on the registration form after being given access to this Privacy Policy and the Terms of Service. That acceptance is stored on their account (including the policy version and timestamp). Consent covers processing of their own account data and, where applicable, processing related to linking to their children's records.

Processing of children's personal information relies on school authorisation and, where required, consent or authorisation from a parent or legal guardian (competent person) under POPIA.

7. Children's personal information

LearnerLens is used by schools to share results for learners under 18. Schools upload learner data on their own instruction and must obtain any parental consent required before doing so.

Parents may register for an account, accept this Privacy Policy, and link to a child using a school-issued invite code. Parents may request correction or deletion of their child's information through their school's Information Officer or by contacting privacy@leerderlens.app.

8. Sharing and sub-processors

We share personal information only as necessary to operate the service, with the following sub-processors:

• Google (Firebase / Google Cloud): authentication, database (Firestore), application hosting, App Check, and reCAPTCHA Enterprise — processing may occur in the European Union (Netherlands, europe-west4 region)
• Stripe: subscription billing for schools only. Parent accounts do not process card payments through LearnerLens in the current product.

Authorised staff at a school may access learner data within their school tenant. Linked parents may access their linked children's results. Learners may access their own results via the student portal.

9. Cross-border transfers (POPIA section 72)

Personal information is stored and processed on Google Cloud infrastructure in the Netherlands (europe-west4). This constitutes a cross-border transfer outside South Africa.

By instructing LearnerLens to process learner data, schools acknowledge this transfer. We rely on appropriate contractual and technical safeguards with our sub-processors, consistent with POPIA requirements for cross-border processing.

10. Security

• Data is encrypted in transit (HTTPS/TLS) and at rest on Firebase infrastructure
• Access is restricted by role, school tenant, and parent–child linkage
• Learner PINs are stored as hashes, not plain text
• Authentication sessions use httpOnly cookies
• Test results are not publicly disclosed on the open internet
• Security-relevant actions are recorded in audit logs

11. Retention

We retain personal information for as long as the school's use of the service requires and in accordance with the school's instruction as responsible party.

School administrators may export or delete learner data through dashboard tools where authorised. Audit logs are retained for security and accountability, typically for up to three years unless the school instructs otherwise or law requires a different period.

When a school ends its relationship with LearnerLens, data handling will follow the written operator agreement and the school's lawful instructions.

12. Your rights under POPIA

Subject to POPIA, you may have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of personal information, subject to lawful retention requirements
• Object to processing in certain circumstances
• Lodge a complaint with the Information Regulator (South Africa)

For learner records, contact your school's Information Officer in the first instance. For operator queries, email privacy@leerderlens.app.

Information Regulator: inforegulator.org.za

13. Cookies

LearnerLens uses essential cookies only:

• __session — authentication session (httpOnly, up to 5 days)
• ll_active_school — remembers the active school for staff with access to multiple schools

We do not use advertising cookies or third-party marketing trackers.

14. Changes and contact

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Questions about this notice or our processing as operator: privacy@leerderlens.app