Your information, in plain language.

What this notice is

Stanly is a Grade 12 learning platform run by Stanton Hermanus (the Information Officer). This notice explains, in plain language, what personal information we collect, why we need it, how long we keep it and what you can ask us to do with it.

Our legal basis is the Protection of Personal Information Act 4 of 2013 (POPIA). This notice is not legal advice.

What we collect

Account: your email address, display name and password (stored only as a secure hash). If you sign in with Google, your email, name and Google account ID.

Learning: your answers, attempts, hint use, marks, XP and mastery evidence — this is the record of your learning journey, and it exists to help you learn, not to sell anything.

Optional: your school (from the national school list) as a profile preference, and the subjects you choose.

Guest sessions: if you practise without an account, we store a random session token (hashed), your answers and progress. This is not linked to a name or email unless you later create an account and claim the session.

Why we use it

To deliver the learning service: your account, your learning records, your progress and your mastery evidence.

To let your teacher see the work of learners in their own class — teachers never see learners from other classes or schools.

We do not sell your information, and we do not use it for advertising.

How long we keep it

Active account and learning records: while your account is active.

Guest sessions: 30 days, then deleted.

If you request deletion: your account is erased after a 14-day grace period (you can cancel during those 14 days). Erasure removes your email, name, sign-in records, answers, attempts, marks, XP and mastery evidence.

Security and audit events are kept for 24 months, with personal identifiers replaced by a non-reversible placeholder at account deletion.

Server logs rotate after 30 days and never contain passwords or tokens.

Who else sees it

Hosting provider (xneelo, South Africa) — runs the app and database.

Email provider (Resend, USA) — delivers password resets and guardian consent emails (the recipient address and the link only).

Google — if you use Google sign-in, your email, name and Google account ID.

An AI feedback service (z.ai) may receive only a stage number, a feedback type and an assisted flag — never your name, email, answers or any identifier.

If you are under 18

POPIA calls anyone under 18 a child, and processing a child's personal information needs the prior consent of a parent or guardian.

If your account is for a learner under 18, we ask for a guardian's email address at sign-up and send them a confirmation link. Your account is marked 'guardian consent pending' until they confirm. Guest practice (no account) stays available without it.

A guardian can withdraw consent at any time — the account is then deleted.

Your rights

Export: download all of your own data at any time from your account page.

Correct: ask us to fix inaccurate information via your account settings or support.

Delete: request deletion of your account at any time from your account page.

Withdraw: withdraw consent at any time — withdrawal is recorded and stops further processing.

Teachers see only learners in their own classes. Nobody else sees your learning record.

If something goes wrong

If you suspect a breach of your personal information, contact the Information Officer immediately. We notify the Information Regulator and affected users as soon as reasonably possible, as POPIA requires.

Contact

Information Officer: Stanton Hermanus — via the support option in the app.