Privacy Policy

1. Who we are

123tutors (Pty) Ltd (registration number 2017/300521/07), trading as 123tutors, operates the 123tutors website and platform. We are the responsible party for the personal information described in this policy.

Address: 22 Sloane Street, Bryanston, Sandton, 2192, South Africa. Privacy queries and requests: hello@123tutors.co.za (attention: Information Officer). Our Information Officer is the managing director of 123tutors (Pty) Ltd, as provided for in section 55 of POPIA.

2. Information we collect

• Account and contact details — name, email address, phone / WhatsApp number, and login credentials (passwords are stored only in hashed form by our authentication provider).
• Learning information — school or institution, grade or year of study, subjects and courses, tutoring preferences, lesson history, ratings and reviews.
• Tutor application information — qualifications, academic records, identity document, matric certificate, address, demographic information you choose to provide, and banking details for payouts.
• Bursary information — for sponsored students, the bursary or sponsor name and records shared by the bursary administrator, such as hours approved and funded.
• Payment information — wallet top-ups, lesson charges, invoices and payouts. Card details are captured directly by our payment provider, Paystack; we never see or store your full card number.
• Usage and technical information — device and browser information, pages visited, and security logs, used to keep the platform secure and working.
• Communications — messages sent through platform chat, and emails or WhatsApp messages you send us.

3. Learners under 18

Many of our students are children. Where a learner is under 18, we process their personal information with the consent of a parent or guardian (a competent person under POPIA), who normally creates or manages the account and requests the tutoring. Parents and guardians may exercise the rights in section 8 on the learner’s behalf.

4. Why we use it (and our lawful basis)

• To provide tutoring: matching students with suitable tutors, scheduling and logging lessons, and managing hours — to perform our contract with you.
• To take payments, pay tutors, issue invoices and keep financial records — contract and legal obligation.
• To vet tutors (identity, qualifications and suitability to work with learners) — legitimate interest in learner safety, and your consent when you apply.
• To report to a bursary on a sponsored student’s tutoring — contract with the bursary, and the student’s consent.
• To send service messages (confirmations, lesson reminders, receipts, security notices) — contract.
• To send marketing, only where you have agreed or are an existing customer, with an opt-out in every message — consent / POPIA section 69.
• To secure the platform, prevent fraud and misuse, and comply with the law — legitimate interest and legal obligation.

5. Who we share it with

We do not sell personal information. We share only what is needed:

• Between platform users — a matched student and tutor see each other’s name and the information needed to hold lessons. Tutors never see a student’s payment details, and students never see a tutor’s banking or identity documents.
• Bursary administrators — for sponsored students only: lesson hours, attendance and progress for students on their programme.
• Service providers (operators) who process information on our instructions under written agreements: Supabase (database, authentication and file storage), Vercel (website hosting), Postmark (email delivery), Paystack (payments), Twilio (SMS), Upstash (security rate limiting), and Anthropic (the AI study coach, which receives only the course material and questions you give it).
• Authorities — where the law requires it, or to protect the safety of a learner.

6. Transfers outside South Africa

Some of our service providers store or process information outside South Africa (for example in the European Union or the United States). We only use providers bound by data-protection laws or agreements that give protection substantially similar to POPIA, as section 72 requires.

7. How we protect it

• Encryption in transit (HTTPS) everywhere, and encryption at rest.
• Additional application-level encryption for special personal information such as identity numbers, banking details and race.
• Identity and qualification documents are kept in private storage and opened only through short-lived, access-checked links by the tutor concerned and authorised administrators.
• Role-based access controls, audit logging, and rate limiting to prevent abuse.

If a security compromise affects your information, we will notify you and the Information Regulator as POPIA requires.

8. Your rights

You may:

• ask whether we hold information about you and request a copy of it;
• ask us to correct or update inaccurate information (much of it you can edit yourself in your dashboard);
• ask us to delete your information — you can submit a deletion request from your account dashboard;
• object to processing based on legitimate interest, and opt out of marketing at any time;
• withdraw consent where we rely on it (this does not affect processing already done).

Email hello@123tutors.co.za. We respond within 30 days. When a deletion request is approved your account is deactivated immediately and your information is permanently erased after a 30-day grace period, during which you can cancel the request.

If you are unhappy with how we handled your information, you may complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za.

Requests for access to records under the Promotion of Access to Information Act, 2000 (PAIA) can be sent to the same address; our PAIA manual is available on request.

9. How long we keep it

We keep personal information only as long as needed for the purposes above or as the law requires. Tax invoices, payment records and financial ledgers are kept for five to seven years under the Income Tax Act and the Companies Act; if you ask us to delete your data, we keep those transactions but remove the details that identify you. Information that exists only to serve you — messages, lesson activity, learning progress, application material and verification documents — is deleted outright.

10. Cookies

We use essential cookies to keep you signed in and secure, and limited analytics to improve the platform. See our Cookie Policy.

11. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell you about material changes by email or on the platform. Questions: support@123tutors.co.za.