Privacy Policy

1. Information we process

• your name, email address and Google account identifier;
• account, authentication and security-session information;
• the date and time of your one-time confirmation that you are 18 or older (we do not collect your birth date or age);
• orders, purchased lessons and Paystack payment references;
• Google Drive identifiers used to grant and revoke access;
• lesson progress, quiz attempts, answers and results; and
• information you include when contacting us.

We do not store your card number. Paystack processes payment-card information on its own secure checkout service.

2. Why we use it

We use personal information to authenticate users, process and verify purchases, provide lesson access, record learning progress, prevent fraud, support users, comply with legal duties and protect TutorMe's systems and rights.

We process it where necessary to provide our service or perform a contract with you, meet a legal duty, pursue a legitimate interest permitted by POPIA, or with consent where consent is required.

3. Service providers and international processing

We use these service providers:

• Google, to confirm your identity and manage access to lesson material in Google Drive;
• Supabase, for authentication, account records, database services and security controls;
• Paystack, to securely process payments and return transaction references and payment status to TutorMe; and
• Netlify, to host and deliver the website and run its server-side functions.

Netlify's server-side functions are currently hosted in Ohio, United States. These international providers may also process or support information in the United States and other countries outside South Africa.

For these transfers, TutorMe relies on the providers' binding service and data-processing terms as contractual safeguards designed to provide protection comparable to POPIA, including confidentiality, security and onward-transfer controls. If an adequate safeguard or another ground allowed by section 72 of POPIA cannot be established, TutorMe will not make the transfer.

4. How long we keep information

We retain personal information only for its stated purpose or as required or permitted by law. Our principal periods are:

• checkout quotes expire after 15 minutes and are deleted seven days after expiry;
• Paystack redirect credentials and the checkout copy of your email are removed when checkout reaches a final status;
• incomplete and unsuccessful checkout records are removed after 30 days, while paid checkout-processing records are removed after 90 days;
• Google Drive identity and resource identifiers are de-identified 90 days after access has been successfully revoked;
• account information and lesson progress are kept while the account remains open, while quiz results are deleted after the relevant lesson access expires; and
• relevant payment, banking or accounting providers normally retain core transaction records for the period required by South African tax law, generally at least five years from the relevant return or tax period. They may be kept longer where an audit, dispute or other legal duty requires it.

When a retention period ends, we delete, destroy or de-identify the information unless continued retention is lawfully required.

5. Account deletion

You can delete your account from your profile. This immediately removes your TutorMe account, profile, lesson access, learning records, checkout data and payment history from Supabase. Any tracked Google Drive permission is stripped of your identity and queued for revocation. Paystack, banks or accounting providers may separately retain transaction records where law requires it.

6. Security

We use reasonable technical and organisational safeguards, including encrypted connections, access controls, restricted server credentials, database row-level controls, session security and retention limits. No online service can guarantee absolute security.

7. Your choices and rights

Subject to POPIA, you may ask whether we hold your information, request access or correction, ask us to delete information we are not required to keep, or object to certain processing. You may also complain to South Africa's Information Regulator.

8. Contact us

Send privacy questions or requests to statistics224tutor@gmail.com.