Privacy Policy

The responsible party is [Company name], registration number [Registration number], of [Address] ("ClimbClever", "we", "us").

Our Information Officer is [Information Officer name], who can be reached at [Information Officer email]. Our registration with the Information Regulator is [Information Regulator registration reference]. Our PAIA manual is available at [PAIA manual link].

POPIA treats a child's personal information as special: it may only be processed with the prior consent of a competent person, such as a parent or legal guardian. Children cannot create a ClimbClever account. Only a parent or guardian can, and by adding a child to the family account you confirm that you are that child's parent or legal guardian (or otherwise a competent person) and that you consent to us processing the child's information as this policy describes.

You can withdraw this consent at any time by asking us to delete your child's information (see section 8). Withdrawing consent does not affect processing that took place before you withdrew it.

About you, the parent or guardian:

• Your email address and, if you give it, your name.
• Your password and parent PIN. We never see these in plain text: the password is held by our authentication provider and the PIN is stored only as a secure one-way hash.
• Your settings, such as which subjects each child sees.

About each child you add:

• A first name or nickname, grade and province. The school name is optional.
• A four-digit kid-mode PIN, stored only as a secure one-way hash.
• The Trailmate picture they choose, stored as a picture key. We never collect or store photos of children.
• Short notes you write for the tutor about how your child learns and what they enjoy, if you choose to add them.
• Learning activity: questions answered, answers given, sets, mastery, spaced reviews, exams, points, Trailmates earned and questions they flag as wrong.
• Tutor chats: every message your child sends to the AI tutor and every reply. You can read all of them in the parent dashboard.

About your device:

• Cookies that keep you signed in and remember whether this device is in kid mode or parent mode. These are strictly necessary for the app to work; we use no advertising or tracking cookies.
• Offline Quick packs your child downloads, stored only on that device.
• Basic technical logs kept by our hosting provider (such as IP address, browser type and the time of a request), used to keep the service secure and working.

• To run the family account, kid mode and the parent dashboard.
• To choose your child's next questions, mark answers, track mastery and schedule reviews.
• To let the AI tutor help your child with the skill in front of them, and to mark written sentences.
• To show you your child's progress, exams and every tutor chat, and to flag anything unsafe to you.
• To send you account emails, such as sign-up confirmation, password resets and parent unlock links.
• To keep the service secure, fix problems and improve the questions.

We process this information because you consent to it on your own and your child's behalf, and because it is needed to provide the service you signed up for. We do not use your information for direct marketing unless you opt in, and you can opt out at any time.

The tutor and sentence marking use AI models from Anthropic. Every AI request is made from our server, never from your child's device. Before a message leaves our server:

• Your child's name is not sent.
• In tutor chats, email addresses, phone numbers and passwords your child types are stripped out.
• In tutor chats, a separate safety check reads every message, and anything unsafe is refused and flagged to you.

What is sent is the question or skill being learned, your child's grade, their tutor messages or written answer, and any tutor notes you wrote. [Confirm Anthropic's current data retention period and that API inputs are not used to train its models under our agreement.]

We use a small number of service providers who process information on our behalf, under written agreements that require them to keep it secure and confidential:

• Supabase: our database, authentication and file storage. [Supabase project region]
• Vercel: hosts the website and runs our server code.
• Anthropic: the AI models behind the tutor and sentence marking, called only from our server and never sent your child's name.
• Resend: delivers account emails such as confirmations, password resets and unlock links.

We do not sell, rent or trade personal information, and we do not share it with advertisers.

Some of our providers store or process information outside South Africa, including in the United States [and the Supabase project region]. POPIA allows this where the recipient is bound by law, binding corporate rules or an agreement that gives the information a level of protection substantially similar to POPIA, or where the transfer is needed to provide the service you asked for. We rely on our providers' data processing agreements for this, and by using ClimbClever you consent to these transfers.

As the account holder, and on behalf of each child on your account, you have the right to:

• Ask what personal information we hold and receive a copy of it.
• Correct it. You can edit your children's profiles yourself in the parent dashboard.
• Ask us to delete it, for one child or for the whole family account.
• Object to processing, or withdraw your consent.
• Complain to the Information Regulator if you believe we have not handled your information properly.

To use any of these rights, email our Information Officer at [Information Officer email] from the email address on your account. We will respond within [Response period, e.g. 30 days]. Archiving a child in the app hides their profile but keeps their learning history; to delete it permanently, ask us.

The Information Regulator can be contacted through its website, inforegulator.org.za.

• While your account is open, we keep your family's information so your children's progress carries on from year to year.
• When you ask us to delete a child or close your account, we delete the information within [Deletion period, e.g. 30 days], except where the law requires us to keep something.
• Backups are overwritten on a rolling cycle of [Backup retention period].
• Technical logs are kept for [Log retention period].

• Each family's data is locked to that family at the database level, so one family can never see another's.
• PINs are stored only as secure one-way hashes, and never logged.
• Information travels over encrypted connections.
• Kid mode never shows another child's information or the parent settings.

If we become aware of a breach that affects your information, we will tell you and the Information Regulator as POPIA requires.

If we change this policy in a way that matters, we will email you before the change takes effect and update the date at the top of this page. Questions about it can go to [Information Officer email]. See also our Terms of Service.