Privacy Policy

Mzansi Academy Kids is a South African learning app for children aged 2 to 10, built and run independently from Pretoria, Gauteng. We are the "responsible party" for your information under the Protection of Personal Information Act, 2013 (POPIA).

Our Information Officer is Tebatso Mokgokolo, the founder. For anything in this policy, write to info@mzansiacademykids.app, or by post to PO Box 956, Swartbooistad, 0418, South Africa.

This policy covers the Mzansi Academy Kids app, this website, and the emails we send.

Almost everything comes directly from you, the parent or guardian, or from your family using the app. We collect:

• About you: your name and email address; your password, stored only as a one-way hash that cannot be turned back into the password; your Google account identifier if you sign in with Google; and a phone number only if you choose to include one in a message to us.
• About each child: the name you give their profile (a first name or nickname is enough), their date of birth (so the app can work out their grade and move it up each year), their home language, and their gender only if you choose to give it — it is used only so the app refers to your child correctly.
• Learning activity: which lessons were done, answers, scores, time spent, XP, streaks, review schedules, badges, weekly plans and reports. If the AI Teacher chat is switched on, the conversations.
• Devices: a push-notification token if you allow notifications. If your child signs in on their own tablet, the name and type of that device (for example "Lerato's tablet, Android").
• Payments: when you subscribe through Google Play, Google tells us which plan you bought, its status, renewal date and an order number. We never see or store your card or bank details.
• Calendar: only if you connect a calendar, and only the events the app itself creates.
• Support: what you write to us, and the email address we reply to.
• Website: if you join the waitlist or newsletter, your email address.

We do not collect your child's location, contacts, photos or voice. The camera is used only to scan a QR code on screen; the picture is not saved or sent anywhere. The app has no advertising SDKs and does not read any advertising identifier.

We never sell your information or your child's information — not to advertisers, not to data brokers, not to anyone.

We use this information to:

• run the lessons, work out your child's grade, and schedule reviews so learning sticks;
• adapt the app to your child — what to suggest next, when to review, and (if you switch it on) lesson difficulty;
• write your weekly report, progress report and the reminders you choose to receive;
• answer your support requests;
• keep accounts secure, find and fix crashes, and prevent misuse;
• take payment, and keep the records tax law requires.

A child's personal information is processed with the prior consent of a competent person — their parent or guardian (POPIA section 35). That is why only an adult can create an account, and why children never register or supply their own details. Creating the account and each child profile is that consent. You can withdraw it at any time by deleting a child's profile or the whole account.

Your own information is processed to provide the service you signed up for, to protect the service and its users, and where the law requires it.

You must give an email address and a password to have an account, and a child's name, date of birth and home language for the lessons to work. Without them we cannot provide the service. Everything else — gender, notifications, calendar, device linking, groups — is optional, and saying no to it costs no learning feature.

Only a parent or guardian can create an account, add a child, or approve a child's device. On their own device, a child's session can reach only their own lessons and progress — never billing, family settings or other children — and you can sign that device out at any time. Kids Mode on your own phone is a display setting and collects nothing extra.

Children cannot message other people in the app, and nothing a child does is public. If you join a learning group, the other members of that group can see your child's profile name, XP and recent activity; groups are private unless the person who created one chooses to list it.

There are no ads anywhere in the app.

Some lesson feedback, in-lesson tips, and the insights, suggestions and plans written for you are produced by AI language models. To write them, the AI provider receives your child's profile name, grade, gender if you gave it, home language, and a summary of recent activity and scores. If the AI Teacher chat is switched on, it also receives the messages your child types.

The AI provider never receives your email address, your child's date of birth, or anything that says where you live.

Our AI providers today are Groq and Hugging Face, both in the United States. They process this information only to produce the reply, under their API terms. If we change providers, we update this list first.

The AI chat for children is switched off at launch. Every AI suggestion made for you is listed in the app's AI coaching log, and you can report any AI-generated message from inside the app.

Running the service means some information passes through companies working on our behalf ("operators"), under contract and only for the job named:

• Railway — application hosting and database
• Resend — sending email
• Google Firebase — push notifications
• Sentry — crash reports, sent without your IP address
• Groq and Hugging Face — AI language models (section 6)
• Google — Google sign-in, Google Calendar if you connect it, and Google Play for payments
• Cloudflare — lesson images and audio, which contain no personal information

Other adults you add to your family can see your children's profiles and progress. We disclose information to a public body only where the law requires us to.

If you create a teacher link, the teacher you give it to can open that child's progress report — nothing else — until the link ends or you stop it. We never send anything to a teacher unless you ask us to.

Our servers and database are hosted by Railway in Singapore, and some operators (section 7) are in the United States. Your information is therefore processed outside South Africa.

POPIA (section 72) allows this where the recipient is subject to law, binding rules or an agreement that protects it to a standard substantially similar to POPIA. We rely on each operator's data-processing terms for that. If you have concerns about any transfer, contact us.

We keep your family's information for as long as your account is open. After that:

• When you delete your account, your information and your children's are removed from our live systems immediately. Encrypted backups cycle out within 30 days.
• If another guardian shares your family, your own account is removed and the children stay with them.
• Payment records are kept for as long as South African tax law requires (currently five years), with your name and email address removed.
• Short-lived records expire on their own: password reset links after 1 hour, email verification links after 24 hours, device pairing codes after 10 minutes, and records used to detect repeated requests after 7 days.
• Teacher links stop working after the period you chose (one, three or six months), or as soon as you stop them in the app.
• Crash reports and server logs are kept for a limited period set by the operator that holds them, and used only to diagnose problems.

Every connection to the app and website is encrypted (HTTPS). Passwords and sign-in tokens are stored only as hashes. Access to live information is limited to the people who run the service. A child's own device receives a restricted session, enforced on our servers.

If personal information is accessed or acquired by someone who should not have it, we will notify the Information Regulator and every affected person as soon as reasonably possible — what happened, what we did about it, and what you can do to protect yourself. We will not wait to be asked.

Under POPIA you may:

• ask whether we hold information about you or your child, and receive a copy of it — you can also download a full copy yourself in the app, under More → Integrations → Download all my data;
• correct anything inaccurate — most of it directly in the app, under Profile and each child's profile;
• delete your account and your children's information — in the app under Profile → Delete Account, or on our delete-account page without signing in;
• object to how your information is used, and withdraw consent you have given;
• complain to the Information Regulator.

For a copy, an objection, or anything else, email info@mzansiacademykids.app. We respond within 30 days.

Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191 · 010 023 5200 · enquiries@inforegulator.org.za

We send marketing email only if you asked for it, and every one has a way to stop. Reports and reminders about your child can be switched off in the app under Notifications. Security and account emails — a password change, a deletion confirmation — are always sent.

The app makes some decisions automatically: which lesson to suggest, when a word comes back for review, what goes in the weekly plan, and — only if you switch it on — lesson difficulty. None of these has a legal or financial effect on you or your child, and you can change them in Settings or ask us about them.

This website sets no advertising or analytics cookies. The only cookie it uses is a sign-in cookie for our own staff console.

If we change something significant, we will tell you in the app or by email before it takes effect, rather than quietly updating this page. For questions about this policy, contact info@mzansiacademykids.app — we respond within 2 working days.