Privacy Policy

1. Who We Are

StudyShark is operated by CloudCafe (Pty) Ltd, a South African company. We are the "responsible party" under POPIA — meaning we decide how and why your personal information is processed.

Contact: hello@studyshark.cloudcafe.co.za

2. What Information We Collect

We only collect what we need to run the platform:

Account information

• Your name and email address
• Your grade (8–12) and selected CAPS/IEB subjects
• Password (stored as a one-way hash — we cannot see your actual password)
• If you sign in with Google: your Google profile name, email, and profile photo

Study and progress data

• Lessons completed, quiz scores, and time spent studying
• XP earned, level, streak count, and badges unlocked
• Spaced repetition review schedule
• Leaderboard ranking (only if you opt in)

Payment information

• Subscription status and billing history. We do not store your card details — all payment processing is handled by Paystack.

Technical information

• Session cookies used to keep you logged in (Auth.js)
• Basic usage analytics via AWS CloudWatch (page views, errors) — no third-party ad trackers
• Your device type and browser (for fixing bugs)

3. Why We Collect Your Information

We process your personal information for these specific purposes:

• To provide the service: Your account details let you log in and access your content.
• To personalise your learning: Your grade and subjects determine which lessons you see. Your quiz scores power our spaced repetition reminders.
• Gamification: XP, streaks, and leaderboards require us to track your study activity.
• To process payments: We share minimal billing information with Paystack to manage your subscription.
• To improve our content: Anonymised, aggregated performance data tells us which topics students find difficult so we can improve those lessons.
• To keep the platform safe: We log activity to detect abuse and protect all users.
• To communicate with you: Sending important notices like password resets, subscription changes, or platform updates.

4. Where and How We Store Your Data

Your data stays in South Africa. Our servers run on AWS infrastructure in the af-south-1 (Cape Town) region. This means your personal information is stored and processed within the Republic of South Africa, which is important for POPIA compliance.

• Database: Neon Postgres hosted on AWS af-south-1 — encrypted at rest and in transit (TLS).
• Sessions: Auth.js session tokens stored as secure, HTTP-only cookies.
• Secrets: Sensitive credentials (API keys, tokens) stored in AWS Secrets Manager.
• Backups: Automated daily backups, also stored in af-south-1.

5. Who We Share Your Information With

We do not sell your data. Ever. We only share the minimum necessary information with these trusted third parties:

• Paystack: Your email and subscription details are shared with Paystack to process payments and manage billing. Paystack is a South African payment processor. See their privacy policy at paystack.com/za/privacy.
• Google (optional): If you choose to sign in with Google, Google will share your name, email, and profile photo with us. We do not share anything back to Google beyond what is required for authentication.
• AWS: Our infrastructure provider. Data remains in the af-south-1 Cape Town region.

We do not share your data with advertisers, data brokers, or any other third parties.

6. Cookies and Tracking

We use cookies sparingly — only what is needed to run the platform:

• Session cookies (Auth.js): These keep you logged in. They are essential and cannot be disabled. They expire when you log out or after 30 days of inactivity.
• AWS CloudWatch: We use CloudWatch for basic server-side analytics (errors, performance). This does not use browser cookies or track you across other websites.

We do not use Google Analytics, Meta Pixel, or any advertising tracking cookies.

7. Children's Privacy

StudyShark is designed for high school students, many of whom are under 18. We take this seriously.

• Users under 18 should have a parent or guardian review and agree to these terms and this Privacy Policy on their behalf.
• We do not knowingly collect information from children under 13. If you believe your child under 13 has created an account, please contact us and we will delete the account promptly.
• We do not serve ads, and we do not share children's data with third parties beyond what is described in Section 5.
• Parents or guardians may request access to, correction of, or deletion of their child's data at any time (see Section 9).

8. How Long We Keep Your Data

• Active accounts: We keep your data for as long as your account is active.
• Deleted accounts: When you delete your account, we remove your personal data within 30 days. Anonymised, aggregated analytics data (with no link to you) may be retained for platform improvement.
• Payment records: Billing history is retained for 5 years as required by South African tax law.
• Inactive accounts: If your account has been inactive for 3 years, we will notify you and may delete the account if we receive no response.

9. Your Rights Under POPIA

The Protection of Personal Information Act gives you important rights over your personal data:

• Right to access: You can request a copy of the personal information we hold about you.
• Right to correction: You can ask us to fix inaccurate information. You can update most of your details directly in your account settings.
• Right to deletion: You can request that we delete your personal data. We will do so within 30 days, unless we are required by law to retain it.
• Right to object: You can object to the processing of your personal data in certain circumstances.
• Right to lodge a complaint: If you believe we have mishandled your data, you have the right to lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at hello@studyshark.cloudcafe.co.za. We will respond within 30 days.

10. How to Request Data Deletion

You can request deletion of your account and all associated personal data in two ways:

• Self-service: Go to Account Settings → Delete Account. This will immediately begin the deletion process.
• By email: Send a deletion request to hello@studyshark.cloudcafe.co.za with the subject line "Data Deletion Request" and include the email address associated with your account.

We will confirm deletion within 30 days. Some data (e.g. billing records) may be retained for legal compliance as noted in Section 8.

11. Information Officer

Under POPIA, we are required to have a designated Information Officer responsible for ensuring compliance with the Act.

Information Officer: CloudCafe (Pty) Ltd Information Officer

Contact: hello@studyshark.cloudcafe.co.za

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date and notify you by email if the changes are significant. We encourage you to review this page periodically.