Draft template — last edited 2026-08-30. Not yet reviewed by a lawyer. Replace all bracketed placeholders before publishing.
1. Who we are
MathSprint ("we", "us", "our") is a classroom mathematics platform provided by [Company Legal Name], a company registered in South Africa ([registration number]), with its registered address at [physical address]. This policy explains what personal information we collect through the MathSprint service (the "Service"), why we collect it, and the rights you and your school have over it.
We process personal information as a data controller for school ("Customer") account and billing data, and generally as a data processor on behalf of a school for student data entered into the Service by that school's teachers — the school remains responsible for obtaining any consent required from parents/guardians under applicable law.
2. Information we collect
From schools and teachers (account holders): school name, teacher name and email address, login credentials (a one-time emailed code, and optionally a password — stored only as a salted cryptographic hash, never in plain text), and billing/subscription details processed via our payment provider, PayFast.
From students, entered by their teacher: first name (or a name chosen by the teacher/school), an access code (not a password chosen by the student), and gameplay/practice data — which questions were attempted, whether answers were correct, time taken, and progress through class assignments. We do not require or knowingly collect a student's email address, date of birth, or other directly identifying information beyond what a teacher chooses to enter.
Technical data: IP address, browser/device information, and usage logs, collected automatically for security, troubleshooting, and abuse prevention.
3. Children's data
The Service is designed to be used by students under the direction and account of their school and teacher, not signed up for directly by a child. Schools are responsible for ensuring they have the necessary legal basis (e.g. under South Africa's Protection of Personal Information Act, POPIA, and/or other applicable child-data-protection law such as COPPA where relevant) before entering any student's information into the Service, including any required parental/guardian consent.
4. How we use information
- To provide, operate, and maintain the Service (accounts, tournaments, practice tracking, class reports).
- To process subscription payments via PayFast and manage billing.
- To send operational emails (login codes, weekly class-progress digests to teachers who opt in).
- To monitor, secure, and improve the Service, including detecting abuse and fraud.
- To comply with legal obligations.
We do not sell personal information, and we do not use student data for advertising.
5. Who we share information with
We share information only where necessary to provide the Service:
- PayFast (payment processing) — receives billing/transaction information necessary to process a school's subscription payment. See PayFast's own privacy policy for how they handle that data.
- [Email/SMTP provider name] — used to deliver login codes and digest emails.
- [Hosting provider name] — hosts the Service's servers and database.
We do not share student or teacher data with any other third party except where required by law.
6. Data retention
We retain account and gameplay data for as long as a school's account remains active, plus [retention period, e.g. 90 days] after cancellation to allow for reactivation, after which it is deleted or anonymized, except where we are required to retain records for longer (e.g. financial/tax records related to payments).
7. Your rights
Subject to applicable law (including POPIA), a school, teacher, or the parent/guardian of a student may request access to, correction of, or deletion of personal information held about them by contacting [contact email]. A school's own SuperAdmin can directly manage and delete student and teacher records within the Service at any time.
8. Security
We use industry-standard measures to protect personal information, including encrypted connections (HTTPS), salted password/access-code hashing, and per-school data isolation. No system is completely secure, and we cannot guarantee absolute security.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to school administrators via email or an in-app notice.
10. Contact us
Questions about this policy or your data can be sent to [contact email].