Equals2 — How We Protect Your Information and Your Child's Information
This Privacy Policy explains how Equals2 ("we", "us", "our") collects, uses, stores, and protects personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Electronic Communications and Transactions Act 25 of 2002 ("ECT Act").
Because our Service is used by parents on behalf of their children, we take extra care to protect children's personal information as required under Sections 34 and 35 of POPIA.
This policy applies to:
| Data | Purpose | Legal Basis (POPIA) |
|---|---|---|
| Email address | Account creation, login, communication | Consent & contract |
| Full name | Account identification | Consent & contract |
| Password (hashed) | Account security | Consent & contract |
| Subscription plan & status | Service delivery, billing | Contract |
| Payment transaction records | Billing records (we do NOT store card details) | Contract & legal obligation |
| Data | Purpose | Legal Basis (POPIA) |
|---|---|---|
| Nickname (chosen by parent) | Display within the app | Parental consent (s35) |
| Avatar selection | Profile personalisation | Parental consent (s35) |
| Grade level (1–12) | Serving appropriate content | Parental consent (s35) & legitimate interest |
| Assessment responses | Diagnostic scoring, gap identification | Parental consent (s35) & contract |
| Practice test scores | Progress tracking | Parental consent (s35) & contract |
| Topic performance data | Personalised question generation | Parental consent (s35) & contract |
| Data | Purpose | Legal Basis |
|---|---|---|
| Free trial attempt count (localStorage) | Enforcing 3-attempt limit | Legitimate interest |
| Browser type, device type | Ensuring Service compatibility | Legitimate interest |
| IP address (server logs) | Security, fraud prevention | Legitimate interest |
We do not collect: children's real names (unless chosen as a nickname by the parent), ID numbers, physical addresses, phone numbers, photos, location data, or biometric data.
Under POPIA Sections 34 and 35, children's personal information may only be processed with the consent of a "competent person" (parent or legal guardian). Equals2 is designed so that:
We use personal information for the following purposes and no others:
We will never use personal information for purposes incompatible with those stated above without first obtaining your consent.
Equals2 may use artificial intelligence (via the Anthropic API) to generate personalised practice questions based on your child's performance data. When this occurs:
We share personal information with the following third parties, solely to operate the Service:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database hosting, authentication | All Account and Child Profile data | Cloud servers (see Section 7) |
| PayFast | Payment processing | Email, transaction amounts | South Africa |
| Anthropic | AI question generation | Grade, term, topic scores (anonymised) | United States |
Each provider processes data under their own privacy policies and in accordance with contractual obligations to protect your information. We do not share data with any other third parties.
Some of our service providers (Supabase, Anthropic) may process data on servers located outside of South Africa. In accordance with Section 72 of POPIA, we ensure that any cross-border transfer of personal information is subject to one or more of the following safeguards:
By using the Service, you acknowledge and consent to the transfer of data as described in this section. We minimise the data sent to offshore providers — particularly for AI features, where only anonymised performance data (no names or identifying details) is transmitted.
We retain personal information only for as long as necessary to fulfil the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Active Account data | For the duration of your subscription, plus 12 months after Account closure |
| Child Profile data | Same as parent Account. Deleted when Account is closed and retention period expires. |
| Payment records | 7 years (as required by South African tax law — Income Tax Act) |
| Free trial data (localStorage) | Until you clear your browser data |
| Server logs (IP, browser) | 90 days |
When the retention period expires, personal information is securely deleted or irreversibly anonymised.
We implement appropriate technical and organisational measures to protect personal information, including:
Despite our best efforts, no method of transmission over the internet is 100% secure. If you become aware of a security vulnerability, please report it immediately to privacy@equals2.co.za.
As a data subject, you have the following rights under POPIA. To exercise any of these rights, contact our Information Officer at privacy@equals2.co.za.
| Right | Description |
|---|---|
| Access | Request confirmation of whether we hold personal information about you or your child, and request a copy of that information. |
| Correction | Request that inaccurate or incomplete personal information be corrected or updated. |
| Deletion | Request that personal information be deleted where it is no longer necessary for the purpose it was collected, subject to legal retention requirements. |
| Object to processing | Object to the processing of your personal information on reasonable grounds. |
| Withdraw consent | Withdraw your consent to processing at any time. This may affect our ability to provide the Service. |
| Complain | Lodge a complaint with the Information Regulator if you believe your rights have been violated. |
As a parent or legal guardian, you may exercise these rights on behalf of your child.
We will respond to any rights request within 30 days. We may request verification of your identity before processing your request.
In the event of a security breach that compromises personal information, we will:
Equals2 uses local storage (not traditional cookies) to track free diagnostic attempt counts. This data is stored only on your device and is not transmitted to our servers. No third-party tracking cookies are used. For more details, see our Cookie Notice.
We may send you service-related communications (subscription confirmations, diagnostic reminders, important updates). These are not marketing communications and are necessary for the operation of your Account.
We will only send promotional or marketing communications with your explicit opt-in consent. You may withdraw this consent at any time by clicking "unsubscribe" in any marketing email or by emailing support@equals2.co.za.
We will never send direct marketing communications to children.
We may update this Privacy Policy from time to time. If we make material changes — particularly to how we handle children's data — we will notify you by email at least 30 days before the changes take effect. The "Last Updated" date at the top of this policy indicates the most recent revision.
If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
P.O. Box 31533, Braamfontein, 2017
Email: complaints.IR@justice.gov.za
Tel: 010 023 5207
Website: https://inforegulator.org.za
For any questions about this Privacy Policy, to exercise your POPIA rights, or to raise a concern about how your data is handled:
Information Officer: [FULL NAME]
Email: privacy@equals2.co.za
General Support: support@equals2.co.za
Entity: [YOUR FULL LEGAL NAME / ENTITY]
Address: [YOUR PHYSICAL ADDRESS, SOUTH AFRICA]