Privacy Notice

Andissa is operated by ANDISSA (PTY) LTD, a South African private company, registration number 2026/828820/07. This operator is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). Contact leo@andissa.com for privacy requests and for our registered office details; our Information Officer can also be reached at that address. This notice explains how we handle personal information when you use our website, learning app or contact form.

You provide your email address and password when creating an account, and your first/display name, grade, subjects and optional school name during onboarding. We automatically record lesson opens and their times, lesson completions, XP and quiz attempt results, including correct answers and total questions. These records allow us to show progress, repeat attempts and participation. Legacy profile fields, such as a learning goal or profile image, may remain where previously supplied. We do not request a home address or identity document for ordinary learning access.

Email and a password are needed for account access. Your name, grade and subject selection are needed to complete the current personalised onboarding flow. School name is optional; leaving it blank does not prevent learning. Activity records arise when you open or finish lessons. Without the information needed for an account and personalised learning, those parts of the service cannot be provided. Browsing the public website does not require a student account. No law specifically requires you to register for Andissa.

When you contact us, we receive your name, email address and message. The form also contains an anti-spam field and uses recent submissions to limit repeated messages. Account sessions use browser storage. Hosting, authentication and error-monitoring services may process connection and diagnostic information, such as IP addresses, browser/device details, request times and errors, for security and reliability. Please do not submit sensitive medical, religious, biometric or other special personal information in a support message.

We use information to provide and secure accounts, tailor grade and subject access, deliver lessons, record progress and scores, support students, answer enquiries and investigate errors or misuse. For adults, the relevant grounds may include steps to enter or perform an agreement, consent where requested, legal obligations, and legitimate interests in proportionate security and service administration. These grounds are applied to the specific purpose; agreement to this notice is not blanket consent to unrelated processing. Children's information requires the additional protections below.

Many students are under 18. POPIA restricts processing a child's personal information unless an exception under section 35 applies. For ordinary child registration, Andissa must obtain prior, informed consent from a competent person, normally a parent or legal guardian authorised to act for the child. A child's own acceptance or a statement that a parent “allowed” use is not, on its own, proof of that consent. A school name or school referral does not itself authorise processing or establish guardianship. If you are a parent or guardian and have questions about your child's information, or if your child registered without your authorisation, contact us so the account and further processing can be reviewed promptly.

A competent person may contact leo@andissa.com to request access, correction, deletion or withdrawal of consent for a child's information. We must reasonably verify identity and authority before disclosure. If valid consent is withdrawn, processing that depends on it must stop; this may prevent continued personalised learning. Information may only be retained on another applicable lawful basis.

Authorised Andissa administrators can see student profiles and learning records, including grades, participation, quiz scores and attempts, for service administration and learning support. The current administrator role is not limited to one school. Supplying a school name does not automatically give that school access. Any future sharing with a teacher or school must have a lawful basis, an appropriate notice and access restrictions. We do not sell student personal information.

We use Lovable Cloud and its underlying hosting, authentication, database and storage services, plus email-delivery and error-monitoring providers. Support notices are sent to leo@andissa.com and handled in our Google Workspace mailbox; the sender receives an acknowledgement. Service providers must process information only as authorised and be subject to appropriate confidentiality, security and written operator obligations under POPIA. Google sign-in and payments are not currently offered. Older account identity or subscription records may remain from past use and are handled under our retention practices.

Our service providers may process information abroad. Where that happens, the transfers must meet the requirements of section 72 of POPIA, including adequate protection and onward-transfer safeguards where that route is relied on. Where section 57(1)(d) applies to transferring children's or special personal information to a country without adequate protection, prior authorisation from the Information Regulator is required; consent wording alone does not remove that requirement.

Account verification, password resets and enquiry acknowledgements relate to actions you take. If we ever run an optional promotional email programme, it will use a lawful section 69 basis, clear sender details and an easy opt-out; children's competent-person requirements would also apply. Essential browser storage supports sign-in and settings. No advertising tracker was identified in the reviewed app source, but this does not establish the practices of every deployed service. Lesson suggestions support learning, not official assessment. We do not intend to make legally significant decisions about admission, promotion or exclusion solely by automated processing; any such future use would need a separate section 71 review.

We retain personal information only for as long as necessary for a lawful purpose, taking section 14 of POPIA into account, and then securely delete, destroy or appropriately de-identify it. There is currently no self-service account-deletion button or verified automated expiry process. Request closure or deletion at leo@andissa.com. We will assess the request and explain any lawful retention, practical backup restrictions and the expected timeline rather than promise an unverified deletion deadline.

We use reasonable technical and organisational safeguards, including access controls and secure connections, and must regularly review risks and provider protections. No internet service can guarantee absolute security. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, Andissa will notify the Information Regulator and affected data subjects as soon as reasonably possible under section 22, subject to lawful exceptions or delays. Child-related notifications will appropriately involve the competent person.

Subject to applicable law, you may ask whether we hold your information, request access or a copy, seek correction, request deletion where authorised, object to qualifying processing, withdraw consent prospectively and object to direct marketing. Contact leo@andissa.com. We may request proportionate proof of identity or authority, but not excessive information. Access procedures and permitted fees, if any, follow POPIA and PAIA; prescribed forms may apply. Withdrawal does not invalidate earlier lawful processing. Our PAIA manual is available on request.

You may complain to the Information Regulator without first using our complaints process: https://inforegulator.org.za/ • POPIAComplaints@inforegulator.org.za. Check its website for the current complaint channels and forms. We will date changes to this notice and provide appropriate notice of material changes. A new purpose or consent-dependent activity may require a fresh notice and consent, not merely continued use.