Privacy notice
We collect as little as possible.
A plain-language summary. This reflects how the platform is being built; we will keep it current as features ship.
Effective date: 2 June 2026 · Last updated: 5 June 2026
⚠ Draft — not yet in force
This is a working draft, published for transparency while paid features are being built. It has not yet been reviewed by a legal professional against South African law, and is not the final agreement. It does not yet apply to any purchase. We will replace it with a reviewed version before any paid plan goes on sale.
What we collect
To place a learner in the right grade we ask for an age (or date of birth). For analytics we store only an age band (for example “Grade 4”), not a raw birth date. We keep account details (an email and a password, stored securely) so progress can follow a learner across devices.
What we show
Any numbers we publish about platform users are aggregates only — for example, “Grade 4 learners on this platform average X%”. We never expose an individual child’s data, and we keep platform figures clearly separate from national statistics (such as PIRLS and TIMSS).
Children’s data
We treat children’s information with extra care. Where feasible, accounts for under-18s are owned and managed by a parent or teacher. When in doubt, we collect less. We follow South Africa’s Protection of Personal Information Act (POPIA).
Website analytics
To understand how people find and use our public pages, we use privacy-friendly, cookieless analytics (Cloudflare Web Analytics). It sets no cookies, doesn’t track you across other websites, and collects no personal information — only aggregate counts like page views and referrers. We deliberately keep it off the signed-in learning app, where children work.
Payments & billing (optional paid plans)
The core curriculum is free. If you choose an optional Plus plan, payment is handled by PayFast, a South African payment provider, on their secure pages. Your card details are entered on PayFast and never reach our servers. We store only what we need to run your plan:
- which plan you’re on and whether it’s active;
- a payment reference / token from PayFast (not card numbers);
- the dates your plan starts, renews and ends.
PayFast processes your payment information as an independent provider under their own terms and privacy policy. We don’t sell or share your billing information for marketing.
Emails & the newsletter
We send account emails that keep your account working — a link to verify your address, a password reset when you ask for one, and a one-time welcome. These aren’t marketing, so they aren’t something you opt out of while you hold an account.
Separately, we offer an optional monthly newsletter — practical thinking tips and new lessons. It is strictly opt-in: you only receive it if you tick the box when you sign up, and we only offer it to adults (a parent, a teacher, or a learner aged 18 or older). We never add a child to a mailing list. Every newsletter carries an unsubscribe link, and you can withdraw consent at any time — under POPIA you have the right to object to direct marketing, and unsubscribing is immediate and free.
School accounts
Where a school buys a licence and enrols learners, the school is the responsible party for those learners’ personal information and we act as an operator processing it on the school’s instructions, under a written data-processing agreement. We hold only what’s needed to run classes, gating and class-level (aggregate) reports.
Your rights under POPIA
You may ask us what personal information we hold about you or your child, ask us to correct or delete it, or object to certain processing. Contact us at the address below. You also have the right to complain to South Africa’s Information Regulator.
Correcting, exporting and deleting a child’s profile
These rights are built into the dashboard — you don’t need to email us (though you always may). The account that owns a child’s profile (the parent or guardian, as the child’s competent person under POPIA) can, under Manage:
- Correct the name or grade at any time. Changing a grade keeps all progress and journal entries — the new grade simply has its own lesson sequence.
- Download a complete copy of everything we hold for the profile (grade band, progress, journal, ratings) as a file.
- Delete the profile. By default deletion comes with a 30-day safety window: the profile disappears everywhere immediately and can be restored from the dashboard for 30 days, after which it is erased permanently and automatically. You can also choose to erase immediately, with no recovery. We say this plainly because the window is protection against accidents — not a way of quietly keeping data.
What we keep, and why: if you had a paid plan, South African tax and consumer law requires us to retain transaction records (amounts, dates, payment references) for the legally required period — these records are kept unlinked from deleted profiles and contain no child data. A minimal audit log records that a correction or deletion happened (never names or journal content), as POPIA’s accountability rules expect. For school-enrolled learners, requests are handled with the school as the responsible party.
What we don’t do
We don’t sell personal data, and we don’t use dark patterns to push you into sharing more than you want to.
Questions
Reach us at hello@criticalthinkers.co.za. See also our Terms of Service and Refund & Cancellation policy.