Privacy Policy

This policy explains how Mathly ("Mathly", "we", "us"), a South African maths education service operated by an individual trading as Mathly, collects, uses, and protects personal information under the Protection of Personal Information Act, 2013 ("POPIA"). Divan Bosman is Mathly's Information Officer under POPIA. You can reach us about privacy matters at hello@mathly.co.za.

Account information (from you, the parent/guardian): your name, email address, and password (handled securely by our authentication provider — we never see your password in plain text).

Child profile information (that you provide about your child): your child's first name, school grade, and preferred language.

Subscription and billing information: which plan each child is on, subscription status, payment amounts and dates, and a payment reference token from our payment processor. We do not collect or store your card number, expiry date, or CVV — these are entered directly with our payment processor, Paystack.

Live session bookings: the account holder's name and email, the child's name, the session booked, and its payment status.

Referral information: your referral code and, if someone signs up using it, a record linking the two accounts so we can apply referral credit.

AI assistant questions: the maths questions and study-guide text you send to the AI assistant, and its replies. We do not attach your name, email, or grade to this content when it is sent for processing. Where an AI assistant reply is separately checked for mathematical correctness, we may keep a text-only copy of that conversation (the questions, the answer, your child's grade, and language) to help us develop and train our own future AI tutoring model. This includes replies confirmed correct, and replies the check finds incorrect — which we keep flagged as incorrect, together with the checker's own written reasoning about the mistake, so the future model can learn to avoid it. This copy is never linked to your name, email, or account.

Test Analyzer submissions (Max plan): photos of a test paper and answer sheet you upload for AI-generated feedback, and your child's grade. By default, nothing about this changes: the photos are processed to generate your feedback and are deleted straight afterwards — they are not stored by us.

Optional photo retention for AI training: on the Test Analyzer form, you can tick an optional box — unticked by default — to let us keep your uploaded photos so we can use them to help train our own future AI tutoring model. Leaving the box unticked means your photos are deleted exactly as described above. If you tick it, the photos are stored privately, are never made public, and are never shared beyond the service providers already listed in Section 5 — they are used only for AI training. You can ask us to delete any retained photos at any time using the contact details in Section 11.

We may separately keep a text-only, structured summary of that submission (the text of each question as printed on the paper, transcribed by the AI; topics covered; marks awarded and marks available; the answer given; the correct answer; a category describing the type of error made, such as conceptual, arithmetic, or misreading the question; the language of the paper; general strengths/weaknesses; any optional note you typed about what feedback you wanted; and, where your child reviews the feedback, any confirmation or correction they give of the AI's marking) for the same AI-training purpose described above. This text-only summary is kept regardless of whether you opt in to photo retention, and never includes the photos themselves. This summary does not contain your name, email, or account ID. It does carry a pseudonymous learner reference — a one-way cryptographic code derived from your account — which lets us group a learner's own submissions together over time to see how they progress. This reference is pseudonymous, not anonymous: because it is derived from your account, we could in principle recompute it to relink these records back to your account, even though the record itself does not store your name, email, or account ID.

Prep pack purchases: which prep pack you bought from our Store, the price paid, and a payment reference token from Paystack (see Section 5). We do not store your card details.

Contact and support messages: anything you send us via our contact form, including your name, email, grade, and message.

Mathly is used by children, but accounts are created and controlled by a parent or guardian, who provides their child's name, grade, and language preference for the sole purpose of personalising that child's access to age-appropriate study content. We collect the minimum information needed to provide the service and do not knowingly use children's personal information for direct marketing. If you are a parent or guardian and want to review, correct, or remove your child's information, contact us using the details in Section 11.

• to create and run your account and your children's profiles,
• to show the correct study content, difficulty, and language for each child,
• to process subscription payments and live session bookings,
• to send you service emails — for example booking confirmations, payment receipts, session reminders, and account/billing notices,
• to respond to support requests and contact-form submissions,
• to track and apply referral credit,
• to fulfil prep pack purchases from our Store,
• to develop and improve our AI features, including training our own future AI tutoring model using AI assistant exchanges (both those confirmed correct and those flagged incorrect, with the checker's reasoning) and Test Analyzer summaries, which carry a pseudonymous learner reference (see Section 2), and
• to keep the service secure and working as intended.

We do not sell your personal information, and the main Mathly app does not use tracking cookies, advertising pixels, or analytics scripts. Our separate pre-launch waitlist page does use Google Analytics — see Section 7 for details.

We share personal information only with the service providers ("operators" under POPIA) that help us run Mathly, and only to the extent needed for them to do so:

• Firebase / Google Cloud — hosts our account login system and database, and stores any Test Analyzer photos you have opted to retain (see Section 2).
• Paystack — processes your subscription and session payments; we never see or store your card details.
• Resend — sends transactional emails on our behalf (booking confirmations, receipts, reminders).
• Anthropic — processes the text of questions sent to the AI maths assistant, and Test Analyzer photos you upload, without your name or email attached.
• Google Meet — used to host live tutoring sessions; the meeting link is shared with you by email.
• Google Analytics — used only on our pre-launch waitlist page to measure anonymised visit statistics; see Section 7.

We do not share your information with third parties for their own marketing purposes.

Some of the providers listed in Section 5 (Firebase/Google Cloud, Anthropic) are headquartered in, and may process data in, the United States and other countries outside South Africa. Under POPIA section 72, we may only allow this where the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA — Google Cloud/Firebase and Anthropic both contractually commit to data protection and security safeguards (including standard contractual-clause-equivalent terms) that meet this requirement, and we only engage processors on that basis.

The main Mathly app does not use advertising or analytics tracking cookies. Our login system uses standard authentication session storage to keep you signed in. We also store a small amount of non-sensitive information in your browser (such as your AI assistant usage count for the month, or in-progress form data) purely so the site works correctly — this stays on your device and is not sent to any third-party tracker.

Our standalone pre-launch waitlist page uses Google Analyticsto measure how many people visit it before launch. Google Analytics uses cookies and similar technology to recognise your browser and collect anonymised, aggregate visit statistics (such as page views and general location). This is separate from your Mathly account and is not linked to your name, email, or any account data. You can opt out of Google Analytics tracking generally using a browser extension such as Google's own Analytics Opt-out Browser Add-on.

We keep your account information for as long as your account is active. If you close your account, we delete or de-identify your personal information within a reasonable period, except where we are legally required to keep financial records (such as payment records) for longer — South African tax law generally requires financial records to be kept for 5 years.

We use reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS), secure password handling through our authentication provider, database access rules that restrict who can read or write your data, and a payment processor (Paystack) that is responsible for card-data security on its own PCI-DSS compliant systems. No system is completely secure, but we take reasonable steps to protect your information against loss, misuse, or unauthorised access.

You have the right to:

• ask us what personal information we hold about you or your child,
• ask us to correct information that is inaccurate or out of date,
• delete your account and associated personal information yourself, any time, from your profile page — or ask us to do it for you — subject to Section 8,
• object to how we process your information, and
• lodge a complaint with the Information Regulator of South Africa if you believe we have mishandled your information (inforegulator.org.za).

To exercise any of these rights, contact us using the details in Section 11 — we'll respond within a reasonable time.

For any privacy question, or to exercise your rights under Section 10, email hello@mathly.co.za or use our Contact page.

We may update this Privacy Policy as the service changes. We'll update the "Last updated" date above whenever we do.