Privacy Policy

1. Introduction and scope

Stardy (“Stardy”, “we”, “us” or “our”) provides a learning management platform for South African schools, educators, and learners. This Privacy Policy explains how we collect, use, disclose, store, and protect the personal information of users who interact with Stardy through our website, mobile clients, and related APIs (together, the “Platform”). It applies to all data subjects: learners in grades 7 to 12, educators, school administrators, and parents or legal guardians of minor learners.

By creating an account, enrolling in a class, uploading content, or otherwise using the Platform, you confirm that you have read and understood this policy. If you are under the age of 18, you additionally confirm that a parent or legal guardian has reviewed this policy on your behalf and has consented to the processing of your personal information as described. Schools that issue accounts to learners on their own authority warrant that they hold the necessary consents under section 35 of POPIA to act as the data subject’s representative for this purpose.

2. Who the responsible party is

Stardy is the “responsible party” (as defined in section 1 of POPIA) for personal information processed through the Platform for its own purposes (service delivery, analytics, security, and billing). Schools that onboard learners and educators are themselves responsible parties in respect of personal information they upload or cause to be uploaded (for example, class rosters and grade records). In these cases Stardy acts as an “operator” (section 1, POPIA) and processes the data only on the documented instructions of the school pursuant to our Data Processing Addendum.

The Information Officer required by section 55 of POPIA can be contacted at stardyLMS@gmail.com. Our written PAIA manual (Promotion of Access to Information Act, 2000) is available on request and covers the categories of records we hold, how to request access, and the relevant prescribed fees.

3. The personal information we collect

To provide and improve the Platform, we collect and process the following categories of personal information. Some categories are only relevant to specific user roles.

• Account and identity data: full name, preferred display name, email address, school affiliation, role (learner, educator, school administrator, or Stardy administrator), grade level where applicable, and a hashed password credential. We do not knowingly collect ID numbers; where a school chooses to link Stardy to its own identity system we rely on the school’s consent basis.
• Learning and performance data: class enrolments, quiz attempts, typed answers, written submissions, flashcard reviews, mastery probabilities generated by our Bayesian Knowledge Tracing (BKT) engine, assignment grades, teacher feedback, and attendance records for live classes.
• Content you upload: documents, past papers, assignment attachments (PDFs), video or image thumbnails, and any other material you choose to share with a class.
• Technical and device data: browser type, operating system, screen resolution, approximate location derived from the IP address, device identifiers, and logs of API requests. This data is used for security monitoring, fraud prevention, and capacity planning.
• Communications data: notification preferences, OneSignal subscription identifiers, in-app announcements you interact with, and support queries you submit.
• Parent contact information (learners only): WhatsApp phone number of a parent or legal guardian, provided optionally during account registration, used solely for sending performance updates and educational communications to parents.
• Billing data (school administrators only): invoicing contact, VAT number where applicable, and records of payments made to Stardy. We do not store payment card numbers; these are handled by our certified payment service provider.

We do not collect special personal information (as defined in section 26 of POPIA), such as health or biometric data. We do not knowingly process the personal information of children under the age of 13 without the consent of a competent person. If you believe a child’s information has been processed without such consent, contact us immediately and we will delete the information.

4. How we use personal information

We process personal information only where we have a lawful basis under section 11 of POPIA. The specific purposes are:

• Service delivery: to provide you with the functionality you sign up for, including creating and joining classes, generating curriculum-aligned quizzes, tracking progress, issuing gradebook marks, and delivering notifications. Lawful basis: performance of a contract.
• AI-assisted content generation: to transform your prompts and selected curriculum context into quizzes, lesson plans, flashcards, and explanations using large-language-model providers. Inputs may be processed by third-party providers strictly as operators under written contracts that prohibit them from training models on your data. Lawful basis: performance of a contract and your explicit consent when toggling AI features.
• Platform integrity: to secure accounts, detect abuse, investigate bugs, and defend against legal claims. Lawful basis: our legitimate interest, balanced against your rights and freedoms.
• Product improvement: to analyse anonymised or aggregated usage patterns, measure feature adoption, and prioritise engineering work. We do not use your content to train public AI models. Lawful basis: our legitimate interest.
• Legal compliance: to comply with the Companies Act, the Income Tax Act, the FIC Act where applicable, and lawful orders from South African courts or regulators. Lawful basis: compliance with a legal obligation.

5. Sharing and disclosure

We do not sell personal information. We share personal information only with the following categories of recipients and only to the extent necessary:

• Infrastructure and service providers: cloud hosting (Vercel, Supabase), storage (Supabase Storage), push notification delivery (OneSignal), live video (Agora), AI inference (Google AI), and monitoring. Each provider is bound by written agreements that enforce the conditions of Chapter 3 of POPIA.
• Your school: teachers and school administrators within your school can view learning and performance data generated in the classes you belong to. This is intrinsic to the product and forms part of the contract between your school and Stardy.
• Law enforcement and regulators: where required by law, court order, or formal regulatory process, or where necessary to prevent imminent harm.
• Successors in interest: if Stardy is acquired or merged, we will transfer personal information under equivalent protections and will notify you at the email address on file.

6. International transfers

Some of our operators process data outside the Republic of South Africa, primarily in the European Union and the United States. Section 72 of POPIA permits such transfers where the recipient is subject to a law or binding corporate rules providing an adequate level of protection, or where the data subject has consented, or where the transfer is necessary to perform a contract in the data subject’s interest. We rely on Standard Contractual Clauses or equivalent safeguards with each offshore operator, and we document each transfer in our POPIA register.

7. Retention

We retain personal information only for as long as it is necessary to fulfil the purpose for which it was collected, or for as long as we are required to retain it under South African law. Indicative retention periods are:

• Account records: for the life of the account, plus 12 months after closure.
• Learning and performance data: retained for the current academic year plus three subsequent years, matching the school reporting cycle.
• Financial records: seven years, per the Companies Act and the Income Tax Act.
• Security and access logs: 18 months rolling window.
• Backups: purged on a rolling 90-day cycle; data deleted from production will be overwritten within that window.

Schools may request shorter retention for their learners’ data under their data processing agreement with us.

8. Your rights as a data subject

Subject to the exceptions in section 35 and Chapter 6 of POPIA, you have the right to:

• request confirmation of whether we process your personal information;
• request a copy of, or access to, the personal information we hold about you;
• request correction or deletion of inaccurate, irrelevant, or unlawfully processed data;
• object to processing based on legitimate interest or for direct marketing;
• withdraw consent at any time, without affecting processing that occurred before the withdrawal;
• lodge a complaint with the Information Regulator of South Africa.

Requests must be submitted in writing to stardyLMS@gmail.com using the PAIA request form (where required). We respond within 30 days and will explain if any extension is necessary under section 53 of POPIA.

9. Security safeguards

We take reasonable, appropriate, technical and organisational measures to secure personal information under section 19 of POPIA. These include TLS 1.2+ for all network traffic, encryption at rest for documents and database backups, role-based access controls, row-level security policies in our database, audit logging of privileged access, secure software development practices aligned with OWASP ASVS, and third-party penetration testing before each major release. Despite our efforts, no online service can be perfectly secure. You must promptly notify us of any suspected compromise of your account.

In the event of a security compromise that affects your personal information, we will notify you and the Information Regulator in accordance with section 22 of POPIA as soon as reasonably possible after discovering the incident.

10. AI-generated content disclaimer

Stardy provides AI-assisted tools for generating quizzes, explanations, flashcards, and lesson plans grounded in the South African CAPS curriculum. AI output is a study aid, not a substitute for qualified teaching. Teachers retain ultimate responsibility for content used in their classrooms and should review generated material before publishing it to learners. AI output may occasionally contain inaccuracies, bias, or omissions; we actively work to mitigate these through retrieval-augmented generation, explicit prompt engineering, and user feedback loops.

11. Cookies and similar technologies

We use strictly-necessary cookies to keep you signed in and to remember your theme preference. We use first-party analytics cookies to measure feature adoption in aggregate. We do not use third-party advertising cookies. You can clear cookies at any time through your browser settings; doing so may sign you out or reset preferences.

12. Changes to this policy

We may update this policy from time to time to reflect changes in the law, our services, or our practices. Where changes are material we will notify you via email and an in-app banner at least 14 days before the changes take effect. Continued use of the Platform after that period constitutes acceptance of the revised policy.

13. Contact

For any questions about this policy or how we handle personal information, write to stardyLMS@gmail.com. The Information Regulator of South Africa can be contacted at inforeg@justice.gov.za.