Privacy Policy

1.1. This Privacy Policy governs how Tutorverse ("we", "us", or "our") collects, uses, stores, and protects personal information from users of the Tutorverse platform ("Platform").

1.2. By using the Platform, you (as a Tutor or Client) consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

2.1. This Policy is governed by the Protection of Personal Information Act 4 of 2013 (POPIA) and any related South African privacy regulations.

2.2. Tutorverse is the "responsible party" as defined under POPIA and takes all reasonable steps to ensure that your personal information is processed lawfully and securely.

4.1. Personal information is processed for the following purposes:

• 4.1.1 Creating and managing user accounts
• 4.1.2 Facilitating tutoring sessions and bookings
• 4.1.3 Processing payments and issuing receipts
• 4.1.4 Providing customer service and support
• 4.1.5 Verifying certifications (where voluntarily disclosed)
• 4.1.6 Preventing fraud and abuse
• 4.1.7 Complying with legal obligations
• 4.1.8 Improving Platform functionality and analytics

4.2. Messages sent through the Platform. Messages exchanged between users through our in-platform messaging system are stored on our systems. We do not routinely monitor or read them. Authorised members of our team may access message content only where:

• 4.2.1 a user reports a message or a conversation to us;
• 4.2.2 it is necessary to investigate a dispute, a safety concern or a suspected breach of our Terms and Conditions; or
• 4.2.3 we are required to do so by law.

We retain messages for the purposes of dispute resolution and user safety. You should not use the Platform’s messaging system to send sensitive personal or financial information.

5.1. We only process your personal information with your consent, or where it is necessary to perform our contract with you, comply with a legal obligation, or pursue a legitimate interest (e.g., security, service optimisation).

5.2. You may withdraw your consent at any time. Where the Platform provides a direct control, please use it:

• 5.2.1 cookies and advertising: select "Cookie preferences" in the footer of any page;
• 5.2.2 email and in-app notifications: adjust your notification settings in your profile;
• 5.2.3 saved payment cards: remove the card in your profile;
• 5.2.4 credential documents: remove the document from your profile;
• 5.2.5 profile photograph: change or remove it in your profile settings.

For anything else, including identity verification information, email info@tutorverse.co.za. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal, and may limit your ability to use parts of the Platform.

6.1. We use established, enterprise-grade cloud infrastructure providers for the hosting, storage and processing of your personal information. These providers act as Operators under POPIA and process your personal information only on our documented instructions.

6.2. We select these providers on the basis of recognised international security standards (including SOC 2 Type II certification or an equivalent independent assurance standard), and each is bound by a written agreement requiring it to maintain appropriate technical and organisational security measures and to uphold the standards required of us as Responsible Party under POPIA.

6.3. A current list of the Operators we engage is available on written request to info@tutorverse.co.za. We do not publish this list, as it forms part of our confidential technical arrangements, and it may change from time to time as we improve the Platform.

7.1. Some of our Operators store or process personal information on servers located outside the Republic of South Africa, including in the European Union, the United Kingdom and the United States.

7.2. We transfer personal information outside South Africa only where one or more of the conditions in section 72 of POPIA is met, namely:

• 7.2.1 the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, and that includes provisions for onward transfer;
• 7.2.2 the transfer is necessary for the performance of our contract with you, or for the conclusion or performance of a contract concluded in your interest; or
• 7.2.3 you have consented to the transfer.

7.3. Where we rely on clause 7.2.1, we contract with our Operators on terms that include data protection commitments substantially similar to those required of us under POPIA, including restrictions on onward transfer and obligations of security and confidentiality.

8.1. To process payments for our products/services, we use Paystack as a secure payment facilitator. Paystack acts as an Operator (a party processing Personal Information on our behalf) for all payment transactions.

8.2. When you make a purchase on our website, we share your personal information with our payment processor, Paystack (an Operator under POPIA), to enable the secure and lawful processing of your payment.

8.3. We share the following categories of your Personal Information with Paystack for the sole purpose of authorising, processing, and securing the transaction: your Name, Email Address, Phone Number, the Transaction Amount, and certain Device/Transaction Data (such as your IP address).

9.1. We do not store your full payment card number (the 16-digit Primary Account Number or PAN) or your Card Verification Value (CVV) on our platform. Instead, we employ the industry standard of tokenisation by using a third-party Payment Processor (Paystack, who acts as our Operator).

9.2. When you save your card details, Paystack securely stores your sensitive information and provides us with a non-sensitive token.

9.3. We only store this token and the following partial card details to enable you to identify and manage your saved payment methods:

• 9.3.1 Card Type (e.g., Visa, Mastercard)
• 9.3.2 Last 4 digits of the card number
• 9.3.3 Expiry Date

9.4. This process ensures that the minimum amount of your personal financial information is processed and retained by us.

9.5. Purpose of processing. We process and retain the token and partial card details for the following specific purposes:

• 9.5.1 Performance of a Contract: To facilitate future or recurring transactions (e.g., monthly fees, subscription renewals) as explicitly agreed to by you.
• 9.5.2 User Convenience: To allow you to easily identify and select your saved payment method for fast checkout.

9.6. Consent for stored payments.

• 9.6.1 We will only store your payment token and the partial card details listed above if you provide us with explicit consent to "Save Card Details for Future Use" at the time of checkout.
• 9.6.2 You have the right to withdraw this consent and request the deletion of your saved payment token at any time via your account settings.

10.1. Your suburb and city. We ask Clients for a suburb and city so that we can show lessons available near them. This is used only to rank and filter search results by proximity. It is not displayed publicly and is not disclosed to Tutors through the Platform.

10.2. Lesson locations are set by Tutors and are public. A Tutor who offers in-person lessons specifies the location at which those lessons take place when creating the listing. That location is public. It is displayed on the lesson page, including on a map, and is visible to anyone who views the listing, whether or not they hold an account.

10.4. We do not verify lesson locations. We do not inspect, approve or confirm the accuracy or safety of any location a Tutor enters.

10.5. Changing or removing a location. You may change or remove a lesson location at any time by editing the listing, or by deactivating the listing, which removes it from public view.

10.6. Where a Client and a Tutor agree a different venue for a particular lesson — including a Client’s home — that arrangement is made directly between them, usually through the Platform’s messaging system. Any address shared in that way is shared by the Client with the Tutor, not published by us. Clause 6 of our Terms and Conditions sets out each party’s responsibilities in relation to lesson venues.

12.1. Identity verification is voluntary. Tutors may use the Platform without verifying their identity. Tutors who verify receive an "ID Verified" badge on their profile.

12.2. If you choose to verify your identity, we ask you to upload a copy of a government-issued identity document (a South African identity document, passport or driving licence).

12.3. What we check, and what we do not. An authorised member of our team checks two things only: that the name on the document matches the name on your Tutorverse profile, and that you are at least 18 years old. We do not compare your profile photograph, or any other image, against the document. We do not conduct criminal record checks, credit checks or child protection register checks, and the "ID Verified" badge is not a warranty as to a tutor’s suitability to work with children.

12.4. Purposes. We process your identity document only to:

• 12.4.1 confirm that you are who you say you are;
• 12.4.2 confirm that you meet our minimum age requirement;
• 12.4.3 protect users of the Platform from impersonation and fraud; and
• 12.4.4 meet our legal obligations and respond to lawful requests from law enforcement or a regulator.

12.5. Who sees it. Your identity document is reviewed by a limited number of authorised members of our team. It is never displayed on your profile and is never shared with students, parents, guardians or other tutors. Only the outcome of the verification — the badge — is visible to other users. We may in future engage a specialist verification provider, in which case that provider would be bound by a written agreement to the same POPIA standards that apply to us.

12.6. Retention and destruction. We destroy or permanently de-identify your identity document within twelve (12) months of the verification decision, retaining only a record of the fact, date and outcome of the verification, unless a longer period is required by law or by an active dispute or investigation.

12.7. Withdrawal. You may withdraw your consent and request the deletion of your identity document at any time by writing to info@tutorverse.co.za. Withdrawal will result in the removal of your "ID Verified" badge. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

12.8. Profile photograph. Uploading a profile photograph is entirely voluntary and separate from identity verification. If you upload one, it will be displayed publicly on your profile and in search results. You may change or remove it at any time in your profile settings. We do not compare it against your identity document, and it is not used to verify you.

13.1. Data Scraping and Automated Access: To protect the privacy of our Tutors and Clients, the use of automated systems or software to extract data from this Platform (data scraping) for commercial or non-commercial purposes is strictly prohibited.

13.2. The only exception to this prohibition is for legitimate search engine crawlers (such as Googlebot) that access the Platform for the sole purpose of search engine optimisation and indexing.

13.3. We do not sell your personal information. See also clause 17.8 in relation to our advertising partners.

13.4. "Operators" means the service providers who process personal information on our behalf and on our documented instructions, and who are bound by written agreement to maintain confidentiality and appropriate security. We engage, or may from time to time engage, Operators in the following categories:

• 13.4.1 cloud hosting, database and authentication providers;
• 13.4.2 our payment processor (see clauses 8 and 9);
• 13.4.3 communications and email delivery providers, used to send booking confirmations, reminders and service notices;
• 13.4.4 online meeting and video conferencing providers, where we arrange a meeting link for an online lesson;
• 13.4.5 mapping and location providers, used to display lesson locations on a map;
• 13.4.6 analytics and advertising platforms (see clause 17);
• 13.4.7 identity and credential verification providers;
• 13.4.8 customer support and helpdesk providers.

13.5. We do not publish the identity of every Operator, as this forms part of our confidential technical arrangements. A current list is available on written request to info@tutorverse.co.za.

13.6. Apart from our Operators, we disclose your personal information only:

• 13.6.1 to other users of the Platform, to the limited extent necessary to arrange and deliver a lesson;
• 13.6.2 to law enforcement, a court, the Information Regulator or another competent authority, where we are legally obliged to do so or where it is necessary to protect the safety of a person;
• 13.6.3 to our professional advisers (such as attorneys, auditors and insurers) where necessary and under a duty of confidentiality;
• 13.6.4 to a purchaser or successor in the event of a sale, merger or restructuring of our business, subject to the recipient continuing to be bound by this Policy;
• 13.6.5 to authorised members of our own team, under confidentiality obligations, for support, moderation, safety and Platform administration.

14.1. We secure the integrity and confidentiality of personal information in our possession by taking appropriate, reasonable technical and organisational measures, as required by section 19 of POPIA. These include:

• 14.1.1 encryption of data in transit using industry-standard TLS, and encryption of data at rest;
• 14.1.2 row-level access controls in our database, so that users can access only the records they are entitled to see;
• 14.1.3 role-based access restrictions for our own team, granted on a least-privilege basis;
• 14.1.4 tokenisation of payment card information, so that full card numbers are never stored on our systems (see clause 9);
• 14.1.5 logging and monitoring of access to personal information;
• 14.1.6 confidentiality undertakings binding our team and our Operators;
• 14.1.7 periodic review of our security measures against recognised information security practice.

14.2. While we take all reasonable precautions, no system can be guaranteed to be entirely secure. You are responsible for keeping your password confidential and for notifying us promptly of any unauthorised access to your account.

15.1. We do not retain personal information for longer than is necessary to achieve the purpose for which it was collected, unless we are required or permitted by law to retain it for longer. Our retention periods are:

15.2. Where we are required to retain a record for legal, accounting or dispute purposes after you have asked us to delete your information, we restrict its use to that purpose only.

15.3. You may request deletion of your personal information by contacting info@tutorverse.co.za. We will respond within a reasonable time and will tell you if we are unable to delete a particular record and why.

16.1. You have the following rights under POPIA:

• 16.1.1 To access your personal information
• 16.1.2 To request correction or deletion of inaccurate or outdated information
• 16.1.3 To object to the processing of your personal information
• 16.1.4 To withdraw consent for processing
• 16.1.5 To lodge a complaint with the Information Regulator (see clause 23.4 for contact details)

16.2. Requests to exercise these rights should be sent to info@tutorverse.co.za.

17.1. We use cookies and similar technologies (including pixels, tags and local storage) for three purposes, which we group into the categories below. Each category is handled differently, and the cookie banner shows you the state of each one.

17.2. Essential. These are necessary for the Platform to work. They keep you signed in, secure your session, remember your cookie choices and enable bookings and payments. They cannot be switched off.

17.3. Analytics. We record how the Platform is used so that we can improve it: which pages are visited, which features are used, where searches lead, and where users run into difficulty. We use PostHog (PostHog, Inc.), hosted in the European Union, for this. It records the pages and actions of a visit, your browser and device type, an approximate location derived from your IP address, and, if you are signed in, your Platform account identifier. It does not receive your name, email address or telephone number, the content of your messages, or any details about a child. On a small number of pages we may also replay a session to see how a feature was used; text you type is always masked in such a replay. We also use Vercel Web Analytics, which sets no cookie and counts visits in aggregate only.

17.4. Analytics runs on the basis of our legitimate interest in understanding and improving our own service (section 11(1)(f) of POPIA). It is on by default, and you have the right to object at any time by switching Analytics off in the cookie banner. When it is off, no analytics cookie or storage is used and you cannot be identified; your visits are only ever counted anonymously through a hash that changes daily. Where you have accepted analytics through the banner, we may additionally use Google Analytics (Google LLC); it never runs on the basis of legitimate interest.

17.5. Marketing and advertising. These allow us to measure the effectiveness of our advertising and to show relevant advertisements to people who may benefit from tutoring. For this purpose we use advertising and measurement services provided by Meta Platforms, Inc. (the Meta Pixel and Conversions API) and Google LLC (Google Ads). These are off until you switch them on, and nothing is sent to these platforms, from your browser or from our servers, without that consent.

17.6. Information shared with advertising platforms. Where you have consented to marketing cookies, we share the following with the advertising platforms named above so that they can measure and attribute conversions:

• 17.6.1 a cryptographically hashed (irreversibly scrambled) version of your email address, telephone number, name and Platform account identifier;
• 17.6.2 your IP address, browser information and the advertising cookies those platforms set in your browser;
• 17.6.3 the action you took (for example, that a lesson was viewed or a booking was completed) and its value.

We do not share your name, email address or telephone number with these platforms in readable form, and we never share the identity of your tutor, your lesson address, your messages, or the content of your lessons. Analytics data is never passed to advertising platforms.

17.7. Your choice. When you first visit the Platform, the cookie banner tells you that analytics is on and lets you switch it off, and asks whether you want to switch marketing on. You may change either choice at any time by selecting "Cookie preferences" in the footer of any page, or by emailing info@tutorverse.co.za. Your choice is recorded in a cookie that lasts twelve (12) months. You may also block cookies through your browser settings, although this may impair Platform functionality.

17.8. We do not sell your personal information, and we do not permit our analytics or advertising partners to use the information described in this clause for their own independent purposes.

18.1. The Platform may include links to third-party websites or services (e.g., Paystack, external resources). We are not responsible for the privacy practices of these entities. Users are encouraged to read their privacy policies separately.

19.1. Accounts on the Platform may only be held by persons aged 18 or over. Children may not register for an account.

19.2. A parent or legal guardian may book lessons for a child. Where they do so, we process the child’s personal information on the basis of the consent of that parent or guardian, as the competent person contemplated in section 35 of POPIA.

19.3. We collect the minimum information about a child necessary to arrange and deliver a lesson — typically the child’s first name, school grade or level, and the subject to be taught. Where we arrange an online meeting for a lesson, we may also use the child’s email address, or that of the parent or guardian, to send the meeting invitation; that address is visible to the tutor and is processed by the meeting provider. We ask parents and guardians not to provide a child’s identity number, medical information, home address or photograph.

19.4. Information about a child is shared only with the tutor engaged for the lesson, and is never displayed publicly.

19.5. A parent or guardian may at any time access, correct or request the deletion of information relating to their child by contacting info@tutorverse.co.za.

19.6. If we become aware that we hold personal information about a child without the consent of a competent person, we will delete it promptly.

20.1. Where there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise, having regard to the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of our systems.

20.2. Our notification to you will describe, as far as we are able, the possible consequences of the compromise, the measures we intend to take or have taken to address it, what we recommend you do to mitigate any adverse effects, and the identity of the unauthorised person if known to us.

21.1. We may update this Privacy Policy from time to time. Updates will be communicated via email or in-app notice at least 7 days before taking effect.

21.2. Continued use of the Platform after an update indicates acceptance of the revised Policy.

22.1. We use automated systems to rank tutors and lessons in search results and recommendations. These systems take into account factors such as relevance to the search, the completeness and quality of a profile, verified credentials, ratings and reviews, responsiveness, and reliability (including cancellations and no-shows).

22.2. These systems affect how prominently a tutor appears in search results. They do not make any decision about a person that has legal consequences for that person, or that affects them to a substantial degree, solely on the basis of automated processing, as contemplated in section 71 of POPIA. Decisions to suspend or remove an account are reviewed by a member of our team.

22.3. A tutor who believes their ranking has been affected by inaccurate information may contact us at info@tutorverse.co.za to have it reviewed.

23.1. The Responsible Party for the purposes of POPIA is:

23.2. Our Information Officer, as contemplated in section 55 of POPIA, may be contacted at info@tutorverse.co.za.

23.3. For privacy questions, requests to exercise your rights under POPIA, or complaints, please contact us at info@tutorverse.co.za. We aim to respond within 15 business days.

23.4. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

• Email: complaints.IR@justice.gov.za
• Website: www.inforegulator.org.za