Impande Ignite (Pty) Ltd
Privacy Policy
Version 1.0-draft-2026-07-15 — pending review by a South African attorney
How Impande Ignite collects, uses and protects personal information, in line with POPIA.
This Privacy Policy explains how Impande Ignite (Pty) Ltd ("Impande Ignite", "we", "us") collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act, 2013 (POPIA). We are the responsible party for the personal information we process.
Effective date: 15 July 2026.
1. Who we are
Impande Ignite is a South African company (registration 2026/437966/07) based in Durban, KwaZulu-Natal. Our Information Officer (Mluleki Praisegod Xaba) can be contacted at privacy@impandeignite.co.za or +27 71 592 5932.
2. The personal information we collect
We collect only the information needed to provide learning support and to run the educator bridge:
| Category | Examples | Why we collect it |
|---|---|---|
| Learner identity | Name, grade, province, date of birth, email address, and school name (optional) | To create and personalise the learner account, and to establish whether a guardian's consent is required |
| Guardian details and consent | Parent or guardian email address, and a dated record of the consent given | To request consent, to contact you, and to keep the auditable record POPIA requires |
| Academic activity | Subjects taken, current and target marks, study goals, and a record of study and practice activity on the platform | To deliver tutoring, track progress and report |
| Tutor records | Identity and session records | To match and supervise tutors |
| Graduate educator records | Name, email address, city and province, qualification and institution, year of graduation, teaching subjects and teaching phase, and SACE registration number | To create the educator profile and, once educator verification is available, to connect verified educators with schools |
| Technical and security records | Account and security event logs | For security, reliability and accountability |
We do not collect IP addresses.
3. How we use personal information
We process personal information to: provide and personalise the platform; deliver AI tutoring and study tools; communicate with learners and guardians; create and maintain graduate educator profiles; keep the platform safe and secure; meet legal and reporting obligations; and improve our services. We rely on consent and our legitimate operational needs as the lawful basis, as POPIA allows.
4. Children's personal information
This section concerns processing the personal information of children and is the highest-risk area. It must be reviewed by an attorney experienced in POPIA's provisions on children's data before use.
Many of our users are under 18. We do not knowingly allow a learner under 18 to use the platform until a parent or legal guardian (a competent person) has given consent. We obtain that consent through a verified parental-consent step that the parent or guardian completes before the learner is granted access to the platform, and we keep a dated, auditable record of it. A guardian may withdraw consent at any time, after which we will stop processing the child's information and delete it on request, subject to any law that requires us to keep it.
Graduate educator accounts are for adults only, and no learner or child information is shown on the graduate surface.
5. How we share personal information
We do not sell personal information. We share it only with:
- Operators (service providers) who process personal information on our behalf under written operator agreements:
- Supabase — cloud hosting and database, including our response cache — hosted in the European Union (eu-west-1, Ireland);
- Google and Anthropic — artificial-intelligence answer processing that supports the tutor — hosted in the United States;
- OpenAI — embeddings processing of identity-stripped question text, used to retrieve matching curriculum passages — hosted in the United States;
- Resend — transactional email delivery, including the consent request sent to a parent or guardian;
- Vercel — application hosting and delivery.
Identity-verification and payment providers will be added on the same basis as those services go live.
- Schools participating in a programme, in respect of their own learners;
- Authorities where the law requires it, or to protect a child's safety.
No personal identifier is ever included in a request to an artificial-intelligence provider (Google, Anthropic or OpenAI). Each request is built from the learner's question and the relevant curriculum passages alone. The learner's name, school, date of birth, marks, account identifier and session identifier are not removed from the request -- they are never placed in it. The provider receives an academic question and curriculum text, and has no means of knowing which learner asked.
We use each of these providers on their paid tiers, under terms that bind them not to use our prompts or responses to train or improve their models. On the paid tiers, prompts and responses are retained only for a limited period, for abuse detection and to meet legal obligations. We do not use free or unpaid tiers for any learner content, because unpaid terms permit the provider to use submitted content to improve its products and to have it read by human reviewers.
6. Processing outside South Africa
Some of our operators process personal information outside South Africa. Our cloud hosting and database, operated by Supabase, are located in the European Union (eu-west-1, Ireland). Our artificial-intelligence providers, Google, Anthropic and OpenAI, process information on infrastructure in the United States. Our email-delivery and application-hosting operators may also process information outside South Africa.
These transfers are made on the bases permitted by section 72 of POPIA, namely with the consent of the data subject or competent person, and under written operator agreements that bind each recipient to protections substantially similar to those POPIA requires. Because no personal identifier is ever included in a request to an artificial-intelligence provider, no learner's identity is transferred across a border to those providers.
7. Automated decision-making
We do not make decisions about a learner that have legal or similarly significant effects based solely on automated processing. The artificial-intelligence tutor provides educational support: it explains methods and offers hints. It does not decide whether a learner's work is correct, and it does not determine marks, placement, or eligibility. Whether an answer is right or wrong is determined by the platform against the official curriculum solution, not by an artificial-intelligence model. We do not use profiling to make automated decisions with legal effect about a learner.
8. How we keep information secure
We apply appropriate technical and organisational measures, including access controls, encryption of information in transit, authentication safeguards, monitoring, and audit logging of sensitive events. Learner content sent to an artificial-intelligence provider is enclosed in data tags, and every model is instructed to treat that content as data to be answered rather than as instructions to follow. The platform has been security-audited and the findings addressed.
9. Security compromises
We maintain procedures to detect, contain, and investigate security compromises. If a compromise affecting personal information occurs, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after becoming aware of it and establishing its scope, in accordance with section 22 of POPIA. Notifications to affected data subjects will describe the nature of the compromise and the steps they can take to protect themselves. The Information Officer coordinates this process.
10. How long we keep information
We keep personal information only for as long as necessary for the purposes set out above, or as required by law. As a general rule: learner and guardian account information is retained for the duration of the learner's use of the platform and is deleted, or irreversibly anonymised, within 12 months of the account becoming inactive or on earlier request; consent records are retained for the duration of the relationship and for five years thereafter as evidence of consent; graduate educator profiles are retained for the duration of the educator's use of the platform and deleted on request; academic activity is anonymised for evaluation and aggregate reporting; and technical and security logs are retained for 12 months.
Learners, guardians and graduate educators may request deletion at any time, subject to any law that requires us to retain certain records. Where a POPIA-required record of a consent or a security event must be kept after an account is deleted, that record is retained without any information that identifies the person.
11. Your rights
Under POPIA you have the right to: be told what information we hold; access it; ask us to correct or delete it; object to certain processing; and complain to the Information Regulator. To exercise any right, contact our Information Officer at privacy@impandeignite.co.za. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za.
12. Cookies
We use only the cookies and similar technologies needed to run the platform — principally to keep you signed in and to keep your account secure. We do not use advertising cookies, and we do not use third-party analytics or tracking cookies.
13. Changes to this policy
We may update this policy from time to time. We will post the updated version and, where appropriate, notify you. Last updated: 15 July 2026.
14. Contact us
Information Officer, Impande Ignite (Pty) Ltd. Email: privacy@impandeignite.co.za; telephone: +27 71 592 5932; address: 477 Anton Lembede Street, Durban, KwaZulu-Natal, 4001.