Capital Foundry (Pty) Ltd, trading as findalancer.com, is the Responsible Party for your personal information as defined under POPIA. We operate the findalancer.com tutoring marketplace, accessible via our mobile application and at app.findalancer.com.
Our Information Officer can be contacted at: privacy@findalancer.com
| Category | Examples | Who provides it |
|---|---|---|
| Account information | Full name, email address, password (hashed), profile photo, date of birth | All users |
| Parent or guardian information | Guardian's full name, guardian's email address, and record of guardian consent | Learners under 18 |
| Profile information | Subject specialisations, grade levels, hourly rate, bio, availability | Tutors |
| Verification documents | ID / passport number, academic qualifications | Tutors only |
| Payment information | Billing name, bank account details for withdrawals | Tutors (withdrawals) |
| Sponsor organisation information | Organisation name, contact person, contact telephone number | Sponsors |
| Communications | Messages exchanged via in-app chat, support emails | All users |
| Assignment content | Questions, answers, feedback created within the assignment tool | Tutors and Students |
We collect your date of birth in order to determine whether you are a minor and therefore whether parent or guardian consent is required before your account can be used.
| Category | Examples |
|---|---|
| Device information | Device type, operating system, app version, unique device identifiers |
| Usage data | Pages visited, features used, search queries, booking history, session timestamps |
| Log data | IP address, access timestamps, error logs |
| Push notification tokens | Device token used to deliver push notifications via OneSignal |
| Consent records | The version of this policy and the Terms and Conditions you accepted, and the date and time of acceptance |
| Session recordings | Video and audio of tutoring sessions, including anything visible or audible to your camera and microphone while you are in a session |
If you register or sign in using a third-party OAuth provider (e.g. Google), we receive your name and email address from that provider as permitted by your settings with them.
Tutors must verify their identity before they can accept bookings. Students, and the parents of Students under 18, are entitled to know who they are meeting.
The check is carried out by Didit, an identity verification provider. You submit a photograph of a government issued identity document and a short selfie directly to Didit. Their privacy policy governs how they handle those documents.
We do not receive or store your identity document. Capital Foundry (Pty) Ltd receives only the outcome of the check, the date it was completed, and a reference for the verification session. Your date of birth and legal name, which you provided to us at registration, are checked against the document by Didit rather than by us.
We retain the verification outcome for as long as the Tutor account is active, and for one year after it closes, as set out in section 8.
| Purpose | Information used |
|---|---|
| Creating and managing your account | Name, email, password, profile photo |
| Verifying age and obtaining guardian consent for minors | Date of birth, guardian name and email, consent record |
| Facilitating bookings between Students and Tutors | Availability, session history, wallet balance |
| Processing payments and wallet transactions | Payment data, transaction history |
| Administering sponsorships and bursary funding | Learner name, session and subject records, sponsored balance |
| Tutor verification and badge display | ID documents, qualifications |
| Delivering live video sessions | Session ID, device data (via LiveKit) |
| Sending push notifications and emails | Push token, email address |
| Platform support and dispute resolution | Account data, communications, session logs |
| Safety and fraud prevention | Log data, IP addresses, account behaviour |
| Platform improvement and analytics | Aggregated, anonymised usage data |
| Investigating safety concerns and resolving disputes about what happened in a session | Session recordings |
| Legal and regulatory compliance | Identity, transaction records |
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.
Under POPIA, we process your personal information on the following grounds:
We do not sell, rent, or trade your personal information. We share information only in the following circumstances:
Tutor profiles — including name, photo, subjects, rating, and rate — are visible to Students. Student names and profile photos are visible to Tutors for confirmed bookings. In-app messages are visible only to the participants in that conversation.
Where a learner's tutoring is funded by a sponsor, meaning an organisation or individual providing bursary funding through the Platform, we share limited information with that sponsor for the sole purpose of administering the sponsorship.
Information shared with a sponsor includes:
We do not share the following with sponsors: learner contact details (email address or telephone number), identity documents, date of birth, guardian details, payment or banking information, or the content of in-app messages, assignments, or tutoring sessions.
Where the learner is under 18, the parent or legal guardian consents to this sharing as part of the consent given at registration.
We share personal information with trusted third-party service providers who process data on our behalf, under data processing agreements, including:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and authentication | AWS (US-East) |
| Railway | API and application server hosting | US |
| Cloudflare | CDN, DNS, web application firewall | Global |
| Cloudflare R2 | File and media storage | Global |
| LiveKit | Live video session infrastructure | Self-hosted (ZA) |
| Paystack | Payment processing | South Africa / Nigeria |
| PayPal | International payment processing | US / Global |
| OneSignal | Push notification and transactional email delivery | US |
We may disclose personal information if required to do so by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of Capital Foundry (Pty) Ltd, our users, or the public.
In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.
Card numbers, banking credentials, and payment authentication data are processed directly by Paystack and PayPal. Capital Foundry (Pty) Ltd does not receive, store, or have access to your full card or banking details. We store only transaction references, amounts, and status records for reconciliation and dispute resolution purposes.
Paystack and PayPal are PCI-DSS compliant payment processors. Their respective privacy policies govern their handling of your payment data.
The findalancer.com web application (app.findalancer.com) uses the following types of cookies and local storage:
| Type | Purpose | Duration |
|---|---|---|
| Essential / session | Authentication tokens, session state | Session / 30 days |
| Functional | User preferences (language, theme) | 1 year |
| Analytics | Aggregated usage data to improve the Platform | Up to 2 years |
We do not use third-party advertising or tracking cookies. You can manage cookie preferences through your browser settings; however, disabling essential cookies may affect Platform functionality.
The mobile app uses device-local storage for authentication tokens and user preferences. It does not use browser cookies.
We retain your personal information for as long as your account is active and for a period thereafter as necessary for legal, financial, and operational purposes:
| Data type | Retention period |
|---|---|
| Account information | Duration of account + 3 years after closure |
| Guardian consent records | Duration of the learner's account + 3 years after closure |
| Transaction and financial records | 5 years (South African tax and accounting law) |
| Identity verification documents | Duration of Tutor account + 1 year |
| Sponsorship records | Duration of the sponsorship + 5 years (financial record-keeping) |
| Session logs and chat messages | 2 years from session date |
| Session video recordings | 60 days from session date |
| Support communications | 3 years from resolution |
| Anonymised analytics data | Indefinitely (not personally identifiable) |
After the applicable retention period, we securely delete or anonymise your personal information.
Tutoring sessions on the Platform are recorded. This is not optional, and it applies to every session, whether joined from the app or from a web browser.
Why. Learners, including learners under 18, meet tutors one to one over video. Recording allows us to investigate a report of inappropriate behaviour and to establish what happened when a learner, guardian or tutor disputes a session. Without a recording, we would be deciding such matters on one person's word against another's.
Who can see a recording. Recordings are held in private storage and are not publicly accessible. They are viewed only by authorised FindALancer staff, and only when investigating a specific safety concern or dispute. They are not available to other students, not available to sponsors, and are not used for marketing, training, quality scoring or any form of automated analysis.
How long we keep them. 60 days from the session date, after which they are deleted automatically. Where a recording forms part of an active investigation, dispute or legal matter, we retain it until that matter is concluded.
What you are told. You are told that a session is recorded before you join it, and an indicator is shown for the duration of the session. If you do not wish to be recorded, you should not join the session.
Your rights. You may ask us whether a recording of a particular session exists and object to our processing of it, as set out in section 11. Because recording rests on our legitimate interest in learner safety rather than on your consent, we will weigh any objection against that interest, and we will explain our decision.
We implement industry-standard technical and organisational measures to protect your personal information, including:
Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and the Information Regulator as required by POPIA within 72 hours of becoming aware of the breach.
The Platform is available to users aged 13 and above. Users between the ages of 13 and 17 must have the consent of a parent or legal guardian to register and use the Platform.
When a learner registers, we ask for their date of birth. If the learner is under 18, registration cannot be completed unless the learner provides the full name and email address of a parent or legal guardian and confirms that the guardian has consented to their use of the Platform. We record the guardian's details, the fact of consent, and the version of this policy that was in effect at the time.
We use a guardian's name and email address only to record and verify that consent has been given, and to contact the guardian about the learner's account where necessary, including in relation to safety concerns, account closure, or a request to exercise the learner's rights under POPIA. We do not use guardian contact details for marketing, and we invite the guardian to create an account so they can see the learner's sessions, tutors and spending. A guardian cannot read messages between the learner and their tutor.
We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected information from a child under 13, we will delete that information promptly. If you believe a child under 13 has created an account, please contact us at privacy@findalancer.com.
Parents or guardians who have provided consent for a minor to use the Platform may contact us at privacy@findalancer.com to review, update, or delete the minor's account and associated data, or to withdraw their consent. Withdrawal of consent will result in the closure of the learner's account.
As a data subject under POPIA, you have the following rights regarding your personal information:
| Right | What this means |
|---|---|
| Right of access | Request a copy of the personal information we hold about you |
| Right to correction | Request that inaccurate or incomplete information be corrected |
| Right to deletion | Request deletion of your personal information, subject to legal retention obligations |
| Right to object | Object to the processing of your personal information for direct marketing or where we rely on legitimate interest |
| Right to withdraw consent | Withdraw consent at any time where processing is based on consent, without affecting prior lawful processing |
| Right to data portability | Request your personal information in a structured, commonly used format |
| Right to complain | Lodge a complaint with the South African Information Regulator |
To exercise any of these rights, contact us at privacy@findalancer.com. We will respond within 30 days. We may require verification of your identity before processing your request. Where the data subject is a learner under 18, a parent or legal guardian may exercise these rights on their behalf.
You may also lodge a complaint with the Information Regulator of South Africa:
Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Some of our service providers are located outside South Africa (see Section 5.3). Where personal information is transferred across borders, we ensure that adequate safeguards are in place, consistent with the requirements of POPIA Section 72, including:
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will notify registered users via email or in-app notification at least 14 days before the changes take effect.
The current version of this policy is always available at findalancer.com/privacy. The effective date at the top of this page indicates when the policy was last updated.
For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact our Information Officer:
Capital Foundry (Pty) Ltd
t/a findalancer.com
Republic of South Africa
Privacy enquiries: privacy@findalancer.com
General support: support@findalancer.com
We are committed to resolving any privacy concerns promptly and transparently.