Capital Foundry (Pty) Ltd, trading as findalancer.com, is the Responsible Party for your personal information as defined under POPIA. We operate the findalancer.com tutoring marketplace, accessible via our mobile application and at app.findalancer.com.
Our Information Officer can be contacted at: privacy@findalancer.com
| Category | Examples | Who provides it |
|---|---|---|
| Account information | Full name, email address, password (hashed), profile photo | All users |
| Profile information | Subject specialisations, grade levels, hourly rate, bio, availability | Tutors |
| Verification documents | ID / passport number, academic qualifications | Tutors only |
| Payment information | Billing name, bank account details for withdrawals | Tutors (withdrawals) |
| Communications | Messages exchanged via in-app chat, support emails | All users |
| Assignment content | Questions, answers, feedback created within the assignment tool | Tutors and Students |
| Category | Examples |
|---|---|
| Device information | Device type, operating system, app version, unique device identifiers |
| Usage data | Pages visited, features used, search queries, booking history, session timestamps |
| Log data | IP address, access timestamps, error logs |
| Push notification tokens | Device token used to deliver push notifications via OneSignal |
If you register or sign in using a third-party OAuth provider (e.g. Google), we receive your name and email address from that provider as permitted by your settings with them.
| Purpose | Information used |
|---|---|
| Creating and managing your account | Name, email, password, profile photo |
| Facilitating bookings between Students and Tutors | Availability, session history, wallet balance |
| Processing payments and wallet transactions | Payment data, transaction history |
| Tutor verification and badge display | ID documents, qualifications |
| Delivering live video sessions | Session ID, device data (via LiveKit) |
| Sending push notifications and emails | Push token, email address |
| Platform support and dispute resolution | Account data, communications, session logs |
| Safety and fraud prevention | Log data, IP addresses, account behaviour |
| Platform improvement and analytics | Aggregated, anonymised usage data |
| Legal and regulatory compliance | Identity, transaction records |
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.
Under POPIA, we process your personal information on the following grounds:
We do not sell, rent, or trade your personal information. We share information only in the following circumstances:
Tutor profiles — including name, photo, subjects, rating, and rate — are visible to Students. Student names and profile photos are visible to Tutors for confirmed bookings. In-app messages are visible only to the participants in that conversation.
We share personal information with trusted third-party service providers who process data on our behalf, under data processing agreements, including:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and authentication | AWS (US-East) |
| Railway | API server hosting | US |
| Cloudflare | CDN, DNS, web application firewall | Global |
| Cloudflare R2 | File and media storage | Global |
| LiveKit | Live video session infrastructure | Self-hosted (ZA) |
| Paystack | Payment processing | South Africa / Nigeria |
| PayPal | International payment processing | US / Global |
| OneSignal | Push notification delivery | US |
| Resend | Transactional email delivery | US |
We may disclose personal information if required to do so by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of Capital Foundry (Pty) Ltd, our users, or the public.
In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.
Card numbers, banking credentials, and payment authentication data are processed directly by Paystack and PayPal. Capital Foundry (Pty) Ltd does not receive, store, or have access to your full card or banking details. We store only transaction references, amounts, and status records for reconciliation and dispute resolution purposes.
Paystack and PayPal are PCI-DSS compliant payment processors. Their respective privacy policies govern their handling of your payment data.
The findalancer.com web application (app.findalancer.com) uses the following types of cookies and local storage:
| Type | Purpose | Duration |
|---|---|---|
| Essential / session | Authentication tokens, session state | Session / 30 days |
| Functional | User preferences (language, theme) | 1 year |
| Analytics | Aggregated usage data to improve the Platform | Up to 2 years |
We do not use third-party advertising or tracking cookies. You can manage cookie preferences through your browser settings; however, disabling essential cookies may affect Platform functionality.
The mobile app uses device-local storage for authentication tokens and user preferences. It does not use browser cookies.
We retain your personal information for as long as your account is active and for a period thereafter as necessary for legal, financial, and operational purposes:
| Data type | Retention period |
|---|---|
| Account information | Duration of account + 3 years after closure |
| Transaction and financial records | 5 years (South African tax and accounting law) |
| Identity verification documents | Duration of Tutor account + 1 year |
| Session logs and chat messages | 2 years from session date |
| Support communications | 3 years from resolution |
| Anonymised analytics data | Indefinitely (not personally identifiable) |
After the applicable retention period, we securely delete or anonymise your personal information.
We implement industry-standard technical and organisational measures to protect your personal information, including:
Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and the Information Regulator as required by POPIA within 72 hours of becoming aware of the breach.
The Platform is available to users aged 13 and above. Users between the ages of 13 and 17 must have the consent of a parent or legal guardian to register and use the Platform.
We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected information from a child under 13, we will delete that information promptly. If you believe a child under 13 has created an account, please contact us at privacy@findalancer.com.
Parents or guardians who have provided consent for a minor to use the Platform may contact us to review, update, or delete the minor's account and associated data.
As a data subject under POPIA, you have the following rights regarding your personal information:
| Right | What this means |
|---|---|
| Right of access | Request a copy of the personal information we hold about you |
| Right to correction | Request that inaccurate or incomplete information be corrected |
| Right to deletion | Request deletion of your personal information, subject to legal retention obligations |
| Right to object | Object to the processing of your personal information for direct marketing or where we rely on legitimate interest |
| Right to withdraw consent | Withdraw consent at any time where processing is based on consent, without affecting prior lawful processing |
| Right to data portability | Request your personal information in a structured, commonly used format |
| Right to complain | Lodge a complaint with the South African Information Regulator |
To exercise any of these rights, contact us at privacy@findalancer.com. We will respond within 30 days. We may require verification of your identity before processing your request.
You may also lodge a complaint with the Information Regulator of South Africa:
Website: www.inforegulator.org.za
Email: inforeg@justice.gov.za
Some of our service providers are located outside South Africa (see Section 5.2). Where personal information is transferred across borders, we ensure that adequate safeguards are in place, consistent with the requirements of POPIA Section 72, including:
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. When we make material changes, we will notify registered users via email or in-app notification at least 14 days before the changes take effect.
The current version of this policy is always available at findalancer.com/privacy. The effective date at the top of this page indicates when the policy was last updated.
For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact our Information Officer:
Capital Foundry (Pty) Ltd
t/a findalancer.com
Republic of South Africa
Privacy enquiries: privacy@findalancer.com
General support: support@findalancer.com
We are committed to resolving any privacy concerns promptly and transparently.