Privacy Policy

1. Who we are

Expandable Education is operated by EXPANDABLE EDUCATION (PTY) LTD, a private company incorporated in South Africa (registration number 2026/675875/07), of 7 Carbrook Avenue, Claremont, Cape Town, Western Cape, South Africa, 7708 (“we”, “us”, “our”), an AI-powered study platform for GCSE, IGCSE, A-Level, and AS-Level students. We are the “responsible party” under South Africa’s Protection of Personal Information Act (POPIA) and, where applicable, a “data controller” under the UK/EU General Data Protection Regulation (GDPR) for personal information we collect through the Service. Our Information Officer is Vahin Naka, who can be contacted at hello@expandable.education.

2. What data we collect

• Account information: name, email address, phone number, password (hashed) — never stored in plain text
• Usage data: questions answered, accuracy rates, topics practised, time spent, streaks, readiness scores
• Uploaded exam papers and handwritten working (stored securely; used only for marking and your personal progress tracking)
• School or institution affiliation, if you join via a school or institution invite link
• Payment and billing information (processed by Paystack — we never see or store full card details; we retain transaction references and amounts for accounting and support purposes)
• Technical data: IP address and device/browser information, collected for security and fraud prevention (e.g. bot protection via Cloudflare Turnstile)

3. Why we process your data (legal basis)

We process personal information to perform our contract with you (providing the Service you signed up for), for our legitimate interests (improving the Service, preventing fraud and abuse, and platform security), to comply with legal obligations (e.g. tax and accounting records), and, where required, with your consent (e.g. non-essential cookies — see our Cookie Policy). Specifically, we use your data to:

• Provide personalised practice questions, marking, and study plans
• Calculate your readiness scores, predicted grades, and progress reports
• Allow teachers and school/institution admins linked to your account to monitor your progress
• Process payments and manage subscriptions
• Send transactional emails (account confirmation, receipts, password resets)
• Detect and prevent fraud, abuse, and security incidents

We do not sell your personal information, and we do not use it for third-party advertising.

4. Children’s data

Our users are primarily secondary school and A-Level students, many of whom are minors. Where you are under 18, we process your data on the basis that a parent, guardian, or your school/institution has provided the consent required by applicable law (see Terms of Service, Section 3). We collect only the data reasonably necessary to provide the Service to students and do not use children’s data for advertising or share it with third parties beyond the processors and school/institution staff described in this policy. A parent or guardian may contact us at hello@expandable.education to review, correct, or request deletion of a minor’s data.

5. Who we share data with

We share personal information only with the following categories of recipients, each acting as our processor/sub-processor or, in the case of your school, as an independent responsible party for the data they see:

• Your school or institution’s admin and teachers, if you are enrolled via a school/institution account — they can see your readiness scores, recent activity, and progress reports as part of the education services they provide you
• Supabase (database and file storage infrastructure)
• Anthropic (AI question generation and marking — prompts may reference topic names and your submitted answers; we do not send unnecessary personal identifiers)
• Paystack (payment processing)
• Cloudflare (bot/security protection)

We do not sell personal information or share it for cross-context behavioural advertising.

6. International data transfers

We are based in South Africa, but some of our service providers (including Anthropic and, depending on region, Supabase) process data outside South Africa, including in the United States and European Union. Where we transfer personal information internationally, we rely on contractual safeguards with our processors (such as standard contractual clauses or equivalent mechanisms) intended to ensure your data receives a comparable level of protection to that required under POPIA and, where applicable, the GDPR.

7. Data retention

We retain your data for as long as your account is active and as necessary to provide the Service, comply with our legal obligations (including tax and accounting record-keeping), resolve disputes, and enforce our agreements. You may request deletion at any time by emailing hello@expandable.education. We will delete your account and associated personal data within 30 days of a verified request, except where we are required or permitted by law to retain certain records (for example, financial transaction records) for longer.

8. Your rights

Subject to applicable law, you have the right to access, correct, or request deletion of your personal data; to object to or restrict certain processing; and, where processing is based on consent, to withdraw that consent at any time. If you are in the UK or EU, you also have the right to data portability and the right to lodge a complaint with your local data protection supervisory authority. If you are in South Africa, you have the right to lodge a complaint with the Information Regulator (South Africa). To exercise any of these rights, contact us at hello@expandable.education.

9. Security

All data is encrypted in transit (HTTPS/TLS). Passwords are hashed using industry-standard algorithms and never stored in plain text. Uploaded files are stored in access-controlled cloud storage. We apply database-level row-level security policies so users can only access their own data (or data they are authorised to see, such as a teacher viewing their own students). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will provide reasonable notice (for example, by email or an in-app notice) before they take effect.

11. Contact

For any privacy-related questions or to exercise your rights, email hello@expandable.education.