BNAStem Academy

Privacy Policy

Last updated: [add date when approved]

1. Who we are

BNA STEM Academy ("we", "us", "our") operates an online tutoring platform for school subjects in Grades 8 to 12. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have over it, in line with South Africa's Protection of Personal Information Act (POPIA).

2. Information we collect

  • Account information: name, email address, password (stored as a secure hash, never in plain text). Tutor and administrator accounts also use a second sign-in step with an authenticator app.
  • Parent or guardian information (learners under 18): full name, email address, phone number and relationship to the learner, and a record of when and from where consent was given. We do not collect ID or passport numbers.
  • Student information: date of birth (we do not collect ID or passport numbers), gender, phone number, grade level, subject enrollments, class attendance, grades, and homework submissions.
  • Tutor information: phone number, professional email, bio, timezone, and (where applicable) uploaded qualifications/credentials.
  • Sign-in and confirmation data: to keep accounts safe and make sure every account belongs to a real person, we email a one-time code when you sign in on a new browser, and we send a one-time code to your WhatsApp number (and to a parent or guardian's WhatsApp number for learners under 18) to confirm that the number is yours. We keep the confirmed number, the date it was confirmed, and which browsers you chose to trust for 30 days. Codes are stored only in scrambled form and expire after 10 minutes.
  • Payment-related information: payments are processed by PayFast. We never see or store your card or bank login details; PayFast sends us confirmation of the payment, and we keep the payment reference, amount, status and date for reconciliation and record-keeping.
  • Reviews and messages you send us: if you submit a review we collect your name, email address, whether you are a student, parent or tutor, your rating and what you write, and optionally the grade, subject and tutor it relates to. If you use the contact form we receive the name, email and message you enter.
  • Usage information: login timestamps and basic activity logs needed to operate the portal (e.g. quiz submissions, class join times).

3. Children's / minors' information

Many of our students are under the age of 18. We ask for each learner's date of birth to work out whether a parent or legal guardian must consent. A learner under 18 can only use the portal once their parent or guardian has confirmed consent from their own email address. A learner who is 18 or older consents for themselves. We collect only the information necessary to provide tutoring services (contact details, academic records) and do not use minors' information for marketing purposes. We do not collect ID or passport numbers for learners or parents.

4. Why we collect this information

  • To create and manage student, tutor, and admin accounts
  • To confirm a learner's age, so we know whether a parent or guardian must consent, and to prevent fraudulent registrations
  • To deliver tutoring services: scheduling classes, tracking attendance, marking assignments, and issuing grades
  • To communicate with you about your account, classes, and payments
  • To review and approve tutor applications
  • To comply with legal and regulatory obligations

5. How we store and protect your information

Data is stored in a PostgreSQL database hosted by Neon, and the platform and uploaded files are hosted on Vercel. Access is restricted to authorized administrators. Some of our service providers store or process information on servers outside South Africa. Passwords are hashed and never stored in plain text, and learners' dates of birth are encrypted in our database. We use industry-standard practices such as input validation and sanitization to guard against common attacks. No system is 100% secure, and we continue to improve our security practices over time.

6. Who we share information with

We do not sell personal information. We may share limited information with:

  • Service providers who help us operate the platform: Vercel (hosting and file storage), Neon (database), Resend (email delivery), Meta (WhatsApp, which delivers the confirmation codes; it receives the phone number and the code only), PayFast (payment processing, which also acts as a responsible party for the payment details you give it) and Microsoft (Teams, used to run live classes)
  • Tutors, limited to the information needed to teach and support their assigned students
  • Legal or regulatory authorities where required by law

7. Your rights under POPIA

You have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or outdated information
  • Request deletion of your information, subject to legal/record-keeping requirements
  • Object to processing of your information in certain circumstances
  • Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at support@bnastemacademy.co.za.

8. Data retention

We retain account and academic records for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and record-keeping obligations. In particular:

  • Student accounts that have been inactive for 12 months are automatically erased.
  • Reviews that we reject are deleted 30 days after the decision, and reviews that are never moderated are deleted after 90 days. Approved reviews stay on the site until you ask us to remove them, which you can do at any time by contacting us below.
  • Reviews are shown publicly with your first name and last initial only; your email address is never shown.
  • Payment records are kept for as long as tax and accounting law requires.
  • Short-lived security records (such as login-attempt counters) are deleted automatically within hours.

9. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the platform.

10. Contact us

Email: support@bnastemacademy.co.za
Phone: 067 025 1855

Information Officer: Khathutshelo Tshisudi (info@kmhgwebsolutions.co.za)