Privacy Policy

The responsible party is OUTSIDETHEBOX (PTY) LTD (registration 2025/944907/07), 42A Malabor Road North, Lynnwood Glen, Pretoria, Gauteng, 0081, trading as buitedieboksAFRIKAANS.

Information Officer: Tendai Simbanegavi. For anything in this policy — including access, correction or deletion requests — contact privacy@buitedieboks.com.

Where your school or tutoring provider created your account and directs how it is used, that school also determines the purpose of processing for its own learners. Requests about a school's own records may be referred to that school.

We do not collect identity numbers, dates of birth, home addresses, learner phone numbers, health information or payment card details. Package payments are arranged and confirmed off the platform; no card details are entered into or stored by this site.

Most learners on this platform are under 18. Learner accounts are created by, or on the instruction of, a school, tutor or parent — the platform is not marketed to children directly, and a learner cannot join a school or class without an access code issued by that school or tutor.

Under POPIA, personal information of a child may only be processed with the authorisation of a competent person (normally a parent or guardian). Where a school or tutor enrols a learner, we rely on that school or tutor having obtained that authorisation. If you are a parent or guardian and want to see, correct or remove your child's information, contact us at privacy@buitedieboks.com or your child's school.

If you sign in with Google, we ask Google only for the email and profile scopes. From those we receive your email address, your name and your Google profile picture.

We use that information solely to create and identify your account. We store your name and email address in our database; we do not store your Google password. We have no access to your Gmail, Drive, Contacts, Calendar or any other Google service, and we do not sell, transfer or use Google user data for advertising or to train any model. You can revoke our access at any time in your Google Account permissions.

We use Sentry to detect faults. Two things about it you should know plainly:

• Error reports include your IP address and the account that hit the error.
• We do not record your ordinary use of the site. A replay of what happened in the browser is kept only for a session in which an error occurs. Text content is masked and media is blocked in these replays by default, so they show the shape of the page and what was clicked rather than what was typed or read.

These recordings are used only to reproduce and fix faults. If you object to session recording, contact privacy@buitedieboks.com.

While you are signed in, we record which pages your account opens and when. This is tied to your account, not anonymous.

While an assessment is open, we record two signals only: whether the assessment tab is the active tab, and whether the window is roughly half-screen width. We do not read other tabs, other applications, your clipboard, your camera or your microphone, and we cannot see anything outside this platform. These signals are shown to your teacher or tutor for the purpose of assessment integrity.

We do not sell personal information. We share it with the following service providers, who process it on our instructions:

Within the platform, your information is also visible to the people who need it: your teacher or tutor sees your work, marks and attendance; your school's administrators see their own learners; and our support staff can see your account and support tickets.

With your consent on a specific support ticket, an administrator can be granted temporary access to diagnostic logs from your session. That access is time-limited, records who granted it and why, and expires automatically.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Our database, sign-in service, uploaded files and the application itself are hosted in Germany. Some of our other service providers — those listed above as being in the United States — process information there. This means personal information — including learners' work and marks — is transferred outside South Africa.

POPIA permits a transfer outside South Africa where the recipient is subject to a law, binding corporate rules or agreement that upholds principles of protection substantially similar to POPIA. Germany is subject to the European Union's General Data Protection Regulation (GDPR), and each of the providers above is engaged under its standard data processing terms.

Course materials and profile photos are stored in file buckets that serve content over a direct link. Anyone holding that exact link can open the file without signing in. The link is not secret or random — it contains the upload timestamp and the file's name — and it keeps working once forwarded. The platform controls who is shown a link, not who can use one.

So: do not forward course-file links, and do not upload anything as a profile photo that you would not want seen by someone who obtains the link.

We do not use advertising or tracking cookies. We use:

• sign-in cookies set by Supabase, which keep you signed in — without them the platform cannot work;
• a short-lived cookie that gates the administrative area;
• two entries in your browser's local storage that remember your preferred gradebook view.

Account information, work, marks and attendance are kept for as long as the account is active and your school needs the academic record. When an account is deleted, its personal information is removed from the platform.

One exception, stated plainly: for accountability we keep an administrative log of the deletion or merging of accounts, which retains the affected email address, name and account type, and who performed the action. This log is visible only to administrators.

Under POPIA you may:

• ask what personal information we hold about you, and get a copy;
• ask us to correct or complete information that is wrong;
• ask us to delete information we are no longer entitled to keep;
• object to processing, and withdraw a consent you previously gave (this does not undo processing already carried out);
• ask not to receive direct marketing — the enquiry form asks for that consent separately, and it is never a condition of using the platform.

Send any of these to privacy@buitedieboks.com. We may need to confirm your identity first. If a request concerns a learner, we may involve the school that holds the academic record.

You also have the right to complain to the Information Regulator (South Africa): enquiries@inforegulator.org.za · inforegulator.org.za.

Access to data is enforced in the database itself, not only in the interface, so a learner cannot read another learner's work by altering a request. Traffic is encrypted in transit, administrative areas sit behind a separate gate, and the platform is audited periodically. No system is perfectly secure; if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.

If we change how we handle personal information we will update this page and change the effective date above. Material changes will be announced in the platform.