Privacy Notice
1. Who is responsible for your information
The responsible party for personal information processed through this website is [TO CONFIRM: full legal name and status of the operator, for example "N R Steyn trading as AfriLearn AI" or the registered company name and number], of [TO CONFIRM: physical address] ("AfriLearn", "we", "us"). You can reach us at hello@afrilearnai.co.za[TO CONFIRM: address once mailbox exists].
2. What we collect, and what we deliberately do not
Information that stays on your device
The course stores your study state in your own browser's local storage: your first name or chosen display name, your field of study, year of study, the concern you selected at onboarding, which lessons you have opened, your quiz scores and practice activity, and the claim token described below. This information is saved on your device so the course works offline and remembers your progress. It is never transmitted to us, and we cannot see it. Clearing your browser data erases it.
Information we receive and store
- When you buy the course: the name you entered for your certificate and a randomly generated claim token pass through the checkout so that your certificate can be issued to the right person and retrieved only by your browser. Our payment provider sends us a payment reference number and, where available, the email address you used to pay.
- When a certificate is issued: we store the certificate ID, your name as it appears on the certificate, the course name, the issue date, the certificate status, the payment reference and the claim token.
- Technical logs: our hosting provider keeps short-lived request logs (such as IP addresses and pages requested) for security and fault diagnosis. We do not use them to profile you.
Payment card details
We never see or store your card number or banking credentials. Payment is processed by PayFast, a South African payment provider, on its own secure pages, under its own privacy policy. PayFast is an independent responsible party for the payment information you give it.
3. Why we process this information, and on what basis
| Purpose | POPIA justification |
|---|---|
| Processing your purchase and issuing your certificate | Performance of the contract you conclude with us when you buy the course (section 11(1)(b)) |
| Public verification of certificates (see section 4 below) | Performance of the contract, and our and your legitimate interests in credible, checkable credentials (section 11(1)(f)) |
| Emailing your certificate to you | Performance of the contract |
| Security, fraud prevention and fault diagnosis | Our legitimate interests (section 11(1)(f)) |
| Complying with tax and financial record-keeping laws | Legal obligation (section 11(1)(c)) |
Providing your name at checkout is voluntary, though without it we cannot put a name on your certificate. We do not use your information for direct marketing. If that ever changes, we will ask for your consent first, as POPIA section 69 requires.
4. Certificate verification is public by design
The point of an AfriLearn certificate is that anyone can check it. If a person has your certificate ID, our verification page will show them your name as it appears on the certificate, the course name, the issue date and whether the certificate is valid. Nothing else is disclosed, and the ID itself cannot be guessed from your name. Share your certificate ID with the people you want to be able to verify it.
5. Who processes information on our behalf
We use a small number of service providers as operators under POPIA section 20: Vercel (website hosting and serverless functions), Supabase (the database that stores certificate and payment records) and Resend (certificate email delivery). Each processes information only on our instructions and under contractual confidentiality and security obligations.
6. Cross-border transfers
Our hosting and database providers store information on infrastructure outside South Africa, including in the United States and the European Union. POPIA section 72 permits this where the recipient is bound by a law or binding agreement providing substantially similar protection, or where the transfer is necessary for the performance of your contract with us. Our providers are bound by contractual data protection terms, and the transfer of your name and payment reference is necessary to deliver the service you bought. By accepting this notice you also consent to these transfers.
7. How long we keep information
- Certificate records: for as long as the verification service exists, because deleting them would silently invalidate the certificate you earned.
- Payment records: at least five years, as tax and financial legislation requires.
- Technical logs: days to weeks, per our hosting provider's standard retention.
8. Security
Certificate IDs are cryptographically signed, so forged IDs fail verification. All traffic to the site is encrypted in transit. Database access is restricted to keys held server-side, and the public can never read claim tokens, email addresses or payment references from our database. No system is perfectly secure, and POPIA section 22 obliges us to notify you and the Information Regulator if a breach of your personal information ever occurs.
9. Your rights
Under POPIA you may ask us: what personal information we hold about you (also see our PAIA Manual); to correct or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully held; and to object to processing based on legitimate interests. Deleting your certificate record is possible at your request, on the understanding that your certificate will then no longer verify. Write to hello@afrilearnai.co.za and we will respond within a reasonable time.
You may also complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za; general enquiries enquiries@inforegulator.org.za; 010 023 5200.
10. Children
The course is intended for tertiary level students. If you are under 18, a parent, guardian or other competent person must consent to your purchase and to the processing described here, as POPIA sections 34 and 35 require.
11. Cookies and similar technologies
We set no advertising or analytics cookies. The site uses your browser's local storage and a service worker cache for one purpose only: making the course work, offline included. These hold your study state and copies of course files on your device, under your control.
12. Changes to this notice
If we change this notice materially, we will update the version and date above and ask you to accept the new version before you continue using the course.
See also the Terms of Use, the Disclaimer and the PAIA Manual.