Privacy Policy

MathFocus is the operator of the Service and, for the purposes of applicable data protection laws (including the South African Protection of Personal Information Act, 2013 ("POPIA") and, where applicable, the UK/EU General Data Protection Regulation ("GDPR")), acts as the responsible party / data controller in respect of personal information collected through the Service.

For purchases and billing, our reseller Paddle.com Market Ltd. ("Paddle") acts as Merchant of Record and processes payment and billing information as an independent controller. See "How we share information" below.

We collect the following categories of personal information:

• Account information — name, email address, hashed password, authentication provider (e.g. Google, Apple), and account creation date.
• Profile information — grade, school (optional), and preferences you provide.
• Learning activity — topics studied, questions attempted, answers, accuracy, streaks, AI tutor conversations, and study session metadata.
• Communication data — support messages and any correspondence you send us.
• Technical and usage data — IP address, device and browser information, session identifiers, log data, referring pages, and page interactions.
• Cookies and similar technologies — see the Cookies section below.
• Billing information — collected and processed by Paddle on our behalf; MathFocus receives limited data such as transaction identifier, subscription status, product, price, billing country, and last four card digits (never the full card number).

We process personal information for the following purposes:

• To create and maintain your account and provide the Service.
• To personalise the learning experience, recommend topics, and generate AI tutor responses.
• To operate subscriptions, entitlements, and access control.
• To provide customer support and respond to your queries.
• To detect, prevent, and address fraud, abuse, and security incidents.
• To improve, debug, and further develop the Service.
• To send transactional and service-related communications (e.g. password resets, subscription notices).
• To comply with legal obligations and enforce our Terms and Conditions.

Where GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for.
• Legitimate interests — to secure the Service, prevent fraud, and improve the platform, provided your interests and fundamental rights do not override ours.
• Consent — for optional analytics or marketing cookies, where required by law. You may withdraw consent at any time.
• Legal obligation — where processing is required by applicable law.

Under POPIA, we process personal information on the basis that it is necessary to conclude or perform a contract with you, to comply with a legal obligation, to protect your legitimate interests, to pursue our legitimate interests or those of a third party, or with your consent.

We do not sell your personal information. We share it only with the following categories of recipients:

• Paddle.com Market Ltd. (Merchant of Record) — Paddle handles all orders, payments, subscription billing, tax compliance, invoicing, refunds, and related customer support inquiries. Paddle receives your name, email, billing address, IP address, and payment method details. Paddle's Buyer Terms and Privacy Notice are available at paddle.com/legal.
• Hosting and infrastructure providers — used to host the Service and store your data securely.
• AI model providers — used to generate AI tutor responses. Conversation content is processed to produce answers but is not used by these providers to train public models.
• Email and communication providers — used to send transactional emails such as receipts, password resets, and service notifications.
• Analytics and error-monitoring providers — used to understand aggregate usage and diagnose issues.
• Professional advisers — such as lawyers and accountants, where reasonably necessary.
• Authorities — where disclosure is required to comply with a legal obligation, court order, or lawful request.

Some of our service providers, including Paddle and our hosting and AI providers, are located outside South Africa (including in the United Kingdom, European Economic Area, and United States). Where personal information is transferred outside South Africa or the EEA/UK, we rely on lawful transfer mechanisms such as adequacy decisions, standard contractual clauses, or the recipient being subject to laws that provide an adequate level of protection, as required by POPIA and GDPR.

We keep personal information only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law. In general:

• Account and profile data — kept for the life of your account.
• Learning activity data — kept for the life of your account so we can personalise your experience and show your progress.
• Billing and transaction records — retained by Paddle and by us for the period required by tax and accounting laws (typically five to seven years).
• Support correspondence — retained for up to three years after resolution.
• Log and security data — retained for up to twelve months.

When you delete your account, we delete or anonymise personal information that is no longer required, subject to the retention periods above.

Depending on where you live, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information, subject to legal retention obligations.
• Object to or restrict certain processing.
• Request portability of information you provided to us.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority — in South Africa, the Information Regulator (https://inforegulator.org.za); in the UK, the ICO (https://ico.org.uk); in the EEA, your local data protection authority.

To exercise any of these rights, email support@mathfocus.co.za. We will respond within the timeframes required by applicable law (typically one month under GDPR).

We apply appropriate technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, disclosure, alteration, or destruction. Measures include encryption in transit (HTTPS/TLS), encryption at rest for stored data, row-level security in our database, hashed passwords, restricted administrative access, and monitoring for suspicious activity. No system can guarantee absolute security, and you are responsible for safeguarding your login credentials.

The Service uses the following categories of cookies and similar technologies:

• Strictly necessary — required for authentication, security, and core Service functionality. These cannot be disabled.
• Functional — remember your preferences and improve usability.
• Analytics — help us understand how the Service is used so we can improve it. Where required by law, we ask for your consent before setting these.

You can manage cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Service from working.

MathFocus is intended for students aged 13 and over. Users under 18 should have permission from a parent or legal guardian before creating an account or subscribing. If you believe a child has provided us with personal information without appropriate consent, please contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or by email. The "Last Updated" date at the top of this page indicates when it was most recently revised.

If you have questions about this Privacy Policy or how we handle your personal information, contact us:

MathFocus
Email: support@mathfocus.co.za
Website: www.mathfocus.co.za

For payment or billing questions, contact Paddle directly via paddle.net.