How Tafela handles data

Tafela stores your tutoring records — your students, parents, lessons, and invoices. We treat that data as yours, and we're bound by South Africa's Protection of Personal Information Act (POPIA). Below is what we collect, why, and what we don't do with it.

• About you (the tutor): name, email, phone, business name, banking reference, payment terms, VAT details if you supply them.
• About your students: name, grade, curriculum, subjects, date of birth, school. Provided by you.
• About your parents/guardians: name, email, phone, billing email. Provided by you.
• Activity: lessons, attendance, lesson notes, invoices, payments. Generated as you use Tafela.
• Authentication metadata: last login, anonymised IP for fraud / abuse signals.

• To run the service you signed up for.
• To deliver invoice emails and lesson reminders to the addresses you provide.
• To show parents (via per-parent share links) the schedule and invoices for their own children — they are the legal guardians of that data.
• To prevent abuse and fix bugs.

• We don't sell your data. Ever.
• We don't use it to train AI models or build marketing profiles.
• We don't expose student names or specific lesson details to the platform admin. Admin sees aggregate counts (number of students, total lessons, paid amount) — never names.
• We don't share data with third parties beyond the service providers strictly needed to run Tafela (Supabase for database/auth; Resend for email; Render for hosting; Cloudflare for DNS). Each is bound by their own data-protection obligations.

You can, at any time:

• Access the data we hold on you and your contacts.
• Correct any inaccuracy from inside the app.
• Export your data (CSV from settings; full export by emailing us).
• Deleteyour account. We keep data for 30 days in case you change your mind, then it's removed.
• Object to processing or lodge a complaint with the Information Regulator (South Africa).

Your database is hosted on Supabase's eu-west-1 region (Ireland). Daily encrypted backups. Email (transactional sends) flows through Resend. Hosting is Render (Frankfurt). All connections are TLS-encrypted in transit.

We use a single session cookie to keep you signed in. We don't run third-party analytics, advertising trackers, or session-replay tools. Hand on heart.

For privacy questions, exports, or complaints: privacy@tafela.co.za. Real human reads, replies within 2 business days.