MathsConnected is a South African maths learning site for Grades 4–7. This explains what we collect, why, and what we refuse to collect. It is written to be read by a parent, not a lawyer.

The short version

• We store a child's first name or nickname, their grade, and an animal avatar — and their surname only if their school adds it. Nothing else.
• Children never give us an email address, phone number, date of birth or photo, and are never asked for their surname.
• We never advertise to children and never sell anyone's information.
• Card numbers never reach us — our payment provider handles those.
• We use what we collect to run MathsConnected, and for nothing else.

What we collect about a child

A display name (first name or nickname), a grade, an avatar, and their progress: which levels they finished, their scores, and when they last played. School learners also have a username and password so they can log in on a shared computer. The learner or their teacher chooses the username, and it need not be their real name.

A school may also add a learner's surname, so that its teachers can tell two children with the same first name apart. Only the teachers and admins at that school see it. A child's own screens only ever show their first name, and a family account never asks for a surname at all.

A parent or teacher can send a child a short message of encouragement. We keep it with the child's profile.

What we collect about adults

Parents, teachers and school admins give a name, an email address and a password. Schools also give the school's name. A name and an email address are needed to open an account. Passwords are stored hashed — scrambled one way, so nobody, including us, can read them back.

If you write to us, through Help, the contact form or email, we keep your message and the name and email address you give, so that we can answer.

What we use it for

To sign people in, to show a child's progress to the grown-ups who are allowed to see it, to take payment and keep the records of it, and to answer you. We email account holders what they need to know about their account: invoices, a reminder before a free week or a year ends, and replies. News and teaching ideas go only to people who ticked the box for them, and every one of those emails has a link that stops them.

Consent (POPIA sections 34 and 35)

South African law prohibits processing a child's personal information without the consent of a competent person — normally a parent or guardian.

• Families: the parent creates the account, confirms they are the parent or guardian, and consents. We record who consented, when, and which version of this policy applied.
• Schools: the school confirms it has obtained parental consent for its learners and provides the learner information. For those learners the school is the responsible party and we handle the information on its behalf, as our terms set out. Schools should follow their own consent process with parents.

Consent can be withdrawn at any time by deleting the child's profile, which deletes their progress.

Keeping a login from being shared

When you sign in we store a random number in your browser and note that this browser was used. It is not your name, your address, or anything that identifies you, and it is never shared. It lets us see when one login is being used on far more devices than one family or one school could have, and it lets you see whether anybody else has been signing in as you. Clearing your browser's site data clears it.

Cookies, and what our servers see

We use no advertising cookies, no trackers and no analytics that follow you around the web. Your browser keeps what holds you signed in and a few of your own settings, and nothing else. Like every website, our servers see your device's internet (IP) address and the type of browser. We use them to stop anyone guessing passwords and class codes over and over, and they are kept in security logs.

Who helps us run the site, and where the information lives

A few companies help us run MathsConnected. Each is bound by a contract to keep the information safe and to use it only for us:

• Supabase keeps our database and handles signing in, on servers in London, in the United Kingdom.
• Cloudflare delivers the website, from a network of servers around the world.
• Paystack takes card payments.
• Resend, in the United States, sends our emails. It handles the email address and the email, and nothing else.

Some of these are outside South Africa. Section 72 of POPIA allows that where the company is bound by a contract or a law that protects the information as POPIA does, which is the case for each of them. The lettering on our pages is loaded from Google Fonts, and one piece of code from jsDelivr: they see a device's internet address when a page loads, and nothing about you.

Payments

Card payments are handled by Paystack, which is PCI DSS certified. Card numbers never touch our servers or our code. We keep only what Paystack hands back: the card's type, its last four digits, its expiry date and a token that lets Paystack charge it again. A fingerprint of the card is kept so that one card cannot start free weeks over and over. Schools may also pay by debit order, or by invoice and EFT by arrangement.

We email an invoice for every payment and keep a copy, as the law requires of us. It carries the name on the account and the email address it was sent to. If you give us more to print on it, such as a registered name, an address, a VAT number, your own reference, or a second email address for your accounts office, we keep those too, and you can change or remove them on your plan page.

Who can see a child's progress

• Their parent, if they play at home.
• The teacher whose class they belong to — and only that teacher's classes.
• The school's admin, for that school only.

These limits are enforced by the database itself, not merely hidden in the screens.

How we keep it safe

Everything travels encrypted. The database itself decides who may see what, passwords are hashed, and only the people who run MathsConnected can reach its systems. If information is ever seen or taken by someone who should not have it, we tell the people affected and the Information Regulator, as the law requires.

How long we keep it

For as long as the account is active. Delete a child and their profile and progress go with it. Close an account and we remove its data within 30 days, except records we must legally keep: invoices and payment records are kept for five years.

Your rights

You may ask what we hold about you or your child, have it corrected or deleted, object to how we use it, and withdraw a consent you gave. It costs nothing, and we answer within 30 days. Send us a message through the contact page.

You may also complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · POPIAComplaints@inforegulator.org.za · 010 023 5200 · inforegulator.org.za.

Our access to information manual, which the Promotion of Access to Information Act requires, lists the records we hold and how to ask for one.

Changes to this policy

If this policy changes in a way that matters, we email account holders before the change starts.

Contact

The responsible party for your information is Edu Connected (Pty) Ltd, trading as MathsConnected, registered in South Africa (2026/591995/07), of 89 Kenneth Kaunda Road, Durban North, Durban, 4051, South Africa.

Our Information Officer answers every privacy question and request. Send yours through our contact page and choose Privacy or my data.