Privacy Policy

Hlayiso is an ai-powered educational platform for south african learners owned and operated by MHSquared (Pty) Ltd (registration number 202486249807). This policy explains how we collect, use, disclose, and protect personal information when you use our website, mobile apps (Android and iOS), WhatsApp services, and related support channels.

Depending on how you use our services, we may collect the following categories of data:

Personal information (required)

• Name — your full name, used for your profile, leaderboard display, and personalisation.
• Email address — used for account creation, login, password recovery, and service communications.

Personal information (optional)

• Phone number — optionally provided for account recovery or WhatsApp integration.
• School name — optionally provided during onboarding for personalisation.
• Gender and date of birth — optionally provided for profile customisation.
• Province and city — optionally provided for regional content recommendations.

Financial information

• Purchase history — subscription plan selections, billing cycles, and transaction records. We do not store credit card numbers or bank details directly; these are handled by our payment processors (Paystack, RevenueCat, Google Play, Apple App Store).

Photos

• Camera images — when you use the Snap feature to photograph a problem for AI solving. Images are stored to provide solution history.

App activity

• App interactions — quiz results, flashcard progress, study sessions, note completions, XP earned, streak data, leaderboard rankings, and quest progress.
• In-app search history — searches performed within the app to find content.
• Advertising data — which advertisements were shown to you and whether you interacted with them, collected by our advertising partner. See section 13.

Content you create in the app

• AI Chat messages — the messages you send in AI Chat, and the replies you receive, are stored against your account so your conversation history is available when you return. Section 6 explains what is transmitted to the AI provider.
• Your own study material — notes, quizzes, and flashcard decks you create.
• Customer support data — the content of support requests, bug reports, and in-app feedback you send us, including any details you choose to include.

App info and performance

• Crash logs — error reports and crash data to diagnose and fix issues.
• Diagnostics — OTA update logs, app version information, and performance metrics.

Device identifiers

• Device IDs — used for push notifications (FCM tokens) and over-the-air update delivery.
• Advertising identifier — the identifier your operating system assigns for advertising (the IDFA on iOS, the Advertising ID on Android). It is used by our advertising partner to measure ad performance and, only where you have permitted it, to personalise the ads you see. Section 13 explains how to allow or refuse this.

The public Hlayiso Past Papers plugin lets ChatGPT users search our public collection without creating or signing into a Hlayiso account. The plugin receives only the search filters needed for the request, such as grade, subject, year, exam period, document type, and language. It does not request or receive your full ChatGPT conversation history, name, email address, password, payment information, or precise location.

Search requests are processed by Cloudflare Workers, and matching public paper metadata is read from Supabase. Results contain public Hlayiso and Hlayiso CDN links. Hlayiso does not create an account profile from plugin searches and does not store the search filters in its application database. Cloudflare and Supabase may process limited technical request data under their infrastructure security and retention practices. You can stop this processing by uninstalling or not using the plugin.

We use personal information for the following purposes:

• App functionality — to deliver learning content, AI features, quizzes, flashcards, progress tracking, gamification, and subscriptions.
• Account management — to create and manage accounts, authenticate users, and process account changes or deletions.
• Personalisation — to customise content recommendations, leaderboard display, and learning paths based on your activity and preferences.
• Analytics — to understand how the platform is used, monitor app health, diagnose bugs, and improve performance.
• Developer communications — to send important service updates, security notices, and billing notifications via email.
• Fraud prevention and security — to detect and prevent abuse, unauthorised access, and fraudulent transactions.
• Legal compliance — to comply with applicable laws, regulations, and legal processes.

Where required, we rely on consent, contractual necessity, legitimate business interests, and legal obligations to process personal information. By using our services, you acknowledge that certain processing is necessary for us to provide the platform.

For optional data (phone number, school, gender, date of birth, province), you choose whether to provide this information. You can update or remove optional data from your account settings at any time.

We do not sell personal information. We may share information with trusted service providers where necessary:

• Supabase — database hosting, authentication, and storage infrastructure.
• Cloudflare — content delivery, Workers (serverless compute), R2 storage, and AI Gateway.
• Paystack — payment processing for web subscriptions (purchase history is shared for transaction processing).
• RevenueCat — subscription management for in-app purchases via Google Play and Apple App Store.
• Google (Firebase) — push notification delivery, crash reporting, and app analytics.
• Google (AdMob) — advertising in the mobile apps. Receives your advertising identifier and ad interaction data. See section 13.
• Expo — mobile app build and over-the-air update delivery, plus basic app usage and version telemetry.
• Google (Vertex AI / Gemini) — AI model inference for Snap Solve and image generation features.
• Amazon Web Services (Bedrock) — AI model inference for AI Chat.

We may also disclose information to law enforcement or regulators where disclosure is legally required.

Two features rely on a third-party AI service to generate responses: AI Chat and Snap Solve. To answer you, these features transmit your input to that service.

What data is sent

• AI Chat — the messages you type and any photos or documents you choose to attach to a chat.
• Snap Solve — the photo you capture (or the problem you type) and, where relevant, the subject you select.

We do not send your name, email address, phone number, or other contact details to the AI service. Snap Solve also includes an on-device solver for simple maths, which is processed locally on your device and is never sent to the AI service.

Who the data is sent to

AI Chat input is sent to Amazon Web Services (Bedrock), while Snap Solve input is sent to Google (Gemini / Vertex AI). Requests are routed through Cloudflare's AI Gateway. Each provider processes the input solely to generate the response and handles it under its own data protection terms.

Your permission

The first time you use AI Chat or Snap Solve, the app asks for your explicit permission before any data is sent to the AI service. If you do not agree, no data is transmitted and the AI feature is not used. You can withdraw your permission at any time in Settings → Privacy → AI Features; after withdrawing, the app will ask again the next time you try to use an AI feature.

All data transmitted between your device and our servers is encrypted in transit using TLS/HTTPS. Data at rest is protected by the security measures of our infrastructure providers (Supabase, Cloudflare).

We use reasonable technical and organisational safeguards to protect data, including access controls, encrypted connections, and regular security reviews. However, no online system can be guaranteed to be completely secure.

Our services cover the South African CAPS curriculum for Grades 1 to 12, so our learners include young children as well as teenagers. Almost all of our users are minors, and we treat learner data accordingly.

Where an account is used by a minor, a parent, guardian, or school may be involved in setup, billing, consent, and supervision. Under POPIA, processing the personal information of a child generally requires the consent of a competent person, and by creating an account for a learner you confirm you are that person or that you have their permission.

We apply the following protections to all accounts, regardless of age:

• We never sell personal information, and we do not share your name, email address, or phone number with advertising partners.
• Advertisements are capped to a general-audience content rating, so ads rated for older audiences are not requested.
• Ads are not personalised unless personalisation has been permitted on the device. On iOS this requires an explicit permission prompt; see section 13.
• AI features are off until explicitly permitted, and that permission can be withdrawn at any time; see section 6.
• Only the learner and, where applicable, a linked parent or guardian can access an account's progress data. Names and profile pictures are visible to other learners only through features the learner chooses to use, such as the leaderboard or a study circle.

If you are a parent or guardian and want to review, correct, or delete a child's information, contact support@hlayiso.com and we will action the request as described in section 11.

We may use cookies, local storage, and similar technologies to keep users signed in, remember preferences, measure performance, and improve the platform experience. Analytics cookies are loaded only after you consent and run under Google Consent Mode v2.

You can change your choice at any time: Manage cookie preferences.

We keep personal information only for as long as needed for service delivery, legal compliance, dispute resolution, and fraud prevention. Specifically:

• Account data is retained while your account is active.
• When you delete your account, all associated personal data is permanently removed within 30 days.
• Anonymised analytics data may be retained indefinitely for platform improvement.
• Payment transaction records are retained as required by financial regulations.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and all associated data.
• Object to certain processing of your information.
• Export your data in a portable format.

To delete your account: Go to Settings → Account → Delete Account within the app, or email support@hlayiso.comwith the subject line "Account Deletion Request". Account deletion is permanent and removes all your personal data, learning progress, and subscription information.

For any other privacy requests, contact support@hlayiso.com.

Some of our service providers may process information outside South Africa (including the United States and European Union). Where this happens, we take reasonable steps to ensure an appropriate level of protection consistent with applicable law, including relying on providers with adequate security certifications and data processing agreements.

Our mobile apps show advertisements through Google AdMob to keep Hlayiso free to use. Paid plans remove advertising entirely, and no ads are requested at all for subscribers.

What our advertising partner receives

• Your device's advertising identifier — the IDFA on iOS, the Advertising ID on Android.
• Advertising data — which ads were shown and whether you interacted with them.
• General device and app information needed to display and measure an ad.

We do not share your name, email address, or phone number with advertising partners, and we do not sell personal information.

Tracking

Where you permit it, your advertising identifier and advertising data may be combined by Google with data from other apps and websites in order to personalise the advertising you see and to measure advertising performance. Apple describes this as tracking, and we declare it as such in our App Store privacy disclosure. This is the only purpose for which we permit tracking. Your learning progress, study content, AI Chat messages, and contact details are never used for it.

Your choice, and how to change it

On iOS, the app asks for your permission using Apple's App Tracking Transparency prompt before any tracking takes place. If you decline, or simply dismiss the prompt, we request only non-personalised advertising and your advertising identifier is not used to track you. You can change your answer at any time in Settings → Privacy & Security → Tracking, or turn it off for every app at once with Allow Apps to Request to Track.

On Android, you control this through Settings → Google → Ads, where you can opt out of ad personalisation or delete and reset your Advertising ID.

Declining has no effect on your access to Hlayiso. You will still see the same number of ads; they will simply be less relevant.

Ad content suitability

Because our learners include children, we request only advertising rated for general audiences.

We may update this Privacy Policy from time to time. The updated version will be published on this page with a revised last updated date. Material changes will be communicated via email or in-app notification.

For privacy questions or requests, contact support@hlayiso.com.

For security-specific disclosures, contact security@hlayiso.com.

WhatsApp: +27 64 526 1203