# Privacy Policy > Hlayiso respects your privacy and processes personal information in line with applicable South African data protection requirements, including POPIA. - Page: https://www.hlayiso.com/privacy - Updated: 2026-10-26 Breadcrumbs: [Home](https://www.hlayiso.com/) › [Privacy Policy](https://www.hlayiso.com/privacy) ## 1. Who we are Hlayiso is an AI-powered educational platform for South African learners owned and operated by MHSquared (Pty) Ltd (registration number 202486249807). This policy explains how we collect, use, disclose, and protect personal information when you use our website, mobile apps (Android and iOS), WhatsApp services, and related support channels. ## 2. Information we collect Depending on how you use our services, we may collect the following categories of data: ### Personal information (required) - **Name** — your full name, used for your profile, leaderboard display, and personalisation. - **Email address** — used for account creation, login, password recovery, and service communications. ### Personal information (optional) - **Phone number** — optionally provided for account recovery or WhatsApp integration. - **School name** — optionally provided during onboarding for personalisation. - **Gender and date of birth** — optionally provided for profile customisation. - **Province and city** — optionally provided for regional content recommendations. ### Financial information - **Purchase history** — subscription plan selections, billing cycles, and transaction records. We do not store credit card numbers or bank details directly; these are handled by our payment processors (Paystack, RevenueCat, Google Play, Apple App Store). ### Photos - **Camera images** — when you use the Snap feature to photograph a problem for AI solving. Images are stored to provide solution history. ### App activity - **App interactions** — quiz results, flashcard progress, study sessions, note completions, XP earned, streak data, leaderboard rankings, and quest progress. - **In-app search history** — searches performed within the app to find content. - **Advertising data** — which advertisements were shown to you and whether you interacted with them, collected by our advertising partner. See section 13. ### Content you create in the app - **AI Chat messages** — the messages you send in AI Chat, and the replies you receive, are stored against your account so your conversation history is available when you return. Section 6 explains what is transmitted to the AI provider. - **Your own study material** — notes, quizzes, and flashcard decks you create. - **Customer support data** — the content of support requests, bug reports, and in-app feedback you send us, including any details you choose to include. ### App info and performance - **Crash logs** — error reports and crash data to diagnose and fix issues. - **Diagnostics** — OTA update logs, app version information, and performance metrics. ### Device identifiers - **Device IDs** — used for push notifications (FCM tokens) and over-the-air update delivery. - **Advertising identifier** — the identifier your operating system assigns for advertising (the IDFA on iOS, the Advertising ID on Android). It is used by our advertising partner to measure ad performance and, only where you have permitted it, to personalise the ads you see. Section 13 explains how to allow or refuse this. ## 2A. ChatGPT Past Papers plugin The public Hlayiso Past Papers plugin lets ChatGPT users search our public collection without creating or signing into a Hlayiso account. The plugin receives only the search filters needed for the request, such as grade, subject, year, exam period, document type, and language. It does not request or receive your full ChatGPT conversation history, name, email address, password, payment information, or precise location. Search requests are processed by **Cloudflare Workers**, and matching public paper metadata is read from **Supabase**. Results contain public Hlayiso and Hlayiso CDN links. Hlayiso does not create an account profile from plugin searches and does not store the search filters in its application database. Cloudflare and Supabase may process limited technical request data under their infrastructure security and retention practices. You can stop this processing by uninstalling or not using the plugin. ## 3. How we use personal information We use personal information for the following purposes: - **App functionality** — to deliver learning content, AI features, quizzes, flashcards, progress tracking, gamification, and subscriptions. - **Account management** — to create and manage accounts, authenticate users, and process account changes or deletions. - **Personalisation** — to customise content recommendations, leaderboard display, and learning paths based on your activity and preferences. - **Analytics** — to understand how the platform is used, monitor app health, diagnose bugs, and improve performance. - **Developer communications** — to send important service updates, security notices, and billing notifications via email. - **Fraud prevention and security** — to detect and prevent abuse, unauthorised access, and fraudulent transactions. - **Legal compliance** — to comply with applicable laws, regulations, and legal processes. ## 4. Lawful basis and consent Where required, we rely on consent, contractual necessity, legitimate business interests, and legal obligations to process personal information. By using our services, you acknowledge that certain processing is necessary for us to provide the platform. For optional data (phone number, school, gender, date of birth, province), you choose whether to provide this information. You can update or remove optional data from your account settings at any time. ## 5. Sharing of information We do not sell personal information. We may share information with trusted service providers where necessary: - **Supabase** — database hosting, authentication, and storage infrastructure. - **Cloudflare** — content delivery, Workers (serverless compute), R2 storage, and AI Gateway. - **Paystack** — payment processing for web subscriptions (purchase history is shared for transaction processing). - **RevenueCat** — subscription management for in-app purchases via Google Play and Apple App Store. - **Google (Firebase)** — push notification delivery, crash reporting, and app analytics. - **Google (AdMob)** — advertising in the mobile apps. Receives your advertising identifier and ad interaction data. See section 13. - **Expo** — mobile app build and over-the-air update delivery, plus basic app usage and version telemetry. - **Anthropic (Claude)** — AI model inference for AI Chat, Ask AI, Snap Solve, AI marking and the note, quiz and flashcard creators. - **Google (Gemini)** — generates illustrations for study notes. We may also disclose information to law enforcement or regulators where disclosure is legally required. ## 6. AI features and third-party AI processing Our AI features rely on a third-party AI service to generate responses: **AI Chat**, **Ask AI**, **Snap Solve**, **AI marking** and the **note, quiz and flashcard creators**. To answer you, these features transmit your input to that service. ### What data is sent - **AI Chat** — the messages you type and any photos or documents you choose to attach to a chat. - **Snap Solve** — the photo you capture (or the problem you type) and, where relevant, the subject you select. - **AI marking** — the answers you type or photograph, with the question and memo they are marked against. - **Note, quiz and flashcard creators** — the photos, files and instructions you add. We do **not** send your name, email address, phone number, or other contact details to the AI service. Snap Solve also includes an on-device solver for simple maths, which is processed locally on your device and is never sent to the AI service. ### Who the data is sent to This input is sent to **Anthropic (Claude)**. Requests are routed through Cloudflare's AI Gateway. Anthropic processes the input solely to generate the response and handles it under its own data protection terms. ### Your permission The first time you use an AI feature, the app asks for your explicit permission before any data is sent to the AI service. If you do not agree, no data is transmitted and the AI feature is not used. You can withdraw your permission at any time in **Settings → Privacy → AI Features**; after withdrawing, the app will ask again the next time you try to use an AI feature. ## 7. Data encryption and security All data transmitted between your device and our servers is encrypted in transit using TLS/HTTPS. Data at rest is protected by the security measures of our infrastructure providers (Supabase, Cloudflare). We use reasonable technical and organisational safeguards to protect data, including access controls, encrypted connections, and regular security reviews. However, no online system can be guaranteed to be completely secure. ## 8. Children and education data Our services cover the South African CAPS curriculum for **Grades 1 to 12**, so our learners include young children as well as teenagers. Almost all of our users are minors, and we treat learner data accordingly. Where an account is used by a minor, a parent, guardian, or school may be involved in setup, billing, consent, and supervision. Under POPIA, processing the personal information of a child generally requires the consent of a competent person, and by creating an account for a learner you confirm you are that person or that you have their permission. We apply the following protections to all accounts, regardless of age: - We never sell personal information, and we do not share your name, email address, or phone number with advertising partners. - Advertisements are capped to a general-audience content rating, so ads rated for older audiences are not requested. - Ads are not personalised unless personalisation has been permitted on the device. On iOS this requires an explicit permission prompt; see section 13. - AI features are off until explicitly permitted, and that permission can be withdrawn at any time; see section 6. - Only the learner and, where applicable, a linked parent or guardian can access an account's progress data. Names and profile pictures are visible to other learners only through features the learner chooses to use, such as the leaderboard or a study circle. If you are a parent or guardian and want to review, correct, or delete a child's information, contact [support@hlayiso.com](mailto:support@hlayiso.com) and we will action the request as described in section 11. ## 9. Cookies and similar technologies We may use cookies, local storage, and similar technologies to keep users signed in, remember preferences, measure performance, and improve the platform experience. Analytics cookies are loaded only after you consent and run under Google Consent Mode v2. You can change your choice at any time: the “Manage cookie preferences” button on the page. ## 10. Data retention We keep personal information only for as long as needed for service delivery, legal compliance, dispute resolution, and fraud prevention. Specifically: - Account data is retained while your account is active. - When you delete your account, all associated personal data is permanently removed within 30 days. - Anonymised analytics data may be retained indefinitely for platform improvement. - Payment transaction records are retained as required by financial regulations. ## 11. Your rights and data deletion Subject to applicable law, you have the right to: - Access the personal information we hold about you. - Correct inaccurate or incomplete information. - Delete your account and all associated data. - Object to certain processing of your information. - Export your data in a portable format. **To delete your account:** Go to Settings → Account → Delete Account within the app, or email [support@hlayiso.com](mailto:support@hlayiso.com) with the subject line "Account Deletion Request". Account deletion is permanent and removes all your personal data, learning progress, and subscription information. For any other privacy requests, contact [support@hlayiso.com](mailto:support@hlayiso.com). ## 12. Cross-border data transfers Some of our service providers may process information outside South Africa (including the United States and European Union). Where this happens, we take reasonable steps to ensure an appropriate level of protection consistent with applicable law, including relying on providers with adequate security certifications and data processing agreements. ## 13. Advertising and tracking Our mobile apps show advertisements through **Google AdMob** to keep Hlayiso free to use. Paid plans remove advertising entirely, and no ads are requested at all for subscribers. ### What our advertising partner receives - Your device's **advertising identifier** — the IDFA on iOS, the Advertising ID on Android. - **Advertising data** — which ads were shown and whether you interacted with them. - General device and app information needed to display and measure an ad. We do **not** share your name, email address, or phone number with advertising partners, and we do not sell personal information. ### Tracking Where you permit it, your advertising identifier and advertising data may be combined by Google with data from other apps and websites in order to personalise the advertising you see and to measure advertising performance. Apple describes this as **tracking**, and we declare it as such in our App Store privacy disclosure. This is the only purpose for which we permit tracking. Your learning progress, study content, AI Chat messages, and contact details are never used for it. ### Your choice, and how to change it **On iOS**, the app asks for your permission using Apple's App Tracking Transparency prompt before any tracking takes place. If you decline, or simply dismiss the prompt, we request only non-personalised advertising and your advertising identifier is not used to track you. You can change your answer at any time in **Settings → Privacy & Security → Tracking**, or turn it off for every app at once with **Allow Apps to Request to Track**. **On Android**, you control this through **Settings → Google → Ads**, where you can opt out of ad personalisation or delete and reset your Advertising ID. Declining has no effect on your access to Hlayiso. You will still see the same number of ads; they will simply be less relevant. ### Ad content suitability Because our learners include children, we request only advertising rated for **general audiences**. ## 14. Changes to this policy We may update this Privacy Policy from time to time. The updated version will be published on this page with a revised last updated date. Material changes will be communicated via email or in-app notification. ## 15. Contact us For privacy questions or requests, contact [support@hlayiso.com](mailto:support@hlayiso.com). For security-specific disclosures, contact [security@hlayiso.com](mailto:security@hlayiso.com). WhatsApp: [+27 64 526 1203](https://wa.me/27645261203) ## Related pages - [About](https://www.hlayiso.com/about) - [Contact](https://www.hlayiso.com/contact) - [Terms and Conditions](https://www.hlayiso.com/terms) --- Hlayiso: free CAPS and IEB past papers, memos, notes and study guides for South African learners. When citing, link the page URL above, not a PDF or /api/ URL.