Privacy Policy

Mathxl (Pty) Ltd (registration number 2026/619778/07), trading as MathXL, is the responsible party for the personal information described here. Our registered office is at 6 Stockley Road, Kenwyn, Cape Town, Western Cape, 7779, South Africa.

Our Information Officer is Mogamad Raeez Adams. For any privacy question, correction or request, contact us at support@mathxl.co.za or 066 018 3756. Please mark privacy requests clearly so we can route them properly.

• Name, email address and, if you give it, a contact number.
• Your password, stored only as a cryptographic hash — we cannot read it.
• Bookings, invoices, payment records and credits on your account.
• Messages and support correspondence with us.
• Technical records created when you use the site, such as your IP address and server logs, kept for security and troubleshooting.

We deliberately keep this to what teaching requires. For each learner we hold their first and last name, date of birth and age, their grade, any note you choose to add about their learning needs, a sign-in username, a hashed password, and their class timetable, attendance and progress.

We may ask separately for your permission to use a learner's photograph, first name or an achievement to celebrate their progress, including on our website or social media.

We only do this with your specific, separate consent, given freely and not bundled into our terms. If you consent, we would keep a record of what you agreed to and when. You may withdraw consent at any time by emailing support@mathxl.co.za. Withdrawal applies going forward: we will stop using the material and remove it from places we control, though we cannot recall printed material already produced or copies others have already saved or shared. Declining or withdrawing has no effect on training.

For trainers we hold contact details, the qualifications and experience they supply, their availability and timetable, and their teaching and attendance records.

• To create and run your account and your learner’s account.
• To schedule, deliver and record classes, attendance and progress.
• To take payment, issue invoices and manage credits.
• To send service messages you need — verification, bookings, invoices, receipts, password resets and class reminders.
• To keep the platform secure, prevent fraud and misuse, and meet our legal obligations.
• Where you have separately agreed, to send marketing, or to celebrate a learner’s achievement.
• Where you have accepted analytics, to understand how our website is used so we can improve it (see clause 13).
• To count, without identifying anyone, how many accounts, call-back requests, bookings and payments our service receives.

We rely on performing our contract with you, our legitimate interests in running, securing and measuring the service, our legal obligations, and — for marketing, website analytics and learner photographs or achievements — your consent.

We never receive or store your card number, expiry date or CVV. Card details are entered on PayFast's own secure payment pages. We receive only the outcome of the payment, a reference and the amount, which we keep for invoicing, accounting and dispute handling. Where you pay by EFT, we hold your payment reference and proof you submit.

We use a small number of service providers, and only for the purposes above:

• PayFast (South Africa) — payment processing.
• Hostinger — the server hosting the platform and its database, located in Germany.
• Our email provider — sending service email from our mathxl.co.za address.
• Twilio — WhatsApp class reminders, where enabled and where you have given a number for it.
• Zoom — used for the online classroom.
• PostHog (servers in Germany) — website analytics, only if you accept analytics, and anonymous counts of key steps (see clause 13).

These providers act on our instructions. We do not sell personal information, and we do not share it with a partner or associate for their own marketing unless you have specifically agreed to that.

Our platform and database are hosted in Germany, and some providers above operate outside South Africa. This means your information is processed outside the country. We only use providers that are required to protect it to a standard consistent with POPIA and to process it solely for the purposes we set.

We keep account, class and attendance information for as long as your account is active and for a reasonable period afterwards, so that history remains available to you and to us. Invoices, payments and related accounting records are kept for the period South African law requires. Security and server logs are kept for a short period. Website analytics events are available to us for up to 12 months, after which they no longer appear in our analytics; our analytics provider may continue to store them until we delete our analytics account. Session recordings are deleted after 30 days.

When information is no longer needed for these purposes we delete it or remove the details that identify a person.

The site is served over an encrypted connection. Passwords are stored only as hashes. Access to the platform is controlled by role, so a parent can only reach their own family's information, and administrative functions are restricted. Access to the underlying server and database is limited to those who need it.

No online service can promise perfect security, and we do not claim to. If a breach affects your information we will notify you and the Information Regulator as POPIA requires.

You may:

• ask what personal information we hold about you or your learner;
• ask us to correct anything inaccurate;
• ask us to delete information we no longer have a lawful reason to keep;
• object to processing we carry out on the basis of our legitimate interests;
• withdraw consent for marketing, or for use of a learner’s photograph or achievement, at any time.

Email support@mathxl.co.za and we will respond as soon as we reasonably can. Account closure and deletion requests are handled by our team rather than by a button in the platform, so please contact us and we will confirm what has been removed and what we must keep for accounting or legal reasons.

The platform stores a small amount of information in your browser so that you stay signed in and so the site remembers basic preferences, including your analytics choice. Accepting, declining or changing your analytics choice does not sign you out; only clearing the sign-in information stored in your browser may do so. Our payment and classroom providers may set their own cookies when you use their pages. We do not use advertising cookies.

Website analytics, only if you accept. On your first visit we ask whether you accept analytics. If you do, we use PostHog, with servers in Germany, to see how parents use our website and where signing up or booking is difficult, so that we can improve it. It records the pages and sections viewed, how far a page is scrolled, which buttons and links are used, whether our videos are played, the type of device and browser, your approximate location (country and city or region, worked out from your internet address, which is then discarded), the website or campaign that brought you to us, and errors that stop a step from working. To group the pages of a visit, it stores a random identifier in your browser; it is not linked to your name or account.

On our public pages only, it may also keep a session recording: a reconstruction of how the page was scrolled and clicked. Everything typed into a form is hidden, and the call-back form is never recorded.

Analytics never runs on student, child sign-in, classroom, trainer or administrator pages. It does not collect names, email addresses, phone numbers, dates of birth, information about children, or payment details. We do not use analytics for advertising, and we do not sell it.

If you decline, no analytics runs and nothing is stored for it. You can change your choice at any time with Cookie settings at the bottom of our pages.

Anonymous counts. Separately, our server counts key steps — an account created, a call-back request received, a booking paid, an EFT order awaiting payment, or a payment that did not go through — with the package size, whether it is a renewal, the payment method, the general reason a payment did not complete, and the hour it happened. These counts contain no name or contact detail, and no customer, account, booking or browser identifier. We use them to see how our service is performing.

Please raise any concern with us first — we would rather fix it directly. If you are not satisfied, you may complain to the Information Regulator of South Africa, which oversees POPIA, at inforegulator.org.za.

We may update this policy. The version and effective date appear at the top of this page, and we will tell you about material changes by email or in the platform. See also our Terms & Conditions.