Skip to main content
← Back to Home

Privacy Policy

Last updated: September 2026

KLEVA ENTERPRISES (PTY) LTD (2026/483090/07), trading as Kleva Academy ("Kleva Academy," "we," "us," or "our") is committed to protecting your privacy and handling your personal information responsibly in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

This Privacy Policy explains what information we collect, how we process and share it, the third-party services we use, and your statutory rights regarding your personal information across klevaacademy.co.za and related services (together, the "Platform").

1. Who We Are & Information Officer

Kleva Academy is an educational study and revision platform designed for Grade 10–12 learners in South Africa.

  • Responsible Party: KLEVA ENTERPRISES (PTY) LTD (Registration Number: 2026/483090/07)
  • Information Officer: Kleva Academy Information Officer (Registered with the Information Regulator)
  • PAIA Manual: Available upon request to the Information Officer.
  • Email: support@klevaacademy.co.za
  • Contact: Via email at support@klevaacademy.co.za or through the in-app Support tab

2. Children's Information & Parental Consent

Many learners utilizing Kleva Academy are under the age of 18. Under sections 34–35 of POPIA, there is a general prohibition on the processing of personal information concerning children. We strictly adhere to the special provisions by ensuring:

  • Learners under 18 may only use the Platform and register an account with the explicit, prior consent of a parent or legal guardian ("competent person").
  • During registration, consent is verified and recorded. Parents and legal guardians may review, amend, or request deletion of their child's information at any time.
  • We strictly prohibit the processing of children's data without consent, and we never sell or use children's data for third-party behavioural advertising or marketing. All processing is solely for providing our educational services.

3. Information We Collect & Consent for Processing

We process your personal information strictly on the basis of your explicit consent, which is obtained during registration, or where necessary to provide our services. You may withdraw consent at any time. We collect only the minimum necessary information required to operate the Platform:

  • Account Data: Name, email address, grade, selected subjects, school (optional), and profile picture (via Google OAuth).
  • Educational & Activity Data: Quiz scores, study notes, flashcard progress, streak records, leaderboard rankings, and AI tutor interaction logs.
  • Payment Information: Subscription tiers, transaction references, and payment verification records processed via our PCI-DSS certified payment gateway (YouTube Memberships). We do not store credit or debit card numbers.
  • Technical & Log Data: IP addresses, browser types, operating system details, device identifiers, and crash diagnostic logs.

4. Data Processing and Hosting via Supabase

Our core backend infrastructure, user authentication, and application database are hosted and processed via Supabase. All user profile data, educational records, notes, and session states are securely processed and stored using Supabase's managed relational database environment with industry-standard encryption in transit and at rest. Cross-border transfers adhere to section 72 of POPIA, ensuring equivalent data protection safeguards.

5. Google Analytics & User Opt-Out

We use Google Analytics to analyze website traffic, measure user engagement, and continually enhance our learning platform. Google Analytics uses cookies to collect aggregated, de-identified metrics about how visitors interact with the site.

Opt-Out: You have the choice to opt out of Google Analytics data collection at any time. You can prevent Google Analytics from recognizing you on return visits by disabling cookies in your browser settings or by downloading and installing the official Google Analytics Opt-out Browser Add-on.

6. Third-Party Service Providers

We do not sell, rent, or trade your personal information. We share data strictly with essential service operators:

  • Supabase: For cloud database hosting, data storage, and authentication.
  • Google Analytics: For aggregate usage analytics and platform optimization (opt-out available).
  • YouTube Memberships: For PCI-DSS compliant subscription billing and payment processing.
  • Groq / AI Model Providers: For processing real-time student queries sent to the AI tutor (data is not used to train external models).
  • Google OAuth: For secure single sign-on authentication.

7. Marketing Communications

We adhere to a strict opt-in policy for marketing communications. You will only receive promotional emails or marketing messages if you have explicitly consented (opted in) to receive them. You can opt out at any time via the unsubscribe link in our communications or your account settings.

8. Data Retention, Breaches & Security

We apply appropriate technical, organizational, and administrative safeguards to protect your personal data against unauthorized access, loss, or destruction. Security procedures are in place to protect the confidentiality of your data, including Google user data. We use encryption to protect your information. Specifically, for sensitive data such as authentication tokens and personal identifiers, we employ encryption in transit using secure protocols (HTTPS/TLS), encryption at rest, and strict role-based access controls (RBAC) to limit system access.

Information is retained in accordance with our documented Data Retention Policy, ensuring data is kept only as long as necessary to provide our educational services or fulfill statutory tax and accounting obligations (up to 5 years for financial records).

In the unlikely event of a security compromise, we maintain a comprehensive Data Breach Response Plan detailing the immediate notification process for affected users and the Information Regulator, as required by POPIA.

9. Your Rights Under POPIA & Right to Deletion (Right to be Forgotten)

Under POPIA, you and your parent or guardian possess statutory data protection rights, including:

  • Right to Request Deletion (Right to be Forgotten): You have the express right to request the permanent deletion and erasure of your personal information held by Kleva Academy. You can request account and data deletion directly within your in-app profile settings or by contacting our Information Officer at support@klevaacademy.co.za. Upon request, all personal data will be purged or irreversibly anonymized, subject only to mandatory legal retention requirements.
  • Right of Access: You can request confirmation and copies of personal data held about you.
  • Right to Rectification: You may request corrections to any inaccurate, outdated, or incomplete information.
  • Right to Object: You have the right to object to processing on reasonable grounds, including direct marketing.
  • Right to Withdraw Consent: You may withdraw previously provided consent at any time.
  • Right to Lodge a Complaint: If you believe your personal data rights have been infringed, you may lodge a complaint with the South African Information Regulator:

10. Contact the Information Officer

If you have questions, privacy requests, or wish to exercise your Right to Request Deletion (Right to be Forgotten), please contact our Information Officer: