Privacy Policy
Version 2026-09-24 · How Qondi ("we") collects and uses your personal information, under the Protection of Personal Information Act 4 of 2013 (POPIA).
The short version
- We collect what we need to tutor you: your account details, what you tell us about how you learn, what you upload, and your lessons.
- We send your questions and uploads to our AI provider to get Qondi's replies. Nobody uses them to train AI models.
- We don't sell your information and we don't use advertising trackers.
- If you're under 18, we need your parent or guardian's consent first.
- You can download or delete your data, or clear what Qondi remembers about you, at any time in Settings → Your data.
1. Who is responsible for your information
Responsible party: Daiyin Naicker, 516 Belmont Road, Rondebosch, Cape Town, 7700, registration number Not applicable (sole proprietor, not a registered company). Information Officer: hello@qondi.co.za.
Contact our Information Officer about anything in this policy.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Early-access list | your name, email, where and what you study, if you ask for an invite before sign-ups open | you |
| Account details | name, email, password (stored only as a secure scrambled hash), birth month and year | you |
| Parent or guardian details (learners under 18) | guardian's name and email, and the record of their consent | you and your guardian |
| Learning profile | grade or year, curriculum, school or university, language, how you like to learn, your goals, exam dates | you |
| Your content | notes, documents, photos, screenshots and snips, questions, answers, test attempts | you |
| Lessons | your conversations with Qondi, lesson plans, study guides, practice tests and marks | created as you use Qondi |
| Qondi's notes about you | topics you find tricky, mix-ups, strengths, how you learn best, topic mastery scores | written by Qondi's AI from your lessons and tests |
| Payments | plan, amount, date, PayFast payment reference and subscription token (never your card number) | PayFast |
| Usage and security | messages used, AI usage per month, login session cookie, basic server logs (such as IP address and time) kept for security | automatically |
| Reports | answers you flag as wrong or inappropriate, with your note | you |
Sensitive information. We don't ask for "special personal information" such as health, religion or beliefs, or criminal history. Please don't include it in your lessons. If you do mention something personal (for example, that you're feeling anxious), Qondi uses it only to reply to you kindly. It stays part of that lesson, which you can delete at any time.
Voice. When voice is on, the text of Qondi's reply is sent to our speech provider (Microsoft Azure, or ElevenLabs if we switch) to be turned into Qondi's spoken voice. It sends only the words Qondi is saying, never your name or account details, and the provider doesn't keep the audio. If that service isn't available, your device's built-in voice reads the reply instead. When you hold Space to talk, speech recognition is done by your browser. Some browsers, such as Google Chrome and Microsoft Edge, send the audio to their own servers to turn it into text, under their privacy policies. Qondi never receives your audio, only the text. Don't use the microphone if you'd rather not have your audio processed this way; you can type instead.
Snipping tools. The Qondi browser extension (Chrome and Edge) and the Qondi Snip Windows app only look at your screen when you press their shortcut or button. They send Qondi only the part you snip, and only when you press Ask. They don't read your browsing history, other tabs or files, and they don't run in the background watching what you do. The extension uses your normal Qondi login and stores nothing about the pages you visit. If you tap the mic in the snip box, your browser's speech service turns what you say into text (Google for Chrome, Microsoft for Edge, under their privacy policies); Qondi only receives the text. The Windows app keeps a connection key on your computer, which you can disconnect at any time in Settings.
3. Why we use it, and our legal basis (POPIA section 11)
| Purpose | Legal basis |
|---|---|
| Creating your account and tutoring you: replies, study guides, tests, marking | Needed to perform our agreement with you (s11(1)(b)). For learners under 18, the prior consent of a parent or guardian (s35(1)(a)) |
| Remembering how you learn so that each lesson builds on the last | As above. You can clear this memory at any time |
| Billing and preventing payment fraud | Needed for our agreement, and to meet legal obligations (s11(1)(b)–(c)) |
| Keeping Qondi secure, fixing bugs, stopping abuse, reviewing flagged answers | Our legitimate interest in a safe, working service (s11(1)(f)) |
| Improving Qondi, using usage statistics and flagged answers | Legitimate interest. We use the least information needed, and never to train AI models |
| Keeping tax and accounting records | Legal obligation, such as the Tax Administration Act (s11(1)(c)) |
| News and offers by email | Only with your consent (s69). You can unsubscribe at any time |
You can object to processing based on legitimate interest (s11(3)) by emailing hello@qondi.co.za.
Automated insights. Qondi's AI estimates how well you know each topic and writes study notes about you. These are study aids only. They are not used to make decisions that have legal or similarly significant effects on you (s71). You can see them on your Progress page and delete them.
4. Who we share it with
We never sell your personal information. We share it only with service providers who process it for us under written agreements that require them to keep it confidential and secure (POPIA ss20–21):
| Provider | What they do | Where |
|---|---|---|
| Anthropic (Claude AI) | Generates Qondi's replies, study guides, tests, marking and notes from your lessons and uploads | USA |
| Vercel | Hosts the app and counts visits anonymously (no cookies) | USA |
| Database provider | Stores data | [confirm provider and region before launch] |
| PayFast | Processes payments | South Africa |
| Email provider | Sends account and guardian-consent emails | [confirm before launch] |
| Microsoft Azure (speech) | Turns the text of Qondi's replies into Qondi's spoken voice | [confirm region before launch, e.g. South Africa North] |
We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or merger of the business, with the same protections continuing.
5. Sending information outside South Africa (POPIA section 72)
Our AI provider processes information in the United States. We only transfer it where the recipient is bound by contract to protections substantially similar to POPIA, including confidentiality, security and not using your data to train its models. For learners under 18, the transfer is also covered by the guardian's consent.
6. How long we keep it (POPIA section 14)
| Information | Kept for |
|---|---|
| Account, profile, lessons, uploads, Qondi's notes | While your account is open. Deleted within 30 days after you delete your account. |
| Early-access list | Until we send your invite, and never more than 12 months. Ask us to remove you any time |
| Accounts with no sign-in for 24 months | We email a warning, then delete the account |
| Backups | Overwritten on a rolling schedule within 90 days |
| Payment and invoice records | 5 years, as tax law requires. They are unlinked from your deleted profile |
| Consent records (including guardian consent) | As long as needed to show valid consent was given, then deleted |
| Security logs | Up to 90 days |
Our AI provider may keep API data for a short period for trust and safety purposes, under its commercial terms. It then deletes it.
7. How we protect it (POPIA section 19)
Measures include encrypted connections (HTTPS), passwords stored only as salted scrypt hashes, access limited to people who need it, and each learner's files kept separate. We also choose providers with strong security. Payment card data is handled by PayFast, never by us.
If a security breach affects your information, we will tell the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.
8. Your rights
You can:
- see the information we hold about you (s23). In the app, use Settings → Your data → Download my data;
- correct it, in Settings, or ask us to (s24);
- delete it, using Settings → Your data → Delete my account, or clear Qondi's memory of you;
- object to processing based on legitimate interest, and withdraw consent at any time. This doesn't affect processing that happened before;
- opt out of marketing at any time;
- complain to the Information Regulator: inforegulator.org.za.
We respond to requests within 30 days. Requests are free, except where our PAIA manual allows a prescribed fee for access to records.
9. Children
POPIA treats everyone under 18 as a child. We don't let under-18s use Qondi until a parent or guardian has confirmed consent by email. Parents and guardians can exercise all of the rights above for their child. See Children & Parents.
10. Cookies
We use one essential login cookie and store one setting in your browser. There are no advertising trackers. We count visits anonymously, without cookies (Vercel Web Analytics, Speed Insights and our own live visitor count, which forgets each visit after 10 minutes). See Cookies & Local Storage.
11. Changes
If we change this policy in an important way, we'll tell you in the app or by email before the change applies. Where needed, we'll ask for your consent again.
12. Contact
Information Officer: hello@qondi.co.za Our PAIA manual explains how to request records.