How Shuter Nexus collects, uses, and protects your personal information under POPIA
This Privacy Policy explains how Shuter & Shooter Publishers (Pty) Ltd ("Shuter Nexus", "we", "us") collects, uses, stores, shares, and protects the personal information of everyone who uses the Shuter Nexus platform at edulinkhub.online, including:
We are the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA"). This means we are accountable for all personal information we collect and process through this Platform.
Our Information Officer is responsible for overseeing POPIA compliance and handling data subject requests.
If you have a question about your data or want to exercise your rights, contact our Information Officer at the address above.
We collect only the personal information we need to provide the service.
| Category | Examples |
|---|---|
| Identity and profile | Name, surname, grade, school name, account type |
| Login credentials | Username (generated or email), hashed password — we never store plain-text passwords |
| School and class data | School registration code, class membership, subject enrolment |
| Educational records | Quiz results, assignment submissions, lesson progress, teacher feedback, grades |
| AI conversation content | Messages sent to and received from AI tutors and the Kwazi chatbot |
| AI usage metadata | Feature used, AI model used, token count, estimated cost, timestamps |
| Device and access logs | IP address, device type, browser, login times — for security purposes only |
| Uploaded files | Assignment documents, images, or other files you upload to the Platform |
| Communications | Messages sent to our support team via the contact form or email |
| Consent records | Records of when and how parental or school consent was obtained |
We do not currently collect biometric data, health information, racial or ethnic origin, political opinions, religious beliefs, or criminal records. If this changes, we will update this policy and obtain the appropriate consents.
We process personal information only where we have a lawful basis under POPIA section 11.
| Processing activity | Lawful basis |
|---|---|
| Creating and managing your account | Necessary to perform the service you requested |
| Delivering AI tutoring, quizzes, assignments, and lessons | Necessary to perform the service; school educational function |
| Generating learner progress reports for teachers | Educational function; legitimate interests of the school and learner |
| AI usage logging for cost control and billing | Legitimate interests of Shuter Nexus; contractual necessity with schools |
| Security logging (IP, access, session logs) | Legitimate interests in securing the Platform; POPIA security obligations |
| Processing children's personal information | POPIA sections 34–35 — prior consent of a competent person, or school educational function with appropriate safeguards |
| Sending service communications (password reset, notifications) | Necessary to perform the service |
| Sending optional marketing or product news | Your consent (opt-in only) |
What this means in practice:
Shuter Nexus uses external AI services to power its tutoring, quiz, and chatbot features.
| Provider | Data handling |
|---|---|
| Anthropic (Claude API) Primary — all AI tutoring |
Prompts and completions are not used to train Anthropic models by default under the API agreement. Anthropic explicitly permits organisations serving minors to use their API with safety measures and AI disclosure in place, which we have implemented. |
We use AI only for educational support, explanation, and feedback. We do not use AI to make final decisions about learners' grades, promotion, welfare, or discipline. Those decisions remain with teachers and school administrators.
Our platform uses services that may store or process data outside South Africa. In all cases, we require our service providers to treat your data with protections substantially equivalent to POPIA's requirements.
| Service | Purpose | Location | Transfer basis |
|---|---|---|---|
| Supabase (PostgreSQL database) | Primary data storage | EU (South Africa region where available) | Standard contractual protections |
| Anthropic (Claude AI) | AI model inference | USA | Consent where required; legitimate interests; contractual protections |
| Hostinger (web hosting) | Platform hosting | EU/Lithuania | Standard contractual protections |
We will not transfer a child's personal information to a third party in a foreign country without ensuring that the transfer meets the requirements of POPIA section 72 and, where required, obtaining prior authorisation from the Information Regulator under POPIA section 57.
We keep personal information only for as long as necessary.
| Data type | Retention period |
|---|---|
| Learner account profile and school linkage | Active account + 3 years after last activity |
| Assessments, submissions, quiz results, teacher feedback | 5 years after the end of the relevant academic year |
| AI conversation transcripts | 12 months from the date of the conversation |
| AI usage metadata (pseudonymous) | 24 months |
| Teacher and school admin accounts | Active account + 3 years after last activity or contract end |
| Parental consent and policy acceptance records | Life of account + 5 years |
| Billing and payment records | 5 years after the transaction or contract end |
| Support and helpdesk records | 24 months after the ticket is closed |
| Security and access logs | 12 months |
| De-identified analytics | Indefinite, only where genuinely de-identified |
When the retention period ends, we delete, destroy, or de-identify the relevant records.
Our technical and organisational security measures include:
If we become aware that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with POPIA section 22.
Under POPIA, you have the right to:
To exercise any of these rights, contact our Information Officer at esupport@shuter.co.za. We will respond within a reasonable time and will not charge a fee for ordinary requests.
For learners under 18, these rights are exercised by the learner or their competent person, depending on the nature of the request and the learner's age and maturity.
We will only send you marketing communications if you have opted in. Service communications — such as password resets, account notifications, class invitations, and school announcements — are not marketing and are sent as part of the service.
You may opt out of optional marketing communications at any time by contacting us at esupport@shuter.co.za or using the unsubscribe link in any marketing email.
The Platform uses browser local storage and session storage to maintain your login session and save your preferences (such as dark mode and low-data mode). We do not use third-party advertising trackers or behavioural advertising cookies.
If you clear your browser storage, you will be logged out and your local preferences will reset.
We will update this Privacy Policy as the Platform grows and as our legal obligations evolve. When we make material changes, we will notify registered users by email or in-platform notification at least 14 days before the changes take effect. The updated policy will always be available at edulinkhub.online/privacy.
See also our Terms of Use.