Privacy Notice

Version 2026-07-24 · Template — review with legal counsel before production use.

Privacy Notice (POPIA)

This notice explains how Socratic Scholar ("we", "us") processes your personal information in line with the Protection of Personal Information Act, 4 of 2013 ("POPIA").

1. Responsible party

The operator of Socratic Scholar is the responsible party for personal information processed on the Platform. Contact for privacy queries, access, or deletion requests: [operator contact — to be supplied].

2. Personal information we collect

• Account: email address, password (hashed by our auth provider).
• Academic profile: degree level, discipline, institution, topic area, motivation, prior reading, data access, timeline, supervisor name, career goal, blockers.
• Research artefacts: chat messages with the tutor, question versions, proposal sections, uploaded literature and derived summaries, milestones, feedback surveys.
• Technical: session logs, feature-usage events, timestamps.

3. Purpose and lawful basis

• Delivering the tutoring service you signed up for (contract).
• Improving the Platform and researching tutoring effectiveness (consent).
• Aggregate reporting to funders and academic partners (legitimate interest).
• Complying with legal obligations.

4. Sharing and processors

We use the following operators (processors) to run the Platform:

• Supabase — database, authentication, and file storage.
• Lovable AI Gateway (Google Gemini) — AI tutoring, critique, and metadata extraction.
• Hosting infrastructure (Cloudflare).

These operators process personal information on our instructions and under contract. Some processing occurs outside South Africa. By accepting this notice you consent to cross-border transfer for the purpose of AI processing and hosting.

5. Admin visibility

Platform administrators can view aggregated metrics (counts, pass rates, NPS) and individual account metadata (email, degree, discipline, institution) to support you and report on Platform effectiveness. Administrators do not read the contents of your uploaded literature or personalised Lab explanations. Other students cannot see any of your data.

6. Retention

We keep your account and research artefacts for as long as your account is active. When you delete your account, related personal information is deleted within 30 days, except for records we are legally required to keep. Aggregated, de-identified research metrics may be retained indefinitely.

7. Your rights under POPIA

• Access the personal information we hold about you (section 23).
• Request correction or deletion of inaccurate or outdated information (section 24).
• Object to processing based on legitimate interest.
• Withdraw consent for processing based on consent (this may limit Platform features).
• Lodge a complaint with the Information Regulator (South Africa).

8. Security

We rely on our operators' security controls including encryption in transit, encryption at rest, row-level access control, and least-privilege administration. No system is perfectly secure — you are responsible for keeping your password confidential.

9. Children

The Platform is intended for university students aged 18 and over. We do not knowingly collect information from children.

10. Changes to this notice

We may update this notice. Material changes will bump the version and require your acceptance at your next sign-in.

By checking "I accept" you confirm that you have read, understood, and consent to the processing of your personal information as described above.