Privacy Policy

1. Introduction

TutorLink (Pty) Ltd (“TutorLink”, “we”, “us”, or “our”) is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the TutorLink platform (the “Platform”).

This policy is drafted in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) of the Republic of South Africa. By using the Platform, you consent to the processing of your personal information as described in this policy.

2. Information We Collect

We collect the following categories of personal information:

• Account information: Your name, email address, and password (stored in hashed form) when you register.
• Profile information (tutors): University, department, subjects offered, hourly rate, bio, profile photo, and WhatsApp number.
• Authentication data: If you sign in via Google OAuth, we receive your name, email address, and profile picture from Google.
• Payment information: We do not store credit card or banking details. Payment processing is handled by our third-party payment provider (Ozow). We receive a transaction reference and status only.
• Usage data: IP address, browser type, pages visited, and actions taken on the Platform, collected via server logs and analytics tools.
• Communications: Emails you send to our support team.

3. How We Use Your Information

We process your personal information only for lawful purposes, including:

• Creating and managing your account and tutor profile.
• Displaying tutor profiles to students browsing the Platform.
• Processing subscription payments and issuing receipts.
• Sending transactional emails (e.g. email verification, password reset, subscription confirmation).
• Improving the Platform through aggregate, anonymised analytics.
• Complying with our legal obligations under South African law.
• Preventing fraud and enforcing our Terms of Service.

We do not sell your personal information to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects without your consent.

4. Storage and Security

Your data is stored on servers hosted with Amazon Web Services (AWS) in the Africa (Cape Town) region (af-south-1). We use industry-standard security measures including:

• Encrypted connections (TLS/HTTPS) for all data in transit.
• Encrypted database storage at rest.
• Bcrypt hashing for passwords — we never store passwords in plain text.
• Role-based access controls limiting who can access production data.

Despite these measures, no system is completely secure. You use the Platform at your own risk and are responsible for keeping your credentials safe.

5. Sharing with Third Parties

We share your personal information only in the following circumstances:

• Service providers: We share data with trusted third-party providers that help us operate the Platform, including AWS (hosting), Ozow (payment processing), and Amazon SES (email delivery). These providers act as operators under POPIA and are contractually required to process your data only as instructed by us.
• Legal requirements: We may disclose your information where required by law, a court order, or a lawful request by a South African government authority.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred. We will notify affected users in advance.

Tutor profiles — including name, university, subjects, hourly rate, and contact details — are publicly visible to all Platform users by design. Tutors should not include information on their profile that they do not wish to be publicly visible.

6. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act (POPIA), you have the following rights:

• Right to access: You may request a copy of the personal information we hold about you.
• Right to correction: You may request that we correct inaccurate or incomplete personal information.
• Right to deletion: You may request that we delete your personal information, subject to our legal obligations to retain certain records.
• Right to object: You may object to the processing of your personal information in certain circumstances.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za.

7. Retention of Data

We retain your personal information for as long as your account is active or as needed to provide our services. If you request deletion of your account, we will delete or anonymise your personal information within 30 days, except where we are required by law to retain it for longer (e.g. financial records, which we retain for five years as required by the Tax Administration Act).

8. Cookies and Analytics

The Platform uses strictly necessary session cookies to keep you logged in. We may use anonymised analytics data to understand how users interact with the Platform. We do not use third-party advertising cookies or tracking pixels.

9. Contact for Data Requests

To exercise any of your rights under POPIA, or if you have any questions or concerns about how we handle your personal information, please contact our Information Officer at:

We will respond to all data requests within 30 days as required by POPIA.