Privacy policy

Who we are

UpMark is a South African online marketplace that matches Grade 8–12 students with independent tutors across Maths, Physical Sciences and 11 more CAPS subjects. In this policy, “we”, “us” and “UpMark” mean the operator of the UpMark platform. We are the responsible party (data controller) for the personal information described here. If you have any questions, email us at support@upmarktutoring.com.

Information we collect

We only collect what we need to run the service:

• Account details — your name, email address, phone number, gender (if you choose to share it), and password (stored only as a secure hash, never in plain text).
• Learner profile — grade, subjects, learning goals and preferences, and general area, so we can match you with a suitable tutor.
• Children’s details — where a parent or guardian manages the account, the child’s name, grade, date of birth and learning preferences, provided by the parent. See “Children’s information” below.
• Tutor details — for tutors, your qualifications, subjects, rates, availability, and the verification documents you upload (ID and proof of results).
• Payment information — bookings are paid in ZAR through Paystack. Paystack processes your card details on their secure systems; we never see or store your full card number. We keep a record of transactions (amounts, dates, status) to manage bookings, payouts and refunds.
• Messages — messages you exchange with a tutor or student through the platform, so the conversation is available to both parties.
• Technical information — basic data needed to keep you signed in and keep the service secure (for example, session cookies and standard server logs).
• Usage statistics — counts of which pages are visited and which steps are taken (for example opening sign-up or booking a seat), and which campaign link brought a visitor here, collected with Vercel Web Analytics. It sets no cookies and does not record your name, email address or account. Your browser keeps the campaign name (such as “whatsapp”) for 30 days so a later sign-up can be counted against it.

Why we use it

We use your information to:

• match students with suitable tutors and show relevant profiles;
• set up and manage bookings, lessons and your account;
• process payments, tutor payouts and refunds;
• verify tutors so students and parents can trust who they book;
• let you message the other party about a lesson;
• keep the platform safe and prevent fraud or abuse;
• see, in total, which pages and campaigns bring people here and where they stop;
• meet our legal and tax obligations.

We do not sell your personal information, and we do not use children’s information for marketing.

How it's stored and protected

Your data is stored in a Postgres database hosted by Supabase, with row-level security so each account can only reach the records it needs: your own, and what you share with a tutor or a linked parent. Traffic is encrypted in transit, passwords are hashed, and tutor verification documents are kept in private storage accessible only to you and, where needed, our review team. The application is hosted on Vercel. We limit staff access to personal information to what’s needed to operate and support the service.

Who we share it with

We share personal information only where it’s needed to provide the service:

• Tutors and students — when you book, the other party sees the limited details needed for the lesson (for a student, the learner’s first name, grade and relevant preferences, and, for an in-person lesson, the address you saved for it; for a tutor, their public profile).
• Paystack — our payments provider, to take payment and pay tutors.
• Supabase — our database, authentication and file-storage provider.
• Vercel — our hosting and usage-statistics provider.
• Resend — sending our emails: your name, email address and the booking it’s about.
• Upstash — blocking abuse: your IP address and account id.
• Google — finding addresses and distances, and Google sign-in if you use it.
• Authorities — if the law requires it, or to protect someone’s safety.

These providers act as our operators (processors) and may store data outside South Africa; where they do, we rely on their security and contractual safeguards. We don’t sell or rent your data to anyone.

Children's information

UpMark is built for high-school learners in Grade 8–12, many of whom are under 18. A learner under 18 may have their own account, or a parent or guardian may create and hold a profile for them. South African law says a parent or guardian must agree before we handle the details of anyone under 18. So a learner under 18 who books for themselves confirms, for each booking, that a parent or guardian knows about it and agrees — we record that confirmation with the time, the device's IP address and its browser, as evidence of what was confirmed — or they link a parent account, and the parent approves and pays for what they book. We collect only what's needed to arrange and track lessons (the learner's name, grade, date of birth and learning preferences), and we don't market to children. Tutors are told that a learner is under 18, never their date of birth, and are reminded in any conversation with a learner under 18 that a parent may read it. A linked parent can read their child's conversations with tutors while the child is under 18. If a parent tells us they didn't agree to a booking, we cancel the child's future lessons, refund them to whoever paid, and from then on the child can book only through a linked parent.

A parent or guardian can ask us to remove their child's details at any time — email us. We anonymise them, as described below, and keep only the financial records we are required to keep.

Your rights under POPIA

You have the right to:

• ask what personal information we hold about you (or your child);
• ask us to correct or update it;
• ask us to anonymise it, where we’re not required to keep it;
• object to certain processing;
• complain to the Information Regulator (South Africa) if you believe we’ve mishandled your information.

To exercise any of these, email support@upmarktutoring.com. Much of it you can also do yourself from your account settings.

Deleting your account and your information

When you ask us to delete your account, we remove your name, contact details and profile from UpMark and we disable your sign-in when you ask us to. Our encrypted backups are kept for a limited time and then deleted; we don't restore your details from them except to recover from a fault. What remains is the record that a lesson happened, what it cost and who was paid — with no identifying details attached to it. We keep that because we are required to keep financial records, and because our safety and payment logs are written so that they cannot be edited after the fact, which is what makes them worth anything if a dispute or an investigation ever needs them.

You can ask us at any time what we hold about you, ask us to correct it, or ask us to anonymise your account. Write to us and we will answer. If you think we have handled your information wrongly, you can complain to the Information Regulator of South Africa.

How long we keep it

We keep your information for as long as your account is active and for a reasonable period afterwards, then delete or anonymise it — except where we’re legally required to keep records longer (for example, transaction records for tax and accounting).

Cookies

We use essential cookies to keep you signed in and to keep the service secure. We don’t use advertising or third-party tracking cookies.

Changes to this policy

We may update this policy as the service grows or the law changes. When we make a material change, we’ll update the date at the top and, where appropriate, let you know.

Contact us

Questions about your privacy? Email support@upmarktutoring.com. See also our Terms of Service.