Privacy Policy

Version 2026-10-10

KHULA processes personal information in line with the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, who sees it, how long we keep it and the rights you have. KHULA is the responsible party. Questions go to our Information Officer at privacy@khula.app.

1. What we collect

  • Account details: name, email, phone number, date of birth, province, school or club, role and time zone.
  • Development data: schedules and reminders, training and match stats, study sessions, meals and pantry, reflections, goals, quiz results and leaderboard points.
  • Special personal information: wellbeing check-ins, injuries and optional cycle tracking. These are used only to support you, are never shown to scouts, coaches or sponsors, and are only seen by KHULA safeguarding staff if a check-in suggests you may be at risk.
  • Uploads: profile photos, verification documents (for tutors, coaches, referees, scouts and other professionals), study files and community images.
  • Payment records. Card details are handled by Paystack and never stored by KHULA. For people we pay, we keep the bank name and the last four digits of the account only.
  • Technical data: device and browser type, IP address for security logs, and push notification tokens.

2. Children and guardian consent

Athletes under 18 need a parent or guardian to give consent (POPIA section 35) before payments, community features, contact with coaches or mentors, and scout visibility are switched on. Every coach, mentor or scout who asks to contact a minor or see their data also needs the guardian's approval. The guardian sees the information the athlete has allowed and can withdraw consent at any time from their KHULA account. Minors are never publicly searchable, only see community content from their own age group, and adults can only contact them through approved, logged channels.

3. Why we use it

  • To build your schedule, send reminders, track progress and personalise meals and training (performing our agreement with you).
  • To take payments, pay tutors, mentors and organisers, and keep tax records (legal obligation).
  • To keep the community safe: moderation, fraud and cheating detection, safeguarding alerts (legitimate interest and protecting children).
  • To show you to verified scouts, but only if you (or your guardian) switch on scout visibility (consent).
  • To send marketing, but only if you opt in (consent). Service messages such as reminders and receipts are not marketing.

4. Who we share it with

We never sell personal information. We share it only with:

  • People you or your guardian approve: guardians, coaches, scouts, tutors and mentors you book or grant access to. You can see and revoke access in Privacy & access.
  • Service providers who process data on our behalf: Vercel (hosting), Neon (database), Cloudinary (file storage), Paystack (payments), Resend (email), web push services, Upstash (rate limiting), TheMealDB (recipe search, which receives ingredient names only) and, where enabled, OpenAI (content moderation of text and images, with no account details attached).
  • Authorities where the law requires it, or where a child's safety is at risk.

Some providers store data outside South Africa (for example in the EU or US). We only use providers bound by data-protection terms that give protection comparable to POPIA (section 72).

5. How long we keep it

  • While your account is active, we keep your data so the app works.
  • If you delete your account, we wait 14 days (in case of a mistake), then permanently remove or anonymise your personal information.
  • Payment, payout and registration records are kept for 5 years, as tax and anti-money-laundering laws require, linked only to an anonymous id.
  • Consent records, safeguarding reports and security audit logs are kept for 5 years to prove lawful processing and protect children.
  • Verification documents are deleted with your account, or on request once your role is verified.

6. Your rights

  • Access: download a copy of your data at any time from Account → Your data.
  • Correction: edit your profile in the app, or ask us to fix anything you can't edit.
  • Deletion: delete your account from Account → Your data.
  • Objection and withdrawal: switch off scout visibility, marketing and optional tracking whenever you like.
  • Complaints: contact privacy@khula.app first. You can also complain to the Information Regulator (inforeg.org.za, complaints.IR@inforegulator.org.za).

7. Security

Data is encrypted in transit, passwords are hashed with bcrypt, private files are served only through short-lived signed links, access is limited by role and sensitive admin actions are audit-logged. If a breach affects your information we will tell you and the Information Regulator as POPIA section 22 requires.

8. Changes

If we change this policy in a way that affects you, we'll tell you in the app and ask for your consent again where the law requires it.