Privacy Policy — KovaVerse

1. Who we are

KovaVerse is an educational platform for South African children aged 6–18, operated by KovaVerse (Pty) Ltd (“we”, “us”, “our”). We are committed to protecting the privacy of children and their families in accordance with the Protection of Personal Information Act, 2013 (POPIA) and applicable child protection legislation.

Questions about this policy: privacy@kovaverse.co.za

2. Information we collect

We collect only what is necessary to deliver the service.

From parents / guardians

Name — to personalise your account
Email address — to send assessment results, your child's sync code, and account communications
Payment information — processed entirely by PayFast. We never store card numbers or banking details.

From children (via parent account)

First name and age — to personalise the learning experience
Assessment responses — to determine starting level and personalise the learning path
Learning progress — missions completed, XP earned, time spent learning
Handwriting input — canvas snapshots sent to our AI for evaluation and immediately discarded. We do not store handwriting images.

Automatically collected

Device type and operating system (for app compatibility)
App usage analytics (session length, feature usage) — anonymised

3. How we use this information

To deliver the KovaVerse learning platform and personalise each child's journey
To evaluate handwritten answers using AI (Claude by Anthropic) — results only, images discarded immediately
To send parents assessment reports and account-related communications
To process subscription payments via PayFast
To improve the platform through anonymised usage analytics

We do not use personal information for advertising, sell data to third parties, or use children's data for profiling outside of the learning context.

4. Children's privacy (POPIA — special conditions for children)

KovaVerse is designed for children. We comply with POPIA's special conditions for the processing of personal information of children (section 35).

All child accounts are created and controlled by a parent or legal guardian
We require verifiable parental consent before processing a child's personal information
Children do not interact directly with payment systems or marketing communications
We do not knowingly collect personal information from children without parental authorisation
Parents may request deletion of their child's data at any time (see section 7)

5. Data storage and security

Data is stored on Google Firebase (Firestore) with servers in the EU and US. Firebase complies with GDPR, ISO 27001, and SOC 2.
All data is encrypted in transit (TLS 1.2+) and at rest
Learning progress is also stored locally on your device (AsyncStorage) so the app works offline
Handwriting images are processed in memory only and never written to disk or cloud storage
We retain your data for as long as your account is active, plus 12 months after account closure for legal compliance

6. Third parties we use

Service	Purpose	Data shared
Google Firebase	Authentication, database, cloud functions	User ID, learning data
PayFast	Payment processing	Name, email, amount — no card data stored by us
Anthropic (Claude)	Handwriting evaluation AI	Canvas image (discarded after evaluation)
Resend	Transactional email	Parent name and email address

No other third parties receive personal information from KovaVerse.

7. Your rights (POPIA)

As a data subject you have the right to:

Access — request a copy of the personal information we hold about you
Correction — request that inaccurate information be corrected
Deletion — request that your account and all associated data be deleted
Objection — object to the processing of your personal information
Complaint — lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email us at privacy@kovaverse.co.za. We will respond within 30 days.

Information Regulator (South Africa): www.justice.gov.za/inforeg · inforeg@justice.gov.za · 012 406 4818

8. Cookies

The KovaVerse website uses only essential session cookies required for authentication and checkout. We do not use advertising, tracking, or analytics cookies. No cookie consent banner is required.

The KovaVerse mobile app uses AsyncStorage (device local storage only) — no cookies.

9. Changes to this policy

We may update this policy when our practices change. We will notify you by email and update the “Last updated” date above. Continued use of KovaVerse after changes constitutes acceptance of the updated policy.

10. Contact

KovaVerse (Pty) Ltd
South Africa
privacy@kovaverse.co.za